ESXi on host system with one physical MAC restriction

[Fade]

Hi to all!

We have ESXi installed on a host system, located in datacenter with MAC restriction on one physical adapter.

Earlier we have VMWare Server 2 with bridged network, so it was not a problem.

All virtual servers was accesible via port forwarding.

On ESXi I cannot found any solution to create bridged network.

Please give me a tip on how to solve this problem.

[J1mbo · Accepted solution]

Create a vswitch with no physical adapters.  Connect VM's to that (and an ESXi management vmkernel).

Then install a virtual firewall such as vyatta connected to both the isolated vswitch and the default vswitch with the physical adapter.  Then setup port forwarding rules as required.

[DSTAVERT]

I often create isolated networks like that.

[bulletprooffool]

As stated above, something like a Vyatta appliance is the way to go - step through guide here: http://www.get-virtual.info/2011/02/18/using-vyatta-as-firewall-in-esxesxi-for-private-network-simul...

[Dave_Mishchenko]

Do you just have one MAC in total to use (i.e. access to VMs and access to ESXi).  If that's the case then you'll need at least two.   If you put a VM firewall in front of ESXi then you'll have issues should the VM now be able to start.  Plus,  you need to have all VMs powered off to patch the host.

[Fade]

Please take a look on my current situation on a screenshot.

I need that Vyatta have IP and MAC of physical adapter. Right now this parameters belongs to Managment Network.

How can I connect firewall to physical adapter directly?

[bulletprooffool]

The Vyatta will not have the MAC, or IP of the physical adapter. the physical adapter behaves like a Switch (a vSwitch in this case) and allow saccess to the Appliance.

The physical Nic's MAC becomes the same as a switch port, so from a networking point of view, devices on the network see the vSwitch that you create in the same way as any other switch.

[Fade]

Dear David,

I cannot understand how you transfer "Managed Network" to virtual network without physycal adapter (like on your screenshot).

I tried to create new port within internal network, but it conflicts with IP and MAC of default managed network.

I need to transer it behind the firewall, and firewall must be port to external adapter, with its IP and MAC.

[Dave_Mishchenko]

You would need to configure a VM with 2 NICs (one for each vSwitch) configured with IPs on 2 subnets.  Then you'll add a vmkernel port on that new subnet.

After that you can removed the primary vmkernel port and later change the IP address that you use for management if you need to.