VSICM6 M05 Networking

Configuring and Managing Virtual Networks Module 5

 You  Y ou Are Here 1. Course Introduction

7. Virtual Machine Management

2. Software-Defined Data Center 

8. Resource Management and

3. Creating Virtual Machines 4. vCenter Server  5. Configuring and Managing

Virtual Networks 6. Configuring and Managing

Virtual Storage

Monitoring 9. vSphere HA and vSphere Fault

Tolerance 10. Host Scalability 11. vSphere Update Manager and

Host Maintenance 12. Installing vSphere Components

 You  Y ou Are Here 1. Course Introduction

7. Virtual Machine Management

2. Software-Defined Data Center 

8. Resource Management and

3. Creating Virtual Machines 4. vCenter Server  5. Configuring and Managing

Virtual Networks 6. Configuring and Managing

Virtual Storage

Monitoring 9. vSphere HA and vSphere Fault

Tolerance 10. Host Scalability 11. vSphere Update Manager and

Host Maintenance 12. Installing vSphere Components

Importance VMware ESXi™ networking features enable: • Virtual machines to communicate with other virtual and physical machines • Management of the ESXi host • VMkernel communication on the network

Failure to properly configure ESXi networking can negatively affect virtual machine management and storage operations.

Module Lessons Lesson 1:

Introduction to vSphere Standard Switches

Lesson 2:

Configuring Standard Switch Policies

Lesson 3: 3:

Introduction to to vS vSphere Di Distributed Sw Switches

Lesson 1: Introduction to vSphere Standard Switches

Learner Objectives By the end of this lesson, you should be able to meet the following objectives: • Describe the virtual switch connection types • Describe the components of a standard switch

Types of Virtual Switch Connections  A virtual switch has specific connection types: • Virtual machine port groups • VMkernel port:  – For IP storage, VMware vSphere® High Availability, VMware vSphere® vMotion®

migration, VMware vSphere® Fault Tolerance, VMware Virtual SAN™, and VMware vSphere® Replication™  – For the ESXi management network

VMkernel Ports

Virtual Machine Port Groups

Production

TestDev

DMZ

Virtual Switch

Uplink Ports

vSphere Management vMotion

Virtual Switch Connection Examples More than one network can coexist on the same virtual switch. Or networks can exist on separate virtual switches. Management

vSphere vMotion

Production

TestDev

iSCSI

Virtual Switch

Management vSphere vMotion

Production

TestDev

Virtual Switch

Virtual Switch

Virtual Switch

Virtual Switch

iSCSI

Virtual Switch

Types of Virtual Switches  A virtual network supports these types of virtual switches: • Standard switches:  – Virtual switch configuration for a single host

• Distributed switches:  – Virtual switches that provide a consistent network configuration for virtual machines

as they migrate across multiple hosts

Standard Switch Components  A standard switch provides connections for virtual machines to communicate with one another, whether they are on the same host or a different host. VM 1 VNIC

VM 2 VNIC

VMkernel

Test VLAN 101 Production VLAN 102 IP Storage VLAN 103 Management VLAN 104

VM 3 VNIC VNIC

IP storage

Management Network

Viewing the Standard Switch Configuration You can view a host’s standard switch configuration by clicking Networking on the Manage tab.

Display port group properties. Delete the port group. Display Cisco Discovery Protocol information.

About VLANs ESXi supports 802.1Q VLAN tagging.

VM

Virtual switch tagging is one of the tagging policies supported:

VM

• Packets from a virtual machine are

tagged as they exit the virtual switch. • Packets are untagged as they return to

the virtual machine.

VMkernel

VLAN 105

VLAN 106

Virtual Switch

• Effect on performance is minimal.

ESXi provides VLAN support by giving a port group a VLAN ID.

Physical NIC Physical Switch Trunk Port

Network Adapter Properties  A physical adapter can become a bottleneck for network traffic if the adapter speed does not match application requirements.

Review of Learner Objectives You should be able to meet the following objectives: • Describe the virtual switch connection types • Describe the components of a standard switch

Lesson 2: Configuring Standard Switch Policies

Learner Objectives By the end of this lesson, you should be able to meet the following objectives: • Describe the security of a standard switch port group • Describe the traffic shaping of a standard switch port group • Describe the NIC teaming and failover of a standard switch port group

Network Switch and Port Policies Policies set at the standard switch level apply to all of the port groups on the standard switch. The exceptions are the configuration options that are overridden at the standard port group.

 Available network policies: • Security • Traffic shaping • NIC teaming and failover 

Policies are defined at these levels: • Standard switch level:  – Default policies for all the ports on the standard switch.

• Port group level:  – Effective policies: Policies defined at this level override the default policies set at the

standard switch level.

Configuring Security Policy  Administrators can define security policies at both the standard switch level and the port group level: • Promiscuous mode: Allows a virtual switch or port group to present all traffic

regardless of the destination. • MAC address changes: Accept or reject inbound traffic when the MAC

address has been altered by the guest. • Forge transmits: Accept or reject outbound traffic when the MAC address has

been altered by the guest.

Traffic-Shaping Policy Network traffic shaping is a mechanism for limiting a virtual machine’s consumption of available network bandwidth.  Average rate, peak rate, and burst size are configurable.

   h    t    d    i   w    d   n   a    B    d   n   u   o    b    t   u    O

Peak Bandwidth Average

Time

Burst Size = Bandwidth x Time

Configuring Traffic Shaping  A traffic-shaping policy is defined by average bandwidth, peak bandwidth, and burst size. You can establish a traffic-shaping policy for each port group and each distributed port or distributed port group: • Traffic shaping is disabled by default. • Parameters apply to each virtual NIC in the standard switch. • On a standard switch, traffic shaping controls only outbound traffic.

NIC Teaming and Failover Policy  Administrators can edit the NIC teaming and failover policy by configuring specific options.

Load-Balancing Method: Originating Virtual Port ID The diagram shows routing based on the originating port ID, called virtual port ID load balancing.

Virtual Switch Physical Switch

Virtual NICs

Physical NICs

Load-Balancing Method: Source MAC Hash The diagram shows routing based on source MAC hash. Internet

Virtual Switch

Virtual NICs

Physical Switch

Physical NICs

Load-Balancing Method: Source and Destination IP Hash The diagram shows routing based on IP hash.

Internet

Virtual Switch

Virtual NICs

Physical NICs

Physical Switch

Detecting and Handling Network Failure The VMkernel can use link status or beaconing or both to detect a network failure. Network failure is detected by the VMkernel, which monitors the link state and performs beacon probing. VMkernel notifies physical switches of changes in the physical location of a MAC address. Failover is implemented by the VMkernel based on configurable parameters: • Failback: How the physical adapter is returned to active duty after recovering

from failure. • Load-balancing option: Use explicit failover order. Always use the vmnic uplink

at the top of the active adapter list.

Lab 7: Using Standard Switches Create a standard switch and a port group 1. View the Standard Switch Configuration 2. Create a Standard Switch with a Virtual Machine Port Group 3.  Attach Your Virtual Machine to the New Virtual Machine Port Group

Review of Learner Objectives You should be able to meet the following objectives: • Describe the security of a standard switch port group • Describe the traffic shaping of a standard switch port group • Describe the NIC teaming and failover of a standard switch port group

Lesson 3: Introduction to vSphere Distributed Switches

Learner Objectives By the end of this lesson, you should be able to meet the following objectives: • List the benefits of using vSphere distributed switches • Describe the distributed switch architecture • Create a distributed switch • Manage the distributed switch • Describe the properties of a distributed switch

About vSphere Distributed Switches  A vSphere distributed switch greatly extends vSphere networking features and centralizes vSphere management. • VMware vCenter Server™ owns the configuration of the distributed switch. The

configuration is consistent across all the hosts that use it. •  A distributed switch enhances the use of physical Ethernet NICs with a speed

of 10 Gbps or faster.

The behavior of distributed switches is consistent with standard switches: • You can configure virtual machine port groups and VMkernel ports.

Benefits of Distributed Switches Benefits of distributed switches over standard switches: • Simplify data center administration • Provide support for advanced features, such as private VLANs, NetFlow, and

port mirroring • Enable networking statistics and policies to migrate with virtual machines

during a migration with VMware vSphere® vMotion® • Provide for customization and third-party development

Standard Switch and Distributed Switch Feature Comparison Feature Layer 2 switch VLAN segmentation IPv6 support 802.1Q tagging NIC teaming Outbound traffic shaping Inbound traffic shaping VM network port block Private VLANs Load-based teaming Data center-level management vSphere vMotion migration over a network Per-port policy settings Port state monitoring NetFlow Port mirroring

Standard Switch

Distributed Switch

Distributed Switch Architecture Management Port

Management Port vSphere vMotion Port

vSphere vMotion Port Distributed Ports and Port Groups

vCenter Server 

Distributed Switch (Control Plane)

Uplink Port Groups

Hidden Virtual Switches (I/O Plane)

Virtual Physical

Physical NICs (Uplinks)

Host 1

Host 2

Distributed Switch Example You create a distributed switch named VDS01. You create a port group named Production, which will be used for virtual machine networking. You assign uplinks vmnic1 on host ESXi01 and vmnic1 on host ESXi02 to the distributed switch.

Distributed Switch VDS01

Production

Uplink Port Group

Virtual Physical

Uplinks vmnic0 vmnic1 vmnic2 ESXi01

vmnic0 vmnic1 vmnic2 ESXi02

Viewing a Distributed Switch You can view a host’s distributed switch configuration by clicking the Manage tab and clicking the Networking link.

View distributed switch settings.

Distributed switch settings.

Creating a Distributed Switch You can create a distributed switch on a data center to handle the networking configuration of multiple hosts at the same time from a central place.

Editing General and Advanced Distributed Switch Properties General settings for a distributed switch include the switch name and the number of uplinks.

Basic multicast filtering mode forwards multicast traffic for virtual machines according to the destination multicast group MAC address.

Migrating Network Adapters to a Distributed Switch For hosts associated with a distributed switch, you can migrate network adapters from a standard switch to the distributed switch.

Migrate physical or virtual network adapters to this distributed switch.

Assigning a Physical NIC of a Host to a Distributed Switch You can assign physical NICs of a host that is associated with a distributed switch to an uplink port on the host proxy switch.

Manage the physical network adapters connected to the selected switch.

Connecting Virtual Machines to a Distributed Switch You connect virtual machines to distributed switches by connecting their associated virtual network adapters to distributed port groups.

For a single virtual machine, modify the network adapter configuration of the virtual machine.

For a group of virtual machines, migrate virtual machines from a virtual network to a distributed switch.

Editing Distributed Port Group General Properties You can edit general distributed port group settings, such as the distributed port group name, the port settings, and the network resource pool.

Editing Distributed Port Group Advanced Properties From the advanced settings of a distributed port group, you can configure the per-port overriding of the policies that are set at the port group level.

About the VMkernel Networking Level The VMkernel networking layer provides connectivity to hosts and handles the standard system traffic of VMware vSphere® vMotion®, IP storage, VMware vSphere® Fault Tolerance, VMware Virtual SAN™, and others. You can also create VMkernel adapters on the source and target VMware vSphere® Replication™ hosts to isolate the replication data traffic. TCP/IP stacks at the VMkernel level: • Default TCP/IP stack • vMotion TCP/IP stack • Provisioning TCP/IP stack • Custom TCP/IP stacks

Creating a VMkernel Adapter on a Host Associated with a Distributed Switch You create a VMkernel adapter on a host that is associated with a distributed switch to provide network connectivity to the host and to handle the traffic for vSphere vMotion, IP storage, vSphere Fault Tolerance logging, Virtual SAN, and others.

Click Add host networking to start the Add Networking wizard.

Click VMkernel Network Adapter .

Virtual Machine Communication Problem Analysis (1) Under certain conditions, the virtual machines on the same distributed port group but on different hosts cannot communicate with one another. Problems: • Virtual machines residing on different hosts and on the same port group are

unable to communicate. • Pings from one virtual machine to another fail. You cannot migrate the virtual

machines between the hosts by using vSphere vMotion.

Causes: • No physical NICs on some of the hosts are assigned to active or standby

uplinks in the teaming. The failover order of the distributed port group is not correctly configured. • The physical NICs on the hosts assigned to the active or standby uplinks

reside on different VLANs on the physical switch. The physical NICs on different VLANs cannot see one another and thus cannot communicate with one another.

Virtual Machine Communication Problem Analysis (2) Solutions: • In the topology of the distributed switch, check which host does not have

physical NICs assigned to an active or standby uplink on the distributed port group. Assign at least one physical NIC on that host to an active uplink on the port group. • In the topology of the distributed switch, check the VLAN IDs of the physical

NICs assigned to the active uplinks on the distributed port group. On all hosts, assign physical NICs from the same VLAN to an active uplink on the distributed port group.

Physical Network Considerations Your virtual networking environment relies on the physical network infrastructure. As a vSphere administrator, you should discuss your vSphere networking needs with your network administration team.

The following issues are topics for discussion: • Number of physical switches • Network bandwidth required • Physical switch configuration support for 802.3ad, for NIC teaming • Physical switch configuration support for 802.1Q, for VLAN tagging • Physical switch configuration support for Link Aggregation Control Protocol

(LACP) • Network port security • Link Layer Discovery Protocol (LLDP) and Cisco Discovery Protocol (CDP)

share the following operation modes:  – Listen, broadcast, listen and broadcast, and disabled

Lab 8: Using vSphere Distributed Switches Create and configure a distributed switch 1. Create a Distributed Switch 2.  Add the ESXi Hosts to the New Distributed Switch 3. Examine Your Distributed Switch Configuration 4. Migrate the Virtual Machines to a Distributed Switch Port Group 5. Prepare for the Next Lab

Review of Learner Objectives You should be able to meet the following objectives: • List the benefits of using vSphere distributed switches • Describe the distributed switch architecture • Create a distributed switch • Manage the distributed switch • Describe the properties of a distributed switch