Base component is the virtual switch (vSwitch). A vSwitch is a very simple Layer-2 device with a software CAM table. Virtual Distributed Switch is superset of the vSwitch. A container for identical vSwitches across all vSphere ESX/ESXi Hosts. Virtual Distributed Switches also add the ability to use Private VLANs and other security constructs.
Components
- ' Portgroup (vPG) is subset of the vSwitch
- Portgroups can represent VLANs on physical switches
- vSwitch connected directly to physical NICs (pNIC) placed in bridged mode
- virtual machine NICs (vNICs) connect to Portgroups
- vmkernel ports (those used just by the hypervisor) connect to Portgroups
- o NFS IP Storage used for NFS based Data Stores
- iSCSI IP Storage use for iSCSI based Data Stores
- FT Logging used by VMware FT
- VMware vMotion used by VMware DRS and vMotion
- ESXi management appliance vmkernel device connects to portgroups per Figure 2.
- ESX service console virtual machine vSwif device connect tport groupsps. See Figure 3. Virtual Networking ESX/EXi Networks
Virtual Networking Design Considerations
Virtual Networking encompasses redundancy, security, and performance. There should be 2 physical NICs per network/ trunk entering a VMware ESX or ESXi host for redundancy and performance.
For the best security results, each virtual network security zone should be connected to different physical switching networks. Less than 4 physical NICs is considered insecure, lacking in redundancy, and will suffer performance degradations.
Virtual Switches cannot be layered or connected directly to each other. There needs to be a VM between two virtual switches acting as a router, gateway, bridge, or firewall to connect to vSwitches.
- Draw out your virtual network to get an idea of how everything interconnects.
- Use of SR-IOV or VMware VMDirectPath bypasses the virtual switch and connects a VM direct to the pNIC.
Common Virtual Networking Examples
The most common question is how to configure virtual networking with either 4 or 6 physical NICs (pNICs). These examples will assume the following:
- All virtualization host networks are required (FT Logging, vMotion, NFS, iSCSI, and Management)
- There is at least one Virtual Machine Network
4 pNICs
With 4 pNICs there is quite a bit of overlap between all the various networks and network performance would need to be considered. Each pNIC on vSwitch0 has several networks running over it so VLANs or subnets will be necessary.
- pNIC0 handles the Service Console (Management Network, FT Logging, and vMotion)
- pNIC1 handles the IP Storage Networks
- pNIC2 and 3 are used to give redundancy to the Virtual Machine Network.
It is best when using less than 6 pNICs to choose to not use this configuration for a DMZ UNLESS pNIC2 and pNIC3 connect to separate physical switching networks due to the hostile nature of this network.
6 pNICS
With 6 pNICs some of the overlap disappears and you have enough pNIC to have both a standard virtual machine network as well as a DMZ.
With 6 pNICs there are now 3 vSwitches and each pNIC has a specific duty:
- pNIC0 handles the Service Console (Management Network and vMotion)
- pNIC1 handles the FT Logging Network
- pNIC2 handles iSCSI traffic
- pNIC3 handles NFS traffic
- pNIC4 and pNIC5 are used to give redundancy to the Virtual Machine Network.
In general, you want to have separate pSwitches to increase security from Layer-2 network attacks instead of using VLANs. Use of VLANs is a trust that your pSwitches are not susceptible to Layer-2 attacks.
When you introduce a DMZ into the mix for 6 pNICS our virtual network looks like our standard 4 pNIC case for all but the DMZ which uses the extra 2 pNICs.
- pNIC0 handles the Service Console (Management Network, FT Logging, and vMotion)
- pNIC1 handles the IP Storage Traffic
- pNIC2 and pNIC3 are used to give non-DMZ virtual machines redundancy.
- pNIC4 and pNIC5 are used to give redundancy to the DMZ Network.
What makes this configuration work with a DMZ is the use of separate pSwitches for each pair of pNICs. This gives the virtual network security and redundancy. However, IP Storage performance can suffer.
Bridging between vSwitches
The last example network is one where you have a need to bridge between two vSwitches using a virtual appliance. The use of this is for:
- Placing a firewall, gateway, or router between two VLANs/Networks
- Implementing some form of inline Virtual Network Security such as VMware vShield Zones and other non-VMsafe security tools
There is a major Caveat however:
- ' This does NOT work with the Cisco Nexus 1000V vSwitch.
The second Portgroup to be bridged (vPG2 in Figure 8) does not need to be:
- On the same vSwitch
- Connected to a pNIC
In addition to bridging between two Portgroups, if the VLAN ID of a portgroup is 4095, it acts as a SPAN port which receives all network packets on a given vSwitch.
VLAN Methods within Virtual Network
There are three 802.1q VLAN implementation methods within the vSwitch. They are defined by where the trunk of VLANs ends.
| External Switch Tagging (EST) |
The Trunk ends at the pSwitch and each pNIC on the Virtualization Host has a single network cable representing a separate VLAN/Network |
| Virtual Switch Tagging (VST) |
The Trunk ends at the vSwitch and each portgroup on the vSwitch represents a different VLAN |
| Virtual Guest Tagging (VGT) |
The Trunk ends at a specific VM. This only works if the VLAN ID of the portgroup to which the VM is connected has a VLAN ID of 4095. |
