vSwitch VLANs

[xlcor]

If I create two new VLANs on my vSwitch, which are completely isolated (ie. the VMs within each can only interact with other VMs within their respective VLANs, and no external VMs, physical servers or clients can interact with either VLAN "bubble"), is there any way to "connect" those VLANs such that they can fully interact only with each other? I realize the limitations in a physical switching/routing environment, but I'm not sure if a vSphere environment works the same way...

thanks in advance!!

[xlcor]

Well it sounded really promising. I ensured that all hosts were in the same physical subnet (192.168.115.x), removed the extra virtual machine port group on the new vswitch (leaving only the one, "staging_ocx_lan), removed all VLAN references from each port group instance on each hypervisor, and even removed the router appliance from that port group (leaving only 11 VMs, all on the same subnet), and none of them can ping any other one, always Destination Host Unreachable (for the linux hosts) and Request Timed Out (for the Windows hosts).

[chadwickking]

Have you tried the following?

go to vsphere switch -

Properties > Select vswitch > Edit > Security > Promiscuous to accept > Ping away.....

Ensure your static IP's and Subnets are all the same - I AM SURE you checked like 50 times considering how this would drive me nuts!!! I am facing some issues as well - oh well it is what it is

Some information on the different switch modes:

http://pubs.vmware.com/vi35/wwhelp/wwhimpl/common/html/wwhelp.htm?context=server_config&file=sc_adv_...

Cheers,

Chad King

VCP-410 | Server+

Twitter: http://twitter.com/cwjking

If you find this or any other answer useful please consider awarding points by marking the answer correct or helpful

[rickardnobel · Accepted solution]

Have you tried the following?

go to vsphere switch -

Properties > Select vswitch > Edit > Security > Promiscuous to accept > Ping away.....

I would not recommend modify that settings as it creates a very large security issue. It should only be done for VMs running certain software such as IDS or network analyzing.

To Xicor, these VMs that you are trying to make contact between, are they on the same ESX/ESXi host or on different hosts?

Have you actually got any VMNIC connections for the vSwitches your VMs are on?

[chadwickking]

Essentially go to the host service console and run esxcfg-vswitch -l .

Could you run it on the Host that has all the VM's?

Also run esxcfg-vswif -l and paste it as well so we can see your switching and swif setups.

As said before the promiscious mode is a "security risk" but we were doing a test.

Cheers,

Chad King

VCP-410 | Server+

Twitter:

If you find this or any other answer useful please consider awarding points by marking the answer correct or helpful

[jpdicicco]

Alright, here's what your config should look like from each VM out though each host and the pSwitch:

VM has NIC (VMXNET3, E1000, whatever) that has IP configuration in the guest for the local subnet, and a gateway if it needs to talk to systems that are not on the subnet.

The VM configuration should have the VM NIC set to the correct port group.

The portgroup is on the correct vSwitch and has the correct VLAN ID associated (if it will be connected to a port that is trunked/uses VLAN tagging).

The pNIC correct is associated with the vSwitch. You need pNICs in order for guests on different hosts to talk to each other, even if they're in the same VLAN or on a vSwitch with the same name.

The switch port configuration associated with the host NIC/pNIC is correct, allowing for your VLAN traffic either as the native VLAN or as a tagged VLAN.

Since you are using multiple hosts and therefore need to engage your physical network, you may want to have your network team setup routing, rather than using a multi-homed VM. It should be possible to configure security on a router interface for each VLAN to only allow traffic that is routed to the other VLAN that it is allowed to talk to. This prevents the need for a dedicated router VM.

Check the config at each layer and let us know. Start with 2 VMs on the same host, and verify that they can ping each other, then work your way out through the configurations from there.

Happy virtualizing!

JP

Please consider awarding points to helpful or correct replies.

[EshuunDara]

Wouldn't it be easier to configure the VLANs to talk just like you would if this were a physical environment? Just configure the link to your ESX Servers as trunk, and then set the ports on the virtual nics to whatever VLAN you need and call it good. This way your ESX hosts can have guests on any vlan, and you use your networking equipment that is already in place to define what vlans can talk to each other.

[xlcor]

Whew!! OK, the issue is finally resolved!!! Sorry for the delay in posting my findings... the result seems to be a combination of advice given by jpdicicco, ricnob and a.p. (although I do thank everyone who contributed, because I certainly learned alot from all you experts out there, and from the process in general!!).

The basic rule of thumb is, if you setup a vswitch with no adapters, and all associated VMs are using the same virtual machine port group (like was the case in this situation), then all VMs need to reside on the same, single hypervisor. Given that the vswitch has no physical adapters associated with it, for that port group, there can be no communication outside of the local host (ie. the local ESX server), not even via a dedicated vmotion VLAN (which I have, using a dedicated vmkernal port group).

Not knowing this, for load balancing, I had all the VMs spread across all of my ESX servers. I had to temporarily assign them to an actively connected port group, vmotion them to a single ESX server, change them back to using the isolated port group, and voila!! All the VMs could now ping each other! (I had preconfigured all their static IPs to be on the same flat subnet) and I didn't need the VM router appliance that I had configured!

Again, thanks so much for all the contributors, I have learned alot from this experience!!!