little network with vlan

[alriz]

I' m using vmware esxi 4. I have two virtual machine into two different virtual lan. Machine1 has ip 10.0.100.200, machine2 has ip 10.0.100.201. The vmware server has ip 10.0.100.234 and uses 10.0.100.1 as a gateway. Can't the two machines communicate with the gateway and vmware server? I cannot even ping them. Is there a way to permit it? I need to use the gateway to connect one of the two machines to internet..

[jb12345]

Why do you have the VMs in separate VLANs? If they are 10.0.100.xxx and have the same mask & gateway why not put them on the same VLAN?

[DSTAVERT]

VLANS are to keep traffic separate. They don't do routing.

[alriz]

I need to have two separate vlan and link them through a firewall because I want to simulate two different lan that communicate just through the firewall. I haven't yet created the firewall because I noticed that there is no way to go on internet, while vlan1 sholud go on internet. I attached a picture of my network

[TobiasKracht]

My only thought here is can you ping the gateway from the ESX host? I wonder if his problem is there? This would explain why you can not ping the gateway from the VMs.

StarWind Software R&D

[Erik_Zandboer]

Let me get this straight. You have configured two VLANs each having a VM in the same subnet. This results in both of them being isolated (VLAN separation). The next step I do not understand: You have a firewall (which basically IS a router) to connect both of these VLANs... That will not work. The firewall needs to have two different subnets in order to work; it cannot route traffic from the first VLAN into the same subnet on the other VLAN....

I would set it up somthing like this: Make two VLANs, 100 and 101. Use 10.0.100.200 for the first VM in VLAN100, and use 10.0.101.200 for the other in VLAN101 (see how I match the VLAN numbers to the subnets? That is not a requirement, but handy!). Give both VMs a default gateway inside their respective subnets. These default gateways will be you firewall.

Now you can try and ping from one VM to the other. The pinging VM will find that the destination address (the other VM) is not in his subnet, so the ping request will be sent to the default gateway. That's your firewall. He will receive the ping request, sees the destination address, and knows this address. That is his other VLAN! if the firewall is not blocking, it will route and pass thorugh the ping request to the second VM. Same route back (if the firewall also permits the ping reply from VM2 to VM1 of course).

Visit my blog at http://www.vmdamentals.com

[rolohm]

I hope that I don't complicate things but my intention is to make things more clear.

1.VLANs and IP subnets are in no way linked to each other. ( You can

run as many IP subnets as you want on the very same VLAN, and one IP

subnet can span many different VLANs as long as you connect them to each other)

2. VLAN separates layer 2 traffic (ethernet) and hence also whatever load the ethernet frame is carrying (typically IP-packets).

3.

You can connect layer 2 traffic e.g thru a cable between two switch

access ports (where VLANs are untagged from the ethernet frames) or, as you have

drawn, via a firewall in transparent mode. Other techniques exist.

In

your case there will be no connection between the two VLANs if the

firewall is not there and ther will be no communication what so ever

between the two "HOST" VMs. No ping, no arp, nothing. It seems however

what you're trying to do is not having a transparent firewall but a

traditional routing one. and in that case you should put the VMs on

different IP subnets per above advice and have the firewall with a routing function in

between. The firewall must have an interface with an ip address in

each subnet and that interface must also be connected to the correct

VLAN. The HOST2 VM must have the firewall interface as default

gateway and the HOST VM must have an internet gatway as default

gateway and you must also put a static route from HOST1 to HOST2 for

HOST1 to know where to send traffic to HOST2. A more common, and much

simpler way, would be connecting internet to the FW and having the FW

as default gw for both hosts... like a traditional DMZ.

Please also note that if a sending node, by comparing IP address and mask, comes to the conclusion that is is on the same IP subnet as the target node, it will never try to send anything to the default gateway even if the default gateway happens to be connected to both nodes (there are exceptions to that too but now it's getting way to complex )

Good luck!

/R