RocknBird
asked on
Create DMZ in Vcenter
I have built a new VLAN for a DMZ. I have the VLAN applied to switches all the way to the port on the Palo Alto Firewall. I have 3 IIS servers on VMWare 5.5. that need to go into that new VLAN. What do I need to do in Vcenter to create the DMZ VLAN and move the 3 servers into that vlan. All access to and from those 2 servers will be controlled by the firewall. Thanks
ASKER
Andrew thanks. I create the port group and assigned my DMZ VLAN to the Port Group. However when I add a virtual machine with the DMZ IP Addressing to that port group I cannot ping the DMZ VLan GW on the firewall. Network guys say they have extended the DMZ Vlan to the firewall. When running a tracert I notice the trace gets dropped right away so makes me think there is another setting in Vcenter I need to make?
No more settings are required on host or vCenter Server (which really has nothing to do with it, it's just a Management Server!)
If you've create the virtual machine portgroup, and the correct VLAN is tagged, that's all that is required.
Can you send me a screenshot of your networking.
If you've create the virtual machine portgroup, and the correct VLAN is tagged, that's all that is required.
Can you send me a screenshot of your networking.
ASKER
Sure. See attached virtual switches for the 1 host its currently configured on.
Doc2.docx
Doc2.docx
So VLAN 202 is the DMZ, and VLAN 202 should be running and trunked (tagged) down those nic links vmnic2 and vmnic3....
all the configuration that is needed.
if the IP Address is configured correctly on the VM - IP Address.... all should be good and working.
Can other devices on the DMZ ping each other if allowed ?
all the configuration that is needed.
if the IP Address is configured correctly on the VM - IP Address.... all should be good and working.
Can other devices on the DMZ ping each other if allowed ?
ASKER
Where do you edit or apply a trunk to the vnics?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Ok that makes sense. I will check the upstream configurations. I suppose I will need to great the same DMZ Port Group on each ESXi host in the cluster if I want to vmotion the DMZ VMs later on yes?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
thank you for your assistance!!
no problems, have a good day.
Then select that virtual machine portgroup for your 3 VMs, e.g. edit VM Settings, and select that Portgroup Label next to the Network Interface.
You may also need to change the IP Addresses in the VMs to match your IP Address scheme in your DMZ.