DMZ on ESXI Servers

Hi Guys,

Firewall->HP Switch Layer 3 -> esxi servers 1,2

I'm a vmware vsphere 6 newbie.
I have 2 physical ESXI servers(ESXI v6) that host 30 virtual servers. vmWare vCenter 6 is set up properly. Desperatly looking for some help/advice on this.

Every physical server has 5 gigabit ethernet connections.

Connected NICs:

Management Network x1 (vmnic0)
LAN x3 ( vmnic 1,vmnic2)  (30x Vms)
ISCSI x2 (vmnic3,vmnic4)




Everything is up and running smoothly on our production Network.

Now I need to connect these physical servers to DMZ since there are some vm's that should run on that part of our network.

How should I do that?
What are you guys doing out there?

How about vLANS? Can it be set up and span multiple subnets so I can keep all servers connected to internal LAN?


Thanks in advance.
needs needsAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

systechadminConsultantCommented:
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
You can either dedicate two DMZ physical network interfaces and connect these to your DMZ

make sure you connect these two network ports on your switch to each ESXi host.

Or you could use VLANS.
Ben Personick (Previously QCubed)Lead Network EngineerCommented:
You losred LAN x3 but only show 2 nNICs so I suspect you mean LAN x
2.

I would run a second VLAN over the LAN adapters and use that for DMZ.

That would be the easiest setup and depending on your HP switches configuration, if they are already set up astrunks with allowed and default vlans

If they aren't already set up that way both are about equal in terms of work, and have similar caveats in doing the chamge without disruption.

However once VLans are in place you will be able to add more networks on additional Clans with very little effort and no chance of dissruption
SolarWinds® VoIP and Network Quality Manager(VNQM)

WAN and VoIP monitoring tools that can help with troubleshooting via an intuitive web interface. Review quality of service data, including jitter, latency, packet loss, and MOS. Troubleshoot call performance and correlate call issues with WAN performance for Cisco and Avaya calls

needs needsAuthor Commented:
Thank you so much for the Infos

@Ben can u please Little bit more info give? sorry LAN (2 x physical Nics connected.Name is only LAN.)


I would run a second VLAN over the LAN adapters and use that for DMZ. I think this is very interesting if i can achive it.

Thanks in advance
needs needsAuthor Commented:
By the way ,There is no VLAN configured on any HP Switches .
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
So you will have to complete some network re-design, and create a trunk using two physical network ports (a static trunk), and create VLANS for LAN and DMZ.

A bit puzzled because we discussed VLANS with you in this question?

https://www.experts-exchange.com/questions/29083986/vmware-trunk-NIC.html
Ben Personick (Previously QCubed)Lead Network EngineerCommented:
Thank you so much for the Infos

@Ben can u please Little bit more info give? sorry LAN (2 x physical Nics connected.Name is only LAN.)


I would run a second VLAN over the LAN adapters and use that for DMZ. I think this is very interesting if i can achieve it.

Thanks in advance

  • 1) Create An additional vLAN on your switch (If your switch supports VLANS at all, there is already a default (VLAN 1) and you will be creating an additional VLAN say, VLAN 3, and labeling it DMZ
  • 2) Connect your Router's DMZ interface to the switch on VLAN 3, or change it's interface to have VLAN interfaces and trunk them to the switch and set up the router/Firewall's Interface as a trunk port (Whichever you personally find easier, which I suspect will be the physical interfaces for now as you seem to be relatively unsure about basic network setup -- no offence intended)
  • 3) On the ESXi Server pull one NIC out of the current vSwitch configuration for LAN.
  • 4) On the Switch set that ESXi's NIC port to be a Trunk port with a native VLAN of VLAN 1 (IF POSSIBLE, Some low-grade switches don't allow the tagged an untagged vlans, so YMMV).
  • 5) IF your switch allows VLANs to pass both tagged an untagged traffic then you can add the NIC back into the existing setup and then repeat steps 3 and 4 on the other NIC before moving on to Step 9.
  • 6) IF your switch does not allow tagged an untagged VLANs, set the Set up the same existing LAN Network as a new vSwitch with similar name, the switch will have VLAN tagging set to 1.
  • 7) Move a test VM to this switch and confirm it is working, once confirmed, move all remaining VMs LAN NICs to the new Network.
  • 8) Remove the remaining NICE in the original LAN network and add it into the New LAN network.
  • 9) Create a New vSwitch with VLAN 3 on it and name it for the DMZ.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
needs needsAuthor Commented:
Thank you all ,
Ben Personick (Previously QCubed)Lead Network EngineerCommented:
Glad to help :)
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Switches / Hubs

From novice to tech pro — start learning today.