Split VLANs on single ESXi host

[thejimmahknows]

Hey all,

Quick quesiton. If I have a single ESXi server with two physical NICs, can I have some guests use NIC 1 and others use NIC 2. The practice here would be the two NICs are on separate networks. Lastly, If the two NICs were on separate networks (two different DMZ networks that should should not be able to talk to one another) is this a bad practice?

Reasoning is to set up one ESXi server to host guest for either DMZ network, where each DMZ network is only reachable by certain clients.

Let me know what y'all think.
Cheers,

Jim

 

[Chimay]

As long as you've got matching VLAN tags from inside the ESXi switch or switches to the outside switch where you're running VLANs it should be fine.

 

[thejimmahknows]

As long as you've got matching VLAN tags from inside the ESXi switch or switches to the outside switch where you're running VLANs it should be fine.

Cool, thx. And the ESXi host will isolate the guests that are on different networks?

 

[Chimay]

As long as you setup the virtual switch to support the VLANs you setup on the outside switch and trunk them together you should be good to go. If your goal is to never have either of the VLANs talk to each other you shouldn't need any layer 3 switch or router for inter-vlan communication. Sounds all fairly straight forward to me. Until each network hits the gateway they should be separate. You can then set ACLs or policies at the gateway if you want them to talk or not to each other.

I'm not an expert but from what I've read and done this is all possible as long as everything is tagged and trunk is correct from virtual to physical.

 

[itrsteve]

Is there any policy that dictates that the traffic can't ride on the same link? Sometimes organizations don't see tagging as sufficient enough separation for DMZ traffic so you have to dedicate a whole pNIC to that specific network. I say this in argument to the suggestions of using trunking & tagging.

Yes, esx can separate that traffic. Just have a portgroup for each network and assign your virtual nics to the portgroups accordingly.

 

[Vader]

Is there any policy that dictates that the traffic can't ride on the same link? Sometimes organizations don't see tagging as sufficient enough separation for DMZ traffic so you have to dedicate a whole pNIC to that specific network. I say this in argument to the suggestions of using trunking & tagging.

Now i'm not a networking expert but can't you accomodate this with Private VLAN Edge?

 

[l3thal6]

This is how I am doing networking in my home lab, tagging traffic from my vSphere host out to a trunk port on my Catalyst.

Private VLAN's won't really allow complete isolation of different VLAN's on a interface, they can isolate interfaces from each other or only allow specific groups of interfaces to communicate.

EEUSDS013550#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1
2    NULL                             active    Fa0/2, Fa0/3, Fa0/4, Fa0/5
                                                Fa0/6, Fa0/7, Fa0/8, Fa0/9
                                                Fa0/10, Fa0/11, Fa0/12, Fa0/13
                                                Fa0/14, Fa0/15, Fa0/16, Fa0/17
                                                Fa0/18
101  USER_ACCESS_1                    active
102  USER_ACCESS_2                    active
201  VOICE_ACCESS_1                   active
202  VOICE_ACCESS_2                   active
501  SERVER_ACCESS_1                  active
602  WANFACING__ACCESS_1              active
701  vSphere_LAB                      active
802  WAN_ACCESS                       active
901  Cisco_MGMT                       active
902  vSphere_MGMT                     active
1002 fddi-default                     act/unsup
1003 trcrf-default                    act/unsup
1004 fddinet-default                  act/unsup
1005 trbrf-default                    act/unsup

EEUSDS013550#show run int g0/1
Building configuration...

Current configuration : 246 bytes
!
interface GigabitEthernet0/1
 description Server Access
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 2
 switchport trunk allowed vlan 1,3-4094
 switchport mode trunk
 switchport nonegotiate
 spanning-tree guard root
end

EEUSDS013550#show int tru

Port        Mode             Encapsulation  Status        Native vlan
Gi0/1       on               802.1q         trunking      2
Gi0/2       on               802.1q         trunking      2
Po1         on               802.1q         trunking      2
Po2         on               802.1q         trunking      2
Po3         on               802.1q         trunking      2

 

[itrsteve]

Now i'm not a networking expert but can't you accomodate this with Private VLAN Edge?

It's more about business requirements. I've been in situations before where it was unacceptable having DMZ and non-DMZ traffic riding the same pNIC/cable/etc. So when I read the OP's question I had a feeling this may of been the case.

 

[thejimmahknows]

I will try this once the hardware comes in the mail and post back. Thanks all!

 

[NetJunkie]

Now i'm not a networking expert but can't you accomodate this with Private VLAN Edge?

Private VLANs are really no different than regular VLANs. Doesn't help with traffic separation in a secure manner any more than regular VLANs.

 

[NetJunkie]

Yeah, you can easily do this. Plug NIC1 in to its network, NIC2 in to its. Create two vSwitches. Put NIC1 as an uplink on the first and NIC2 on the second. Create a port-group on the first vSwitch for the VMs you want to use NIC1 (and set it to the right VLAN) then do the same for vSwitch and NIC2. They can be set for the same VLANs..it doesn't matter.

Then just attach the vNICs in each VM to the right port-group.