Our internet used to come into a small switch, through a physical firewall, then to the main swithch, where our 3 esx'es are also connected.
Now the firewall has been virtualized, so the small and big switch is connected, and the virtual firewall as both legs to the same switch.
It appears to give no problems, as inside and outside is on different subnets, routed through the firewall.
But still, I'd like to keep the inside and outside separate...
There is not enough physical nics on the esx'es to have the outside on a separate nic.
I can create a "Virtual machine port group" with vlan 99 on a vSwitch, where I can connect the "outside leg" of the firewall.
But where should I "Tag" the internet connection? There are 3 locations, listing outside to in:
- A: The port from the media converter (fibre) on small switch
- B: The port going to the "main" switch from small switch
- C: The port in the main switch coming from small switch
The switches are Dell, with options
On page Vlan membership:
- Not member
- Untag egress packets
- Tag egress packets
On page "Vlan port settings"
- pvid [1-4095] (99, I think)
- Admit all
- Admit tag only
Where and what should I set?