Static NAT on ESXI 6.5 VM

[UsoAlpha]

Our lab server make a ESXI server these days, one of VM installed windows 10 and shared a usb printer on it. The server connect to a router with some computers,but some competers not directly connect to the router. Structer of  the network is as below, PM1 is a Physical Machine outside the router subnet, PM2 is a physical machine inside the router subnet,VM means the virtual machine with windows 10 and the printer, MAN means the ESXI management page.All the NATs are DMZ forwarding.

the whole network seems ok,but don't work well.Connection between PM1 PM2 and MAN all ok, but connection with VM not work well. When ping VM by 10.61.53.2, it always returns time out, even ping from itself. But ping by 192.168.1.41 from PM2 is OK . MAN can be normally accessed by 10.61.53.4 even from PM1. But it is really strange that on PM1 use RDP connect to VM by 10.61.53.2 is OK, but remote print service can't use. ESXI inside network topology is as below, and promiscuous mode of virtual switch is enabled.

I can't find what caused it, so need your help,thanks a lot.

A

[mshamima]

When ping VM by 10.61.53.2, it always returns time out, even ping from itself.

1) From which machine you are initiating this ping request.

But ping by 192.168.1.41 from PM2 is OK . MAN can be normally accessed by 10.61.53.4 even from PM1. But it is really strange that on PM1 use RDP connect to VM by 10.61.53.2 is OK, but remote print service can't use.

2) Is printing working fine from VM1 ?

3) ESXI inside network topology is as below, and promiscuous mode of virtual switch is enabled.

AFAIK there is no use case for Promiscous mode here.

[UsoAlpha]

1) From which machine you are initiating this ping request.

Ping from  PM1(10.61.53.3), PM2(192.168.1.40→10.61.53.5), the router(10.61.53.1\192.168.1.1)and itself(192.168.1.41→10.61.53.2). if ping by 10.61.53.2, all the above return time out.If use tracert commad, the ICMP frame arrived 10.61.53.1 then disappeared. If ping by 192.168.1.41 from router and PM2, it works well. Ping by 10.61.53.4 from 10.61.53.3 is quite normal and Web client can be open normally on PM1 by "https://10.61.53.4".

2) Is printing working fine from VM1 ?

Printer is work well on VM1, It can be directly used in VM1 and well shared.On PM2, can use ‘’\\192.168.1.41\print“ print remotely, but use “\\10.61.53.2\print” returns can't find the printer.

[Sreejesh_D · Accepted solution]

HI,

From the scenario mentioned I think you are trying to solve this issue - "But it is really strange that on PM1 use RDP connect to VM by 10.61.53.2 is OK, but remote print service can't use."

am i right?

If so ,

1. Are you able to RDP to the VM from PM2 and Print?

     If YES, it confirms the print function is fine. We've to look at something blocking the Print port between PM1 and VM. It may be the PM1 soft firewall, a physical firewall or the router itself.

     If RDP works and Print fails. Then there is something blocking print services at VM end.

[UsoAlpha]

Thank you,

Are you able to RDP to the VM from PM2 and Print?

If use the NATed IP(10.61.53.2), PM2 also can't use the print service, but use the raw IP in subnet(192.168.1.41) is OK. If make PM1 access to the subnet(Access to the wlan), PM1 can also access the print service by VM‘s raw IP.

It seems that PM1‘s soft firewall、NAT function and VM's inside soft firewall are all work well, feeling like ESXI ‘refused’ all the connections from subnets which it not belongs to except RDP. 

[UsoAlpha]

Once I shutdown the firewall of VM windows 10, problem is solved,thank you very much.

[Sreejesh_D]

good morning, glad to know issue is resolved.