8

I currently have an ESXi server hosting a PFSense guest which is being used as an internet-facing router.

This ESXi server is set up with two vSwitches (each with an associated port group):

  1. WAN - 1 physical uplink
  2. LAN - Connected to a few other virtual machines, as well as 11 physical GigE uplinks.

Edit (to clarify):

  • The "WAN" vSwitch physical uplink connects to a modem - this works fine.
  • The "LAN" vSwitch physical "uplinks" will be connected to physical clients on the internal network.

The PFSense guest on this server has virtual NICs attached to each of the aforementioned port groups (both WAN and LAN), and successfully routes traffic between the two, albeit with one caveat: Only one of the physical uplinks on the LAN vSwitch functions at a time, so I can only connect one physical client machine at a time to the network. This is ostensibly because it is currently configured for failover.

I would like to be able to configure the LAN vSwitch so that instead of using each of the physical uplinks for failover for one link in total, it instead treats each as a separate link allowing different physical clients to be connected to each (functioning as, well, a switch) - if this is possible, how would I go about configuring this?

Thanks!

Edit: Current configuration:

The physical adapters on this vSwitch are not all connected to a switch - I am not trying to aggregate the links. I am merely trying to connect multiple external machines to these physical adapters and have the vSwitch perform packet switching between them (allowing them all to be on the same network as the VMs without using an external switch).

screenshot 1 screenshot 2

1
  • Could you post a screenshot of your hosts networking configuration from vSphere? It would really help to see how the vSwitch ports are currently configured.
    – D34DM347
    Aug 15, 2018 at 13:05

4 Answers 4

2
+100

So the physical server running ESXi and hosting the pfSense virtual machine has 12 physical UTP cables connected to it: one for the WAN link to your internet router and 11 for internal connections? Do these 11 internal-use UTP cables go directly to other servers or do they connect to a switch first? If only one is up and the other 10 are down, I would suspect that the spanning-tree protocol on your switch disables the 10 interfaces as it detects a loop? Why not create a port-channel (LACP) configuration on your switch and ESXi host?

If these cables directly connect the ESXi host to other servers, I would check port speed and duplex settings as well as the UTP cable type (straight vs. crossover).

3
  • I have updated the question for a bit more clarity here. I am not using an external switch or trying to aggregate the links (i.e. with LACP). Each port should be able to connect to a different physical machine and function as if that machine is connected to a physical switch with all of the other machines/VMs.
    – Eli
    Aug 16, 2018 at 4:55
  • Thanks for the clarification. If I remember correctly, this will not work as the vSwitch will not forward traffic out its uplink that it receives from another uplink. So if you have two computers (A and B) that are connected to those physical uplinks and both computers try to communicate with each other, the vSwitch will just drop the packets between them. However... that does not fix the issue of the links staying down. But this won't matter really since it won't work regardless.
    – Tommiie
    Aug 16, 2018 at 9:45
  • Alright, thanks for the info - I'll mark this as the answer
    – Eli
    Aug 16, 2018 at 19:09
0

The cheapest way is the Round-robin DNS. Your host can have more than one A record in the DNS-zone. For each request that IP-adresses will be rotated. Client in general use only first from the set replied, so all IPs will be evenly distributed among the clients. That approach need your own named for master and slaves as far as Google's 8.8.8.8 and other public services denies to rotate IPs in the replies. The reason is the too small TTL that should be set for zones to reduce the outage if one or more uplinks becomes unavailable.

Further reading can be found here: https://en.wikipedia.org/wiki/Round-robin_DNS

1
  • I think I may have phrased the question a bit ambiguously. "Uplinks" are what ESXi refers to external network interfaces bound to a virtual switch as - I am not trying to set up 11 publicly-facing WAN uplinks here (although the method you describe would work for that), I am merely trying to have these eleven physical "uplink" ports on my ESXi vSwitch used for separate inward-facing links, not used for failover.
    – Eli
    Aug 7, 2018 at 1:10
0

Change the setting

NIC Teaming policy -> Failback => Yes. This will "return" "failed" links to usage again once the link is physically up. This can also apply on boot up, where it finds the first available link and thinks life is good and leaves it at that. Until a glitch occurs and it flips over to another link, disabling the original until the now active link fails.

You may also need to change the vSwitch "Link Discovery -> Mode" from Listen to Both as you don't actually have a physical switch involved in these links from the sound of things, and may need this feature in the network at this central point in the network of switch(es).

0

I had the same problem as you. As the other answerer notes, the architecture you're trying to implement is nominally impossible; an ESXi vSwitch is, apparently, incapable of turning a server into a stand-in for a switch.

There is a workaround, however: you may assign those NICs to pfSense and allow it to be the switch. (The core problem is that this setup entails CPU switching, thus is not recommended when there may be a lot of LAN traffic; ESXi flatly refuses to support this use-case. But pfSense at least permits it.)

Here is what that looks like in my specific instance; you may scale it up to your use-case:

Original (non-functioning) architecture

an ESXi-based hypervisor, containing a vSwitch, a pfSense VM, and a number of assorted VMs. The pfSense VM is connected exclusively to a modem thru NIC1 via its designated "WAN" link; its "LAN" link is connected to the vSwitch. The vSwitch is also connected to all other VMs, as well as NIC3 and NIC4. In the physical world, a commodity SOHO Wi-Fi router providing Guest and BYOD access is wired to NIC3, and a Workstation is wired to NIC4.

Revised (functioning) architecture

an ESXi-based hypervisor, containing a vSwitch, a pfSense VM, and a number of assorted VMs. The pfSense VM is connected exclusively to a modem thru NIC1 via its designated "WAN" link; it has two "LAN" links: one connected to the vSwitch, and one PCIe-passthrough to NIC2. The vSwitch is also connected to all other VMs, as well as NIC4. In the physical world, a commodity SOHO Wi-Fi router providing Guest and BYOD access is wired to NIC2, and a Workstation is wired to NIC4.

(Yellow lines are Cat6 cables; Green are PCIe passthroughs; Black is a coaxial cable; Blue lines are active virtual connections, and the Red line is an inactive virtual connection standing by for failover.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .