Solved

Vmware Ports Security and Performance

Posted on 2014-03-31
9
298 Views
Last Modified: 2014-03-31
If I will have to think about performance and security regarding :

- VM Network : Host to Host Communication including VMHA, and Host to Vcenter communication
- Vmtion traffic
- Storage traffic


Having 2 x10GB physical Nics,  will this allow us to separate traffic for security and performance purposes? if so , please explain how to separate traffic and which traffic should never go the same way with other traffic?

I have also heard of system traffic and user traffic.
if I understand System traffic is the same traffic I indicated above, however user traffic is the way workstations get into the VMs, the only way I know is through the Network switch that connects to the SAN….I could be wrong. Please explain




Thanks
0
Comment
Question by:jskfan
  • 5
  • 4
9 Comments
 
LVL 118

Assisted Solution

by:Andrew Hancock (VMware vExpert / EE MVE)
Andrew Hancock (VMware vExpert / EE MVE) earned 500 total points
ID: 39966803
You will need to separate using VLANs, so create a trunk network using your two 2 x10GB physical Nics, and then have different VLANs for vMotion, Management Network, and Virtual Machines.

But you will need a switch capable of VLANs.

User Traffic is known as Virtual Machine Network Traffic.

System Traffic - Management Network, vMotion, iSCSI storage

Have a look here

Pages 13 - 73 Discuss Networking in Detail, iuncluding trunks, VLANs, switches, and load balancing

ESXi Configuration Guide ESXi 4.1

http://www.vmware.com/pdf/vsphere4/r41/vsp_41_esxi_server_config.pdf

Virtual Networking

http://www.vmware.com/technical-resources/virtual-networking/virtual-networks.html

Virtual Networking Concepts

http://www.vmware.com/files/pdf/virtual_networking_concepts.pdf

http://en.wikipedia.org/wiki/Virtual_LAN

http://en.wikipedia.org/wiki/IEEE_802.1Q
Sample configuration of virtual switch VLAN tagging (VST Mode)

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004074

http://blog.scottlowe.org/2006/04/17/vlans-and-port-groups/

How to Setup VLANs

http://www.vladan.fr/great-kb-on-how-to-configure-vlans-on-vswitches-pswitches-and-vms/

VMware ESX Server 3: 802.1Q VLAN Solutions

http://www.vmware.com/pdf/esx3_vlan_wp.pdf

http://kb.vmware.com/kb/1004127

http://kb.vmware.com/kb/1004074

http://kb.vmware.com/kb/1004252
0
 

Author Comment

by:jskfan
ID: 39966833
I see…
So, for instance , I can create vmkernel for vmtion and another vmkernel for VMHA and assign them to the same physical NIC (10GB), but to 2 different Vlans ...
0
 
LVL 118
ID: 39966839
That's correct, but you will have to ensure you configure and build you network design correctly.
0
 

Author Comment

by:jskfan
ID: 39966841
<<User Traffic is known as Virtual Machine Network Traffic.>>

is it how VMs talk to each other
OR how ESX hosts talk to VMs and vice-versa
OR how physical workstations in the office talk to VMs and back
???
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 118
ID: 39966843
All of the above, is correct, via Virtual Machine network.
0
 

Author Comment

by:jskfan
ID: 39967010
<<which traffic should never go the same way with other traffic?>>
if we consider the following types of traffic:
- Management Network : Host to Host Communication including VMHA, and Host to Vcenter communication
-VM Network
- Vmotion traffic
- Storage traffic
0
 

Author Comment

by:jskfan
ID: 39967024
I also am not sure if the communication between Vcenter and VMs is part  VM Network or Management Network
0
 
LVL 118

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE) earned 500 total points
ID: 39967100
It's Best Practice and Recommended, to make sure the following traffic is isolated if possible.

But you DO NOT need to follow these recommendations, it's up to your network design and implementation.

Management Network

VM Network

Vmotion traffic

Storage traffic

Management and VM Network traffic could be on the same network, or you could have a special Management Network for all devices.

vCenter Traffic, is part of VM Network, which could also be Management Network.,

e.g. vCenter Server needs to commnicate with ESXi on the Management Network.

But your management network could also be your Server Network (VM Network)
0
 

Author Closing Comment

by:jskfan
ID: 39967201
Thank you!
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This is an issue that we can get adding / removing permissions in the vCSA 6.0. We can also have issues searching for users / groups in the AD (using your identify sources). This is how one of the ways to handle this issues and fix it.
When we have a dead host and we lose all connections to the ESXi, and we need to find a way to move all VMs from that dead ESXi host.
Teach the user how to delpoy the vCenter Server Appliance and how to configure its network settings Deploy OVF: Open VM console and configure networking:
Teach the user how to configure vSphere Replication and how to protect and recover VMs Open vSphere Web Client: Verify vsphere Replication is enabled: Enable vSphere Replication for a virtual machine: Verify replicated VM is created: Recover replica…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now