Regarding VMnetworking

[abhilashhb]

Hi all,

I have a doubt...i have 4 virtual machines running on a esxi host and i need them all to communicate internally and 2 of them to communicate with the external network.

I have connected all of them using a switch internally and for 2 systems i've provided another NIC card and connected them to another switch and have assigned NATed IP??
I'm able to ping all of them internally but the externally assigned IPs are not pinging....any solutions?? is it the right way to do it?

[Jackobli]

Hello. You didn't explain a lot about the configuration. Maybe threre are missing parts?

I tried to create a fast drawing of a possible configuration.

vSwitch2 does not have any physical network adapter (pNIC). VM1-4 are connected to vSwitch2 and are configured to use private subnet2 and its IP adresses to communicate

vSwitch1 does have a pNIC which is connected to your Firewall/Router. VM1 and VM2 are connected to a second vNIC to vSwitch1. Their second vNIC is configured with an IP address out of a private subnet1. These addresses are NATed on the Firewall/Router to a public IP address.

Can you confirm this architecture?

Snapshot converted to jpg

[rajeshkongu]

Hi,

can you post your screenshort of your network configuration tab.

regards,

karthick

[abhilashhb]

yup thats exactly the scenario.....perfectly shown.....what u think is the solution?

[IgnitionUSMC]

When you say the extenal addresses are not pingable externally, are you trying this from a workstation/desktop outside of the firewall/NAT, correct?

How is your NAT configuration setup?

[Jackobli]

Check as you would do when all physical.

What kind of OS? Any Firewall inside that OS?

Can VM1 connect to VM2 and vice versa?

Are you able to ping outbound (to Firewall, further)?

Standard Gateway? Nameservers?

Wrong Firewall settings?

[kjb007]

When you have multiple network adaptesr in a VM, then you typically end up with asymmetric routing.  Meaning the traffic coming in can come in either interface, but will only go out the default network, if the machine doing the pinging is not on the same subnet.

This is similar type of DMZ config is typically done with the external NIC being the default, and a static route added to allow for the internal traffic.

-KjB

[abhilashhb]

The VM's are running on windows 7......yup the firewall settings are disabled....i'm able to ping another virtual machines on other esxi hosts but not able to ping VM's from the base OS of the desktop where my vSphere client is residing(It should work coz both of them r in different networks and i've assigned a NATed IP to those two VM's) moreover i'm not able to take RDP to the VM's which are connected to external network which is not surprising as ping test itself is not getting through.
I'm doubting its the default gateway that's configured wrong....can i have 2 different gateways on 2 NIC cards in the same VM??

[abhilashhb]

Yup i'm trying to ping from a external network which is on a different subnet....I'm afraid i'm not sure  with the NAT configuration...i'll have to ask my network tem.

[abhilashhb]

yup the machine doing the pinging is not on the same subnet....so is that a problem? as it has NATed IP it should be able ping right?
But yeah even i had the doubt bout traffic flow when two NIC's are present in the same VM.

[kjb007]

Can you ping the external IP from the firewall itself?

Having multiple NIC will require you to set some static routes. That NAT'd IP will work, but the traffic responding back from the host will use the actual IP doing the ping'ing unless you have source NAT as well, which means the server will try to send out its default gateway.

This is why typically the external route will always have the default route set, and there will be a static route for the interal network pointing to the internal gateway.

-KjB