Create DMZ in Vcenter

RocknBird
RocknBird used Ask the Experts™
on
I have built a new VLAN for a DMZ. I have the VLAN applied to switches all the way to the port on the Palo Alto Firewall. I have 3 IIS servers on VMWare 5.5. that need to go into that new VLAN.  What do I need to do in Vcenter to create the DMZ VLAN and move the 3 servers into that vlan. All access to and from those 2 servers will be controlled by the firewall. Thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017

Commented:
You need to create a new Virtual Machine Portgroup, label it DMZ, use VLAN Tags for your DMZ.

Then select that virtual machine portgroup for your 3 VMs, e.g. edit VM Settings, and select that Portgroup Label next to the Network Interface.

You may also need to change the IP Addresses in the VMs to match your IP Address scheme in your DMZ.

Author

Commented:
Andrew thanks. I create the port group and assigned my DMZ VLAN to the Port Group. However when I add a virtual machine with the DMZ IP Addressing to that port group I cannot ping the DMZ VLan GW on the firewall. Network guys say they have extended the DMZ Vlan to the firewall. When running a tracert I notice the trace gets dropped right away so makes me think there is another  setting in Vcenter I need to make?
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017

Commented:
No more settings are required on host or vCenter Server (which really has nothing to do with it, it's just a Management Server!)

If you've create the virtual machine portgroup, and the correct VLAN is tagged, that's all that is required.

Can you send me a screenshot of your networking.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
Sure. See attached virtual switches for the 1 host its currently configured on.
Doc2.docx
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017

Commented:
So VLAN 202 is the DMZ, and VLAN 202 should be running and trunked (tagged) down those nic links vmnic2 and vmnic3....

all the configuration that is needed.

if the IP Address is configured correctly on the VM - IP Address.... all should be good and working.

Can other devices on the DMZ ping each other if allowed ?

Author

Commented:
Where do you edit or apply a trunk to the vnics?
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017
Commented:
You don't, that's done on the physical switch applied to the physical ports of the switch, the uplinks are connected to!

VLAN 202 I assume has a Tag and number of 202 inserted for the virtual machine port group.

and those two nics are connected to a trunk group ports, which all have lots of tags running on those ports.

Author

Commented:
Ok that makes sense. I will check the upstream configurations. I suppose I will need to great the same DMZ Port Group on each ESXi host in the cluster if I want to vmotion the DMZ VMs later on yes?
VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017
Commented:
Correct.

Author

Commented:
thank you for your assistance!!
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017

Commented:
no problems, have a good day.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial