I have two virtual machines on a VMWare ESXi server - a Sophos Firewall and a Windows Server. On the LAN side of my network, I have a bunch of devices and a Cisco ATA connected to a real switch. This switch is connected to nic0 on the server. I am trying to fully segregate VOIP traffic onto VLAN=4. This is the only VLAN in use.
vSwitch0 Topology: The following port groups are connected to physical adapter vmnic0...
- Sophos Port Group. VLAN = 4095 (trunked). VM = Sophos XG Firewall. IP = 192.168.2.1/24.
- Management Port Group. VLAN = 0. VMKernel port vmk0. IP = 192.168.2.2/24.
- Windows Server Port Group. VLAN = 0. VM = Windows Server 2016 IP = 192.168.2.3/24 As I mentioned, nic0 is wired to a real switch. This port trunks VLANs = 1 (untagged) and 4 (tagged).
From a computer attached to another of the real switch ports (PVID=1, IP=192.168.2.40/24), I am able to access the Sophos Firewall and the VMWare Management Server, but NOT the Windows Server.
This seems strange because both VMWare and the Windows Server port groups have the same setup on the virtual switch (VLAN=0 off).
When I add the Windows Server VM into the Sophos Port Group (VLAN=4095 trunked), all works fine and all devices can communicate. However, I don't particularly like this because all my VLAN=4 traffic can be seen on Wireshark on the server, and I'd like to properly segregate VLAN=4 traffic such that the Windows machine cannot see any VOIP data. This should only be seen by the firewall, which forwards it to a WAN virtual switch and physical adapter and out to the internet.
- Why am I able to access VMWare Management (192.168.2.2), but not the Windows Server (192.168.2.3), from a computer (192.168.2.40) attached to the real LAN switch? Their setup on the vSwitch and port groups are identical.