ESX-VLAN Planification

[JoDuro]

Hi,

i'm planning a vmware infrastructure architecture. I will have 2 high capacity server with 2 quad processors and 32gb of RAM and 1 small capacity server with 1 dual core processor and 4gb of RAM. The three servers will have an HBA that will go the our SAN. We Want to use the DRS, Vmotion, High availability, the virtual center server and Update Manager.

Each ESX servers needs to be able to get all thos features and get access to 4 VLAN and each vm will need access to 2 Virtual Machines. i'm not sure about all the networking part of the ESX servers can anybody help me?

Thanks

[Chris_Howard]

Hi,

This whitepaper is a great source of background information on VMware networking.

Best of luck with your Planification..

If you found this helpful please consider the use of the Helpful /Correct buttons to award points. Thanks !!

[azn2kew]

The above questions can be accomplish easily if you have license and shared LUN in placed, but can you specify more details about each VM has access to two virtual machines meaning what??? Which two virtual machines or randomly???

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

Regards,

Stefan Nguyen

iGeek Systems Inc.

VMware, Citrix, Microsoft Consultant

[azn2kew]

Can you also specify how many NICs do you have for your ESX hosts so we can help you plan on networking piece. I'm assuming you have redundant fabric channel switch and multipaths HBAs connection dealt with your networking team? If you have 4 NICs than the networking scenario would be:

1. pNIC1->SC/VMotion standby

2. pNIC2->VMotion/SC standby

3. pNIC3-4->Virtual Machines Network

4. pNIC5-6->If you have 6 NICs for your host than adding DMZ network to secure your FPT, Web and mail servers network as well and preferrably it would be secure on its own cluster as well to prevent from other VMs being moved over.

All you have to do is get the license from VMware and than install your virtual center 2.5 Update 1 with SQL/Oracle database of your choice and create vcdb and appropriate credentials and permissions. Double check OBDC connection make sure it goes through.

1. Connect your servers to the network and load ESX 3.5 Update 1 for all servers

2. Point the browser to your VC server and download VI clients and log on directly to VC server you've just installed.

3. Configure your server license mode and point to the .lic file you've downloaded from VMware.com

4. Create a data center and cluster a cluster and than add all ESX hosts to the cluster and start configure HA settings and DRS.

5. Create resource pools if you want to manage it more effectively and always test the HA and VMotion functions as well.

6. Go through each tabs on the VI Client and configure from networking, storage, security profiles and these are lengthy process and can read admin guide for ESX 3.5 should has everything.

7. For the VLAN part, your networking team and server team should know which servers belong to which network and all they have to do is assign you the correct VLAN ID and you just plug them in each network ports accordingly so traffic can be routed and isolated for more secure.

That's pretty much all. Let us know if you need further assistance.

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

Regards,

Stefan Nguyen

iGeek Systems Inc.

VMware, Citrix, Microsoft Consultant

[Texiwill]

Hello,

How many NIC are in the VMware ESX hosts? That will help you plan as well. But in general, VLANs is not an issue, Security tends to be the issue more than anything. How secure do you need to be? What is your security stance? That will drive your architecture. If you are not very concerned about security I have seen people use one pSwitch with all pNICs attached and multiple VLANs. If you are concerned about security, performance, redundancy, etc. THen what azn2kew suggests will work just fine.

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education. As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization

[JoDuro]

`Thanks for the information guys,

i did a small typing error, I have 4 vlans and each VM will need to access at leat 2 of them and yes i'm bery concerned with the security.

I want to know how many network cards i need.

Thanks

[Texiwill · Accepted solution]

Hello,

If you are very concerned about security you would need:

2 pNICs for SC

2 pNICs for vMotion

2 pNICs for VMs

2 pNICs/iSCSI-HBA/FC-HBA for Storage.

Mixing any of the above is a possible risk. Some say not a very high risk, others say its a risk and isolating the networks is the best way to go. You will want your vMotion network to be isolated from your VM network, and your storage network isolated from your VM network and vMotion network. If you are using iSCSI, however your SC/storage network can not be 100% isolated from each other.

If one of the VLANs is a DMZ, you may wish to use a different set of ESX hosts just for DMZ VMs. For banks I would recommend this approach as it will keep VMs from accidentally or purposefully appearing on the wrong network. However, not everyone needs that level of security.

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education. As well as the Virtualization Wiki at http://www.astroarch.com/wiki/index.php/Virtualization

[habibalby]

I do agree entirely with Texiwill[/b]

If one of the VLANs is a DMZ, you may wish to use a different set of ESX hosts just for DMZ VMs. For banks I would recommend this approach as it will keep VMs from accidentally or purposefully appearing on the wrong network. However, not everyone needs that level of security.

Keeping one server dedicated for a DMZ VMS will be better approche for a security concern. But if you have running lack of budget, then the approche will be different.