topic Re: Extended Switch accross multiple ESX hosts in Networking Members

Extended Switch accross multiple ESX hosts

lamelendrez — Mon, 14 Aug 2023 21:42:56 GMT

Hello,

I am new to VMWare and I would like to know if a vSwitch can be extended across multiple ESXs.

My goal is to deploy a Virtual Firewall that has two interfaces and outside and inside interface.

The outside interface is connected to a virtual switch with connections to uplinks to external connectivity.

The inside interface is connected to an internal isolated protected vSwitch with no uplinks.

I have the need to extend the internal switch risiding on ESX1 for example to another ESX2 server where I can deploy other servers to be protected over the same virtual firewall.

Thanks

Re: Extended Switch accross multiple ESX hosts

sguadamu1 — Mon, 14 Aug 2023 22:36:19 GMT

Good afternoon, hope you are fine.

What you will have is a DVS, this DVS (Distributed Virtual Switch) will be used by all the hosts that you define. My question is, is the DFW going to use for north - south traffic only, or is it going to be used for east - west traffic as well? If this is the scenario, you will need to use NSX.

Best Regards.

Re: Extended Switch accross multiple ESX hosts

lamelendrez — Mon, 14 Aug 2023 23:10:38 GMT

It is only for North/South traffic.

So the DVS will behave as one single switch accross multiple ESX servers?

Re: Extended Switch accross multiple ESX hosts

MJMSRI — Tue, 15 Aug 2023 07:16:06 GMT

Yes all hosts can be connected to a distributed switch for central management and administration. However you will require the Enterprise Plus licence for all hosts CPUs to use that distributed switch. (or if you have vSAN, the distributed switch feature is included)

Re: Extended Switch accross multiple ESX hosts

scott28tt — Tue, 15 Aug 2023 07:59:18 GMT

And just because you have the distributed switch working on all your hosts, that doesn't have an effect on traffic flow.

In other words, if your virtual firewall is a VM and you build it on one host, connecting that VM to a port group on your distributed switch doesn't also "distribute" copies of the virtual firewall VM to all your other hosts.