0

I am facing a peculiar problem. Earlier we had 4 network segments in our production setup, say segment A,B,C and D. A,B and C are able to communicate with each other,the corporate lan and the internet. Segment D is completely isolated segment and purely used for backup and management. so a host Z only on segment D was not able to access any of the other segment.

We recently introduced vmvare vsphere 5.1 setup in our production environment. We have created a distributed switch in vcenter. The distributed switch has uplinks from all the 4 network segments. We have created separate port group for each segment as well.

Now the problem is the host D is now able to communicate with other segments, but only those in the vmware setup, ie hosts attached to the distributed switch. Physical machines in other segments are still not accessible by machine Z.

Now this is my analysis of the problem.

  1. Checking the host Z, if found the the default gateway was set as host Z itself.
  2. A vsphere distributed switch behaves like an L2 switch and port groups are just a group of ports and does not mark any isolation between them.
  3. Since the default gateway is maintained, there is path in the host Z routing table for all other segments. ie the packets reach the D segment switch[point 1].The switch is then sending these packets through the uplinks to the vsphere distributed switch, Keeping point 2 in mind, the packets reaches the destination host.

Point 3 is where I am confused[specifically, the part which is bolded], may be due to my less knowledge in the networking side. Since for machine Z, the gateway is itself, any packet sent for other segments should return to itself....!!.??..or I know that there is something called the spanning tree protocol, which prevents looping in the network. Is this coming into play....?? How is the packet reaching my distributed switch....??

Please correct me if any of the points are wrong and many thanks in advance.

Improve this question
3
  • Spanning Tree prevents traffic storms when you connect multiple switches together: A to B, B to C, and then C back to A, by detecting the presence of a physical loop and automatically blocking one of those three paths to prevent the switches from forwarding the same traffic over and over in a circle... so that is unlikely to be related. The default gateway isn't relevant if host Z has an IP address on the same subnet as other hosts, since the gateway is only used to reach hosts that are not on the same IP subnet. Describing the IP subnetting scheme may be useful, here.
    – Michael - sqlbot
    Mar 16, 2014 at 12:39
  • hai michael, Thanks for the reply. A i mentioned in another comment, we have separate physical switches for the 4 segments. Routers are maintained for segments A,B and C and they can communicate with each other,corporate lan and internet. Switch for segment D is physically isolated. It is not connected to any router. What i noticed is the moment i set default gateway of host Z as itself or any other machine's IP in segment D, its able to communicate to machines in other segment,but only those attached to the vmware VDS. Physical machine is other segments are still not accessible.
    – varun
    Mar 16, 2014 at 13:44
  • Physical machine is other segments are still not accessible. please note that host Z is attached only to segment D switch which has no routers connected to it.
    – varun
    Mar 16, 2014 at 13:49

2 Answers 2

Reset to default
2

At last got the answer to my question. Its was due to how Linux implelemts TCP/IP stack. By default it uses weak host model.[http://en.wikipedia.org/wiki/Host_model] . The Remote hosts network adapter which was connected to the private network was responding to request on the ip of the other adapter due to this.

The host Z was always accessing the private network D only . As mentioned by sean,since the default gateway of Z was set to itself, it would try to sent packets directly to any other host, which supported the behaviour.

Improve this answer
0

It sounds to me like your network is not actually segmented how you describe. Is it possible that the distributed switch is using the same VLAN number for all port-groups or possibly not using VLANs at all? If packets are not being VLAN tagged via the VDS, that would explain why there is undesired connectivity inside of vSphere, and that same connectivity is not observed on the physical uplinks.

It might be helpful to provide more details about IP/masking across your environment, as well as router interfaces to explain the segmentation in more detail.

In any case, I hope this much might be useful. Good luck.

Improve this answer
13
  • hai sean, thanks for the reply and you are correct. We are not using vlans. We have seperate switches for each segment. I m not clear how the packets are reaching the VDS at first place when the default gateway is the host Z itself.Any light on this..?
    – varun
    Mar 16, 2014 at 7:11
  • it is possible that the IP and netmask on host Z are set in a way that the host does not think it needs a gateway to reach the hosts on other segments. the fact that you are not using VLANs means that the hosts within vSphere would be able to reach each other without a router, depending on how their IP/mask is configured.
    – sean
    Mar 16, 2014 at 13:56
  • the moment i remove the gateway setting on machine Z, its not able to communicate with other segments. This shows that, the gateway has something to do with the behavior. Yes, the hosts within vsphere are able to reach one another depending on their IP/MASK settings.
    – varun
    Mar 16, 2014 at 14:05
  • with a default route set to it's own interface, the server would attempt to send packets directly to any other hosts. this is much like host Z having a mask that summarizes all of your networks. again, it would be helpful for you to describe your subnet scheme. since your virtual network is not segmented, there would be more going on at layer-2 than you might think. to prevent cross-network communication, you would really want to assign VLAN numbers to the port-groups on your VDS, forcing hosts to go through their respective routers to reach other segments.
    – sean
    Mar 16, 2014 at 14:39
  • ok, thanks. on host z, remove the default route and use a /16 mask. the connectivity will still work because all networks are using a common (default) VLAN. please tell me if this works.
    – sean
    Mar 16, 2014 at 15:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .