To VLAN TAG on vSwitch or pSwitch??

[rip10552]

Hi

I am rebuilding my home lab network & am seeking help about whether to use VLAN tagging at the vSwitch or let the pSwitch (access port mode) handle the VLANS.

Currently my vSphere(5.5) network does not use VLAN TAGS. The VLANS are defined on the router sub- interfaces (DOT.1q) & the switch VLAN ports are all access ports (DOT.1q). The pSwitch can do L3. If VLAN tagging is used on the vSwitch, the pSwitch would have 19 Trunk ports. From security view I think this would not been considered an ideal configuration.  

When do you use VLAN tagging on the vSwitch versus having the pSwitch handle the VLAN tagging?

When & why is it best to use either option?

The vSwitch for the Hosts will be configured:

HOST's (x 3) vSwitch Configuration - 6 Network Ports

vSwitch 0 (VMkernel)  -  

Management - vmnic0 >>>> pNIC0    VLAN10

vSwitch 1 (VMkernel) 

vMotion  -  vnic1 >>>>>>     pNIC1      VLAN 20

vSwitch 2 (VMkernel) 

IP Storage -   vmnic2 >>>> pNIC2       VLAN 50

vSwitch3 (VMkernel) 

IP Storage -   vmnic3 >>>> pNIC3      VLAN 50

vSwitch 4 (VM Port Group)

Virtual Machines traffic PortGroup

vmnic4 ->>>>>>>>>>>>> pNIC 4         VLAN 40

vmnic5 ->>>>>>>>>>>>> pNIC 5         VLAN 40

Comments & recommendations from the community are very much appreciated.

Regards

[linotelera]

Hi

it depends on your design goals and constraints: you should simply divide your networking type into categories: management, services (vMotion, backup, FT,...) and production. Based on regulation you could assign 1 or more production physical separation (with physical connections into many other switches)... but, sure, this is not your case.

In your case I suggest to do this:

vSwitch mgmt -> 3 phyports -> VLAN management +  vMotion + backup

vSwitch production -> 3phy ports -> VLAN productions

or

vSwitch mgmt -> 2 phyports (VLAN mgmt)

vSwitch serervices -> 2 phyports (VLAN vMotion + backup)

vSwitch production -> 2 phyports (VLAN production)

In all these cases all VLAN must accordingly trunk into physical ports, then the use of PST (physical switch tagging) and VST (virtual switch tagging) is mandatory.

Lino