vswitch networking

[ronald_higgins]

Greetings fellow forumites.

I have a question, and hopefully a quick and easy one

It's revolves around a question posed by our Security admins.

If i have 2 virtual machine port groups hanging off vSwitch0, let's call them PG1 and PG2. And 2 VM's. 1 in each PG.

When these VM's need to chat too each other, does the traffic stay within the the vSwitch0 or does it break out

to the physical switch and come back in again ? The concern on their behalf is that if the traffic stays within the

vSwitch then the firewalls and logging is being bypassed.

Best Regards

rH

[david_o]

if you have multiple port groups on a single vSwitch - the traffik does not need to hit the physical wire to go from 1 vm to another in the other port group.

remember however that vSwitches are LAYER 2 ONLY!

it generally begs the question why have multiple port groups on a single vSwitch, unless you need to use them for different vlans of the like...

[dkfbp]

Hi,

The traffic will have to go out to the switch to find a route to the other VLAN. The vSwitch has no knowledge of how to get to the other portgroup.

Best regards

Frank Brix Pedersen

[ronald_higgins]

Thanks for the feedback too date.

Networking is not my strong point so i appreciate the pointers and i see i have some reading too do.

Yes, the Virtual Machine Portgroups are for different VLANS.

So traffic from VM1 in PG1 (VLAN1)will need to go out too the physical switch before coming back into the vSwitch

and directed too VM2 in PG2(VLAN2) if I understand your answers correctly.

[david_o]

yea - if you are doing virtual switch tagging, then they need to be routed by something.

(i am however sure that traffic can pass from one PG to another on the same vSwitch if there are not vlans on them)

[dkfbp]

Yes, it will hit the physical switch. However traffic within the same portgroup will not leave the vswitch.

Best regards

Frank Brix Pedersen

[TheButcher]

Hi Ronald,

So traffic from VM1 in PG1 (VLAN1)will need to go out too the physical switch before coming back into the vSwitch

and directed too VM2 in PG2(VLAN2) if I understand your answers correctly.

This is correct. But it will also go through the router because it goes to another VLAN.

So this is the route:

VM1 --> vSwitch --> Physical Switch --> Router --> Physical Switch --> vSwitch --> VM2

[Texiwill]

Hello,

Moved to Security and Compliance forum.

Check out http://itknowledgeexchange.techtarget.com/virtualization-pro/how-traffic-routes-between-vms-on-esx-h... for information on how data routes around the virtual network.

In general however portgroup to portgroup can not communicate to each other whether on the same vSwitch or not. You would need some sort of bridge between them to make this happen. vSwitch to vSwitch also requires some sort of bridge. The only exception is a portgroup on a vSwitch with VLAN ID or 4095. VMs on this portgroup can see all traffic on the vSwitch if the VM can place its vNIC into promiscuous mode.

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.

Blue Gears and SearchVMware Pro Blogs: http://www.astroarch.com/wiki/index.php/Blog_Roll

Top Virtualization Security Links: http://www.astroarch.com/wiki/index.php/Top_Virtualization_Security_Links

[david_o]

In general however portgroup to portgroup can not communicate to each other whether on the same vSwitch or not.

This is assuming the 2 port groups are on different layer 3 segments though (and they would be typically). If they were not you would need to have promiscious mode enabled in order for them to 'see' the traffic of the other port group (as you suggest)

(for my clarification - not trying to be a pest)

d.

[Texiwill]

Hello,

Within a vSwitch only, one portgroup can not see the traffic of another portgroup unless that portgroup has VLAN ID 4095 and promiscuous mode vNICs are allowed.

Once you leave the vSwitch, whatever your pSwitch will allow is up to the pSwitch, if it acts as a bridge between the two portgroups, i.e. at Layer 3 then traffic can flow between them. But there needs to be something acting as this bridge. the vSwitch is a Layer 2 device which prevents this within the vSwitch.

You could also have an external firewall acting as a gateway between the two portgroups, etc.

Best regards,

Edward L. Haletky

VMware Communities User Moderator

====

Author of the book 'VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers', Copyright 2008 Pearson Education.

Blue Gears and SearchVMware Pro Blogs: http://www.astroarch.com/wiki/index.php/Blog_Roll

Top Virtualization Security Links: http://www.astroarch.com/wiki/index.php/Top_Virtualization_Security_Links

[admin]

I think the easiest way to look at this is to not look at port groups as VLAN groups as that is not what they are. A port group is really just a configuration group in which all vNICs connected to that port group have the same configuration options.

2 or more port groups on the same vswitch can have the same VLAN ID and therefore both will see the traffic for that VLAN. The use of VLAN 4095 sends ALL VLAN traffic to the port group with that VLAN ID assigned. The use of promiscuous mode will send all traffic to all ports connected to that port group. Much like setting up a SPAN port on a Cisco switch.