vmware, vlan, firewall

Question

Our internet used to come into a small switch, through a physical firewall, then to the main swithch, where our 3 esx'es are also connected.

Now the firewall has been virtualized, so the small and big switch is connected, and the virtual firewall as both legs to the same switch.

It appears to give no problems, as inside and outside is on different subnets, routed through the firewall.

But still, I'd like to keep the inside and outside separate...

There is not enough physical nics on the esx'es to have the outside on a separate nic.

I can create a "Virtual machine port group" with vlan 99 on a vSwitch, where I can connect the "outside leg" of the firewall.

But where should I "Tag" the internet connection? There are 3 locations, listing outside to in:

• A: The port from the media converter (fibre) on small switch
• B: The port going to the "main" switch from small switch
• C: The port in the main switch coming from small switch

The switches are Dell, with options

On page Vlan membership:

• Not member
• Untag egress packets
• Tag egress packets

On page "Vlan port settings"

• pvid [1-4095] (99, I think)

Frame type:

• Admit all
• Admit tag only

Ingress filtering:

• Enable
• Disable

Where and what should I set?

Answer 1

I'm assuming you manage the ESXes over separate pNICs. Otherwise (though it's not best practices) you just handle the management network the same way as the VM networks below.

You begin with the physical switch your ESXes are connected to. Configure VLANs "outside" and "inside". Connect the ISP to outside VLAN, everything else to inside VLAN. The pNICs used by VMs are special: configure the physical ports to be trunks with all VLANs on them, with 802.1q tagging. I'm not familiar with your switches, but I believe the above will be achieved if for VM traffic ports you use "tag egress", "admit tag only", pvid doesn't matter, ingress filtering enable, and all non-VM traffic ports have untag, correct pvid (the one that corresponds to the outside or inside VLAN based on what's connected to it), admit all, ingress filtering doesn't matter.

Then go into ESX and create a single vSwitch for all VMs.

On that vSwitch, you create two portgroups, "outside" and "inside" (the first port group is created as you create the vSwitch, then you add another one by going through the same "Add Networking" wizard, but reusing an existing vSwitch). They both should have VLAN IDs assigned to them, the outside VLAN and the inside VLAN correspondingly. Then attach your firewall VMs to both port groups (one vNIC to each port group), and attach your internal VMs to inside port group only.

VMware reference document is this: http://www.vmware.com/pdf/esx3_vlan_wp.pdf and you're looking for the section that describes "VST".