I have the next configuration:

VM1 - - - >

VM2 - - - > VM0 Gateway

VM3 - - - >

By now all vms are in the same PortGroup but I want to isolate each mv in one VLAN so I created one PortGroup with one vlan for each mv, like this:

PortGroupA VLAN 10 for Gateway(pfsense)

PortGroupB VLAN 20 for VM1

PortGroupC VLAN 30 for VM2

PortGroupD VLAN 40 for VM3

The problem is this, I want to connect each vm to the gateway but I can't, I was reading and it's not possible to assign two or more VLAN to one PortGroup, I tried putting VLAN 10 in 4095 but nothing, of course if I put PortGroupA and PortGroupB in the same VLAN works fine. The other solutions I was thinking is to put one NIC in the gateway for each PortGroup, but I think it's a wrong option. Thanks!

edit: I'm reading about vlan in esxi, and there is somebody saying that, we only use vlan when connect to physical switch, is right? in this case, I have my infrastructure completely virtualise, so, there the best solution is using subnets? nothing more?

  • Look up private vlans and see if that fits your needs – Frederik Nielsen Dec 17 '16 at 23:17
  • Sounds good, I was looking for that option but I have not the enterprise edition, sorry, any idea? – Julio Dec 17 '16 at 23:28

Okay, I understand what you are trying to do. Your idea about adding additional NIC for each VLAN is also not incorrect, but let's assume you have 100 VLANs. If this is the case then surely adding additional NICs to pfsense VM does not sound feasible. You will definitely hit a scale issue.

From a design point of view, the correct way to do this would be by configuring PortGroupA to receive all VLANs. To do this please edit the PortGroupA VLAN ID setting to ALL(4095). This will allow PortGroupA to extend broadcast domain for each VLAN to extend all the way till the pfsense virtual firewall appliance.

Then on the pfsense firewall appliance you configure four sub-interfaces(or VLAN interfaces) with VLAN tags 10, 20, 30, 40. Configure IP address for each sub-interface in pfsense. This all assumes that you are using different subnets for different VLANs. For example, you should have subnet something like below;

 subnet 192.168.10.x/24 part of VLAN 10. 
 subnet 192.168.20.x/24 part of VLAN 20. 
 subnet 192.168.30.x/24 part of VLAN 30. 
 subnet 192.168.40.x/24 part of VLAN 40. 

Then on pfsense your VLAN interfaces should have IP addresses from each VLAN and these IP addresses will become the default gateway for their respective VLAN. What this means for your VMs is that their default gateway will be configured to point to IP addresses configured on pfsense firewall. Example,

 if IP address for VLAN 20 on pfsense firewall is configured to
 then the default gateway on the VM part of VLAN 20 (PortGroupB) should be 
 configured to

Bottom line, you want to enable pfsense to take care of dealing with understanding which traffic belongs to which VLAN, and where is this traffic coming from and where is it going to.

Basically, from a networking point of view, you should be looking at creating a Router-on-A-Stick with firewalling capabilities hosted within ESXi hypervisor as a virtual appliance.

All the best !! let me know about your progress.

  • Oh it's a good solution, it's working fine, I just need to block the traffic betwen networks(vlans) and that's all! Thanks! – Julio Dec 18 '16 at 11:30
  • no problem, I'm glad that helped!! – kodeliner Dec 18 '16 at 21:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.