Skip to main content

vSphere Distributed Switch Part 18 – Configuring dVPortGrouP VLAN Policy

In this post i am going to explain how to configure VLAN policy at distributed port Group. This VLAN ploicy can also be configured at distributed port, Uplink PortGroup and Uplink Port level.  I have explained different types of VLAN’s available with distributed portGroup along with the detailed explanation about different types of VLAN tagging like External Switch Tagging(EST), Virtual Switch Tagging (VST) and Virtual Guest Tagging (VGT).

VLAN type = None:

Configure VLAN type as None, If you are not using VLAN’s or In case of External switch Tagging. I have explained about External switch tagging in my one of the blog post ” VLAN Tagging : VST,EST & VGT on VMware vSphere”. For better understanding i am recollecting the concepts of VLAN tagging here.
External Switch Tagging (EST)
1  In EST, ESX host doesn’t see any vlan tags and does not handle any VLAN tagging.
2  All the tagging operation is done by physical switch and virtual switch is not aware about that.
3  Number of physical nics = no of VLANs connected to ESX
4.Port groups on the Virtual switch of ESX server need not to be configured with the VLAN number or configure VLAN ID 0 (if it is not native VLAN)
5  Count of NICS and cable connected to ESX is more as compared to VST approach.
6  The physical switch port connecting the uplink from the ESX should be configured as Access port assigned to specific VLAN.
7  virtual machine network Packet is delivered to physical switch without any tagging operation performed by the virtual switch.

Below are the examples of External Switch tagging. Each Port group is not tagged with VLAN iD.

VLAN type = VLAN

Tag your network traffic with the VLAN ID. Enter the number between 1 and 4094 for the Virtual Switch Tagging (VST) and Type VLAN number as 4095 for Virtual Guest Tagging(VGT)
 Virtual Switch Tagging (VST)

1. VST uses 802.1q VLAN trunks and tagged traffic.
2 VLAN tagging for all packets is performed by the Virtual Switch before leaving the ESX/ESXI host
3 Port groups on the Virtual switch of ESX server should be configured with VLAN ID (1-4094)
4 vSwitch responsibility is  to strip off the vlan tag and send packet to virtual machine in corresponding port group.
5 Reduces the number of Physical nics on the server by running all the VLANs over one physical nic. Better solution would be keep 2 nics for redundancy.
6.Reduces number of cables from ESX server to physical switch.
7 The physical switch port connecting the uplink from the ESX should be configured as Trunk port.
8 virtual machine network Packet is delivered to vSwitch and before it is sent to physical switch the packet is tagged with vlan id according to the port group membership of originating virtual machine.
Virtual Guest Tagging (VGT)

1. you must install 8021.Q VLAN trunking driver inside virtual machine guest operating system.
2 All the VLAN tagging is performed by the virtual machine with use of trunking driver in the guest.
3 VLAN tags are understandable only between the virtual machine and external switch when frames are passed to/from virtual switches.
4 Virtual Switch will not be involved or aware of this operation. vSwitch only forwards the packets from Virtual machine to physical switch and will not perform any operation.
5 Port group of the virtual machine should be configured with VLAN ID 4095
6 The physical switch port connecting the uplink from the ESX should be configured as Trunk port

VLAN Type = VLAN Trunking

Configure the VLAN ID within the VLAN trunk range. Multiple ranges and individual VLANs can be used by entering as comma-separated list. This option should be with Virtual Guest Tagging (VGT)

VLAN Type = Private VLAN

Associate the PortGroup traffic with a private VLAN. Private VLAN can only be created on the distributed switch. I will explain how to create PVLAN and uses cases of three different types of VLANs in my upcoming posts.
Below is comparison table for the people who want a comparison of different VLAN tagging types under single table
         
 I hope this is informative for you. Thanks for Reading!!!.

Comments

Post a Comment

Popular posts from this blog

  Issue with Aria Automation Custom form Multi Value Picker and Data Grid https://knowledge.broadcom.com/external/article?articleNumber=345960 Products VMware Aria Suite Issue/Introduction Symptoms: Getting  error " Expected Type String but was Object ", w hen trying to use Complex Types in MultiValue Picker on the Aria for Automation Custom Form. Environment VMware vRealize Automation 8.x Cause This issue has been identified where the problem appears when a single column Multi Value Picker or Data Grid is used. Resolution This is a known issue. There is a workaround.  Workaround: As a workaround, try adding one empty column in the Multivalue picker without filling the options. So we can add one more column without filling the value which will be hidden(there is a button in the designer page that will hide the column). This way the end user will receive the same view.  
Post a Comment
Read more

57 Tips Every Admin Should Know

Active Directory 1. To quickly list all the groups in your domain, with members, run this command: dsquery group -limit 0 | dsget group -members –expand 2. To find all users whose accounts are set to have a non-expiring password, run this command: dsquery * domainroot -filter “(&(objectcategory=person)(objectclass=user)(lockoutTime=*))” -limit 0 3. To list all the FSMO role holders in your forest, run this command: netdom query fsmo 4. To refresh group policy settings, run this command: gpupdate 5. To check Active Directory replication on a domain controller, run this command: repadmin /replsummary 6. To force replication from a domain controller without having to go through to Active Directory Sites and Services, run this command: repadmin /syncall 7. To see what server authenticated you (or if you logged on with cached credentials) you can run either of these commands: set l echo %logonserver% 8. To see what account you are logged on as, run this command: ...
Post a Comment
Read more
  The Guardrails of Automation VMware Cloud Foundation (VCF) 9.0 has redefined private cloud automation. With full-stack automation powered by Ansible and orchestrated through vRealize Orchestrator (vRO), and version-controlled deployments driven by GitOps and CI/CD pipelines, teams can build infrastructure faster than ever. But automation without guardrails is a recipe for risk Enter RBAC and policy enforcement. This third and final installment in our automation series focuses on how to secure and govern multi-tenant environments in VCF 9.0 with role-based access control (RBAC) and layered identity management. VCF’s IAM Foundation VCF 9.x integrates tightly with enterprise identity providers, enabling organizations to define and assign roles using existing Active Directory (AD) groups. With its persona-based access model, administrators can enforce strict boundaries across compute, storage, and networking resources: Personas : Global Admin, Tenant Admin, Contributor, Viewer Projec...
Post a Comment
Read more