Isolating two VM's in Vsphere 4.1 essentials

[Adamster]

I am testing out 2003 upgrade to 2008R2 for domain controller.

I have already created a 2003 VM machine and a 2008 R2 VM Machine. Ideally this is what I would like to do.

1. Make sure that 2003 VM & 2008 VM can only talk to each other and not the rest of the network.

2. Once this is done I will seize allt he fsmo roles to the 2003 vm and look into upgrating over to 2008R2.

3. After the upgrade, and the testing done, I would like to introduce the new 2008 R2 domain controller into production.

Can anyone provide any guidance in accomplishing the above, especially step 1.

Thanks,

Adam.

[Adamster]

After doing some search I found this, before I try it, I would like to make sure that I can still connect to the internet for patches and talk between the two computers, hence I still need advice.

Thanks,

Adam.

[FranckRookie]

Hi Adam,

It won't be easy to isolate your VMs from the network but let them access Internet, except if you can have a dedicated link to your provider.

To isolate your VMs, you can create a new vSwitch with no physical card attached. Create a port group on that vSwitch and attach all your VMs to that port group. This way, they will be able to contact each other but will not reach any other machine outside of it.

Hope it helps.

Regards

Franck

[Adamster]

Franck,

I created the VSwitch with no network card attached and made the two computers part of that vswitch. However, now I am trying to have DHCP working within that switch so that the machines can get the ip addresses automatically. I created and IP pool and associated with that switch but still the VM's do not get any ip address automatically. Thanks you for all your help.

[Texiwill]

Hello,

I created the VSwitch with no network card attached and made the two computers part of that vswitch. However, now I am trying to have DHCP working within that switch so that the machines can get the ip addresses automatically. I created and IP pool and associated with that switch but still the VM's do not get any ip address automatically. Thanks you for all your help.

ESX vSwitches do not do DHCP or any Layer 3 without some assistance. Here is what I do in this situation.

1) Create an isolated vSwitch

2) Place all VMs to be isolated on a portgroup of this vSwitch

3) Install an EDGE firewall that has DHCP, NAT, and port redirection capability such as Smoothwall, IPcop, m0n0wall, etc. Give this vFW VM 2 vNICs. Connect 1st vNIC to the isolated vSwitch. Connect 2nd vNIC to your network.

3a) Power on vFW

4) Configure vFW to NOT pass anything but RDP incoming to the isolated VMs using port redirection to each VM.

5) Allow the isolated VMs to access the internet via port 80 or 443 and perhaps by site but no other accesses.

6) Power on Isolated VMs.

You can now access these VMs via RDP to manage/work on them. And they are isolated from the rest of your network, and they can only get patches, etc from outside your network.... Or if you use a patch server, ensure they can only reach that patch server and nothing else.

THis ends up giving you an internal network within a single ESX host that you can use to prepare VMs for production.

Best regards,
Edward L. Haletky VMware Communities User Moderator, VMware vExpert 2009, 2010

Now Available: 'VMware vSphere(TM) and Virtual Infrastructure Security'[/url]

Also available 'VMWare ESX Server in the Enterprise'[/url]

Blogging: The Virtualization Practice[/url]|Blue Gears[/url]|TechTarget[/url]|Network World[/url]

Podcast: Virtualization Security Round Table Podcast[/url]|Twitter: Texiwll[/url]

[mjpagan]

What type of switching/routing devices do you have? I'd be possible to do some of this if you had an extra port on your firewall that could be in a seperate network or with layer 3 switching as well.

Mike P

MCSE, VCP3/4