Solved

Best Practices for VMWare, VCenter, SAN topology and configuration

Posted on 2014-01-09
3
1,711 Views
Last Modified: 2014-01-09
Can someone let me know if this sounds like a normal VMWare deployment scenario?

We are having an outside consultant setup our virtual infrastructure and from what I've seen so far, I have some concerns.

1. The management network, VMotion network, and SAN network are all on the same IP subnet, but different VLANS and different physical ports.  They are on separate virtual switches within VCenter, which I was told was the reason the overlap doesn't matter.  I'm having a hard time wrapping my head around how the server even knows which port to send traffic out of.  If I was to try and setup a router with overlapping subnets on different interfaces, it wouldn't even let me bring both of them online at the same time.  I was told it was set up this way because VCenter had to have access to the SAN, but I've looked at more than a few network diagrams of VCenter deployments, and non of them show the VCenter server with a direct link to the storage VLAN.  I've also never seen the management subnet overlapping the SAN or VMotion networks.  

2.  We are having some major problems just doing a P2V on a print server.  If I'm reading the documentation correctly for the stand alone converter; once the agent is installed on the physical machine, it has to have access to the management network to setup and deliver the VM to the ESXi host, which requires routing since they are on a different subnet from the production LAN.  The only device we have available for that task is already overworked, so we don't want to push that additional traffic through it.  

When I suggested moving the management traffic to the production network until the conversions are finished, I was told that it wouldn't be a good idea because the SAN would need to be reconfigured for the production network as well.  

Now, I'm not a storage expert by any stretch, but I believe I understand the theory and I've played around a bit with a couple ESXi hosts and OpenFiler as an iSCSI target.    

As I understand it, the SAN traffic should be as isolated as possible from the production network.  The only things that should be hooked up are the physical ESXi hosts and the device(s) serving as the iSCSI target itself.  

The consultant seems to believe that when the physical server is converted, that the agent needs to deliver the data directly to the SAN and not to one of the ESXi hosts.  One of us seems to have a fundamental misunderstanding about how a SAN works, and I actually hope it's me, because the alternative isn't pleasant to think about.
0
Comment
Question by:KMDComp
  • 2
3 Comments
 
LVL 119

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE^2) earned 500 total points
ID: 39767555
1. The management network, VMotion network, and SAN network are all on the same IP subnet, but different VLANS and different physical ports.  They are on separate virtual switches within VCenter, which I was told was the reason the overlap doesn't matter.  I'm having a hard time wrapping my head around how the server even knows which port to send traffic out of.  If I was to try and setup a router with overlapping subnets on different interfaces, it wouldn't even let me bring both of them online at the same time.  I was told it was set up this way because VCenter had to have access to the SAN, but I've looked at more than a few network diagrams of VCenter deployments, and non of them show the VCenter server with a direct link to the storage VLAN.  I've also never seen the management subnet overlapping the SAN or VMotion networks.  

Improvements could be made, but different clients do different things.

vCenter does not access the SAN, only the Hosts are connected to the SAN.

Different physical ports are correct, different vSwitches are correct, same IP ok, but usually you would create different IP networks, but your networks are separated by VLANs.

Storage Traffic is sent over VMKernel Portgroups, Management Network is sent over Management Network, vMotion is tagged onto a VMKernel Portgrpoup, which should really be isolated if you have network interfaces and VLANs.

e.g.

Management Network - at least two nics - IP Address here
vMotion - at least two nics - IP Address here
VMs - at least two nics (VMs pass through this switch)
Storage Network - at least two nics (IP Address here)

As I understand it, the SAN traffic should be as isolated as possible from the production network.  The only things that should be hooked up are the physical ESXi hosts and the device(s) serving as the iSCSI target itself.  

Correct.

HOW TO: Add an iSCSI Software Adaptor and Create an iSCSI Multipath Network in VMware vSphere Hypervisor ESXi 5.0

HOW TO: Enable Jumbo Frames on a VMware vSphere Hypervisor (ESXi 5.0) host server using the VMware vSphere Client


2.  We are having some major problems just doing a P2V on a print server.  If I'm reading the documentation correctly for the stand alone converter; once the agent is installed on the physical machine, it has to have access to the management network to setup and deliver the VM to the ESXi host, which requires routing since they are on a different subnet from the production LAN.  The only device we have available for that task is already overworked, so we don't want to push that additional traffic through it.  

Correct - P2V can be troublesome.

see my EE Article, Step by Step Tutorial Instructions with Screenshots

HOW TO: FAQ VMware P2V Troubleshooting

HOW TO:  P2V, V2V for FREE - VMware vCenter Converter Standalone 5.5

HOW TO: Improve the transfer rate of a Physical to Virtual (P2V), Virtual to Virtual Conversion (V2V) using VMware vCenter Converter Standalone 5.0

It's recommended, to install VMware Converter on the computer to be converted.

When I suggested moving the management traffic to the production network until the conversions are finished, I was told that it wouldn't be a good idea because the SAN would need to be reconfigured for the production network as well.  

Now, I'm not a storage expert by any stretch, but I believe I understand the theory and I've played around a bit with a couple ESXi hosts and OpenFiler as an iSCSI target.    

As I understand it, the SAN traffic should be as isolated as possible from the production network.  The only things that should be hooked up are the physical ESXi hosts and the device(s) serving as the iSCSI target itself.  

The consultant seems to believe that when the physical server is converted, that the agent needs to deliver the data directly to the SAN and not to one of the ESXi hosts.  One of us seems to have a fundamental misunderstanding about how a SAN works, and I actually hope it's me, because the alternative isn't pleasant to think about.

Management Network should be on Production Network, unless you have an isolated Management Network for ALL devices.

SAN reconfigured for Production Network, - not sure what is going on here.

SAN traffic should be on it's on network, physical is best, or VLAN etc

Not sure what the last paragraph is about Agents....? which agent?

ESXi <----> SAN

On the SAN, the VMs are stored, and when powered ON, VM traffic goes through ESXi VM vswitch
0
 

Author Comment

by:KMDComp
ID: 39767671
The way they are trying to do the P2V is by installing the converter on the VCenter VM and pushing a remote agent to the physical machine.  The agent then takes care of the P2V which can be monitored from the other server.  The consultant seems to think that the agent copies the physical machine's drives directly to the SAN, even bypassing the ESXi hosts.

Thanks a lot for your response, and I'll check out the links.
0
 
LVL 119
ID: 39767756
It does not copy direct to the SAN!
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If we need to check who deleted a Virtual Machine from our vCenter. Looking this task in logs can be painful and spend lot of time, so the best way to check this is in the vCenter DB. Just connect to vCenter DB(default DB should be VCDB and using…
Many businesses neglect disaster recovery and treat it as an after-thought. I can tell you first hand that data will be lost, hard drives die, servers will be hacked, and careless (or malicious) employees can ruin your data.
Teach the user how to use create log bundles for vCenter Server or ESXi hosts Open vSphere Web Client: Generate vCenter Server and ESXi host log bundle:  Open vCenter Server Appliance Web Management interface and generate log bundle: Open vCenter Se…
Teach the user how to install log collectors and how to configure ESXi 5.5 for remote logging Open console session and mount vCenter Server installer: Install vSphere Core Dump Collector: Install vSphere Syslog Collector: Open vSphere Client: Config…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question