ESXi, pfsense & vlan-ning

[callmeedin]

ESXi 5.1 box with 2 physical NIC's
pfSense 2.0.2 running as a virtual machine on the ESXi box
--1 NIC/vswitch connected to cable modem (WAN)
--1 NIC/vswitch connected to HP 1810G (LAN)
--I will be receiving 2 more NIC's for this server next week
I have various other virtual machines running on the ESXi box and they all use the LAN vswitch.

Right now the HP 1810G is working just as an unmanaged switch, but I would like to start playing around with VLAN's.
So what is the best strategy to setup a flexible VLAN environment?
Reading about it, sounds like VST mode (virtual switch VLAN) tagging is the most flexible way to go. I am assuming I would team up the 2 new NIC (or maybe even 3, if I can use the current LAN NIC) and setup the various vlans on the ESXi.
Do I still need to setup the same vlan's inside the pfsense & 1810G? I can still assign the various ports on the 1810G to different vlan's, right?
Am I on the right track or is there a better way to go about this?

Thank you in advance for your help.

 

[athlon1.2]

You can pass it as VLAN 0 to pfSense and do the tagging in pfSense. Or you can create 1 NIC in Vmware for each VLAN and no tagging in pfSense. In any case you need to set the ports as tagged trunk ports in the switch.

I've never used teaming but failover between multiple switches works great. My recommendation for testing is keep the management on the current NIC so you don't lock yourself out and setup VLANs on a new NIC and migrate everything over.

 

[dave99]

I use pfsense to do all the vlan routing, 2 pNIC's for the 2 internet connections, 1 pNIC for the LAN side. So various vlans on the esxi box itself, then a trunk connection to the first switch to access all the rest.

 

[callmeedin]

Thank you both for your input. Much appreciated.
Once I have the new pNIC's in place, will have to figure out which route to take. I will probably be back with questions.

 

[green91]

Like Athlon, I created vnic based on VLAN with great success. I went with this option because I didnt want to dedicate a NIC to my DSL modem, so i created a VLAN for the modem, untagged the modem''s switchport, tagged the VLAN to the esxi box's NIC and created a vnic. I am able to pass PPPoE over this while using the same physical NIC for LAN & DSL.

 

[callmeedin]

Thanks to your tips and setup pictures, I was finally able to setup a basic VLAN environment.

Edit: I clearly never attached a picture to a forum post before. Hope either the picture or the URL are visible after this edit.

http://imgur.com/5ducpxB

 

[zophar]

This is exactly what i'm searching for months

Will you give me more details about your network/subnet range ?

Thank in advance

 

[NetJunkie]

This isn't complicated. You have one IP subnet on the "external" network that connects your firewall/pfSense/Untange external interface to the cable modem and then an "internal" network for your servers and other stuff. You may have multiple internal networks if you want to split out something like vMotion or NFS/iSCSI storage.

But you just go on your switch and create a VLAN for each one. External VLAN, Internal VLAN, vMotion VLAN (if you want). Tell the switch to tag all frames on the links to your vSphere boxes...and don't tag the frames going to the cable modem or other non-VLAN aware devices (like a NAS). Give your firewall two NICs. One on the inside, one on the outside.

I do this with Untangle in my home lab. Very simple stuff.

 

[Hawkbox]

I never even thought of vlanning my pfsense box, don't know why as I only have 2 nics right now in my server. Guess the question I want to ask is do I need to tag the pfsense external traffic from the modem or is just tagging the port on the switch adequate?

I'm not sure how to vlan the external traffic while not tagging the modem traffic.

Second question tangent, is Untangle good? I've never heard of it.