Create DMZ in Vcenter

I have built a new VLAN for a DMZ. I have the VLAN applied to switches all the way to the port on the Palo Alto Firewall. I have 3 IIS servers on VMWare 5.5. that need to go into that new VLAN.  What do I need to do in Vcenter to create the DMZ VLAN and move the 3 servers into that vlan. All access to and from those 2 servers will be controlled by the firewall. Thanks
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:
You need to create a new Virtual Machine Portgroup, label it DMZ, use VLAN Tags for your DMZ.

Then select that virtual machine portgroup for your 3 VMs, e.g. edit VM Settings, and select that Portgroup Label next to the Network Interface.

You may also need to change the IP Addresses in the VMs to match your IP Address scheme in your DMZ.
RocknBirdAuthor Commented:
Andrew thanks. I create the port group and assigned my DMZ VLAN to the Port Group. However when I add a virtual machine with the DMZ IP Addressing to that port group I cannot ping the DMZ VLan GW on the firewall. Network guys say they have extended the DMZ Vlan to the firewall. When running a tracert I notice the trace gets dropped right away so makes me think there is another  setting in Vcenter I need to make?
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:
No more settings are required on host or vCenter Server (which really has nothing to do with it, it's just a Management Server!)

If you've create the virtual machine portgroup, and the correct VLAN is tagged, that's all that is required.

Can you send me a screenshot of your networking.
Active Protection takes the fight to cryptojacking

While there were several headline-grabbing ransomware attacks during in 2017, another big threat started appearing at the same time that didn’t get the same coverage – illicit cryptomining.

RocknBirdAuthor Commented:
Sure. See attached virtual switches for the 1 host its currently configured on.
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:
So VLAN 202 is the DMZ, and VLAN 202 should be running and trunked (tagged) down those nic links vmnic2 and vmnic3....

all the configuration that is needed.

if the IP Address is configured correctly on the VM - IP Address.... all should be good and working.

Can other devices on the DMZ ping each other if allowed ?
RocknBirdAuthor Commented:
Where do you edit or apply a trunk to the vnics?
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:
You don't, that's done on the physical switch applied to the physical ports of the switch, the uplinks are connected to!

VLAN 202 I assume has a Tag and number of 202 inserted for the virtual machine port group.

and those two nics are connected to a trunk group ports, which all have lots of tags running on those ports.
RocknBirdAuthor Commented:
Ok that makes sense. I will check the upstream configurations. I suppose I will need to great the same DMZ Port Group on each ESXi host in the cluster if I want to vmotion the DMZ VMs later on yes?
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
RocknBirdAuthor Commented:
thank you for your assistance!!
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:
no problems, have a good day.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.