Isolated VM group in vSphere

[mullinb]

Hi , I'm going backwards with a request I hope someone might be able to shed some light upon.

I have a customer who needs to create ~30 vms in their environment, to be used by a separate part of their organisation, and they want to have them as 'separate' as possible  - from a security / network point of view but also as much 'physical and performance separation ' as possible for the New vms.  Basically the message I'm getting is they don't want any trouble from them :>.

So , apart from the networking side , from the storage aspect  'physical separation'  I'm thinking could tie-in alot with performance and they both could mean alot of things. The ESX's are on c7000 enclosures using VC FC Modules, the storage is 3Par , SDRS is not enabled, datastores are not clustered , the Hosts are.

For performance I've looked at resource pooling , SOIC (constrained by physical stuff going on down in the shared disks doesn't seem to be appropriate here ) , for 'separation ' we've even looked at using dedicated physical storage carved into 3Par a common provisioning group (would compromise the 3Par functioning), or a Dedicated vSphere Datastore ( although it could provide 'separation',  Host I/O could be held up by the new vms potentially affecting the original ones).

The datastore would provide as close to what they want as i can see , the next step would be to dedicated some ESX hosts but I suspect I'm missing more than one option, any ideas gratefully received ! 

Many thanks

[Gortee]

Evening,

I love this request... I get these semi IaaS requests all the time.  This normally means management is frustrated or they have someone who is going to break security policy and they don't want to know...

There are lots of options it all depends on what you want to spend. 

1. vCloud director would allow you to create this whole thing except you will need to separate the lun's from your normal luns so they are not mixed loads

2. Solution like Nutanix to keep storage on it's own system

3. A hybrid solution:

* VLAN's with cidr subnetted ip's for their management, vmotion, vm traffic

* Physical different switches uplinked to the c7000 for the 10gb connections

* Use c7000 ports that are not in use so no cross c7000 traffic

* Use Fiber ports not in use and direct connect them to FC storage array taking switches out of the mix

* Add fiber switches

* Storage is hard... you could use the storage appliance but I doubt it has performance or scales like you want.. otherwise you need to share at some level I wish VSAN was out it might solve your issues

* ESXi build more nodes and virtual center

What is really comes down to is how much does your company want to spend to solve this issue and how you are currently setup. 

At the end of the day it's all requirements, cost and time.   

I normally do something like this:

* VLAN's with unique ip ranges

* Shared switches but ports on the C7000 dedicated to their traffic not shared by my stuff

* Blades allocated to them and build

* Unique virtual center with web only access

* Connection to shared storage on it's own array or raid sets

Thou I have to say we just deployed vcloud director to solve these needs and it rocks and always solves the problems.

Thanks,

J