We've a Windows Server 2008 host on VMware ESXi 4 and want to isolate it from the rest of the network. That is, I want no traffic from the Windows Server 2008 to be allowed on the normal network. I was thinking a VLAN would do this if set up properly.
Involved in this is granting access over a VPN from an Endian (Linux) firewall to this host.
Also, between the firewall and the VMware host are two Cisco (LinkSys rebranded!) SG 200-26 switches. The VMware host is using dual network cards in a failover configuration.
As I see it, there's several problems that crop up:
- How is the VLAN recognized by VMware? How do I set up VMware?
- How does the Windows Server host recognize the VLAN?
- What switch configuration is necessary?
- How is the VLAN isolated properly? (I was thinking that the proper firewall rules would do this.)
- How do I set up the firewall without affecting other traffic?
- How do I set up the Windows Server without affecting other guest traffic?
My initial investigation suggests that Endian supports VLANs and VLAN interfaces, though I've not yet tried it out. The Cisco switch supports VLANs but I don't know how it would work with multiple VLANs on the same port. VMware ESXi appears to support VLANs but only at the host level; I don't see where a single guest can be put on a separate VLAN.
UPDATE: From my reading, it sounds like I need to have tagged VLAN frames from the Endian firewall to the connected switch, then to the other switch, and on both NICs used by VMware. I'm not sure all of these will support tagged VLAN frames. If I've tagged VLAN frames, then they should be able to travel over the same wires between the VMware ESXi host and the Endian firewall. The trick, then, is getting the Windows Server 2008 guest onto one VLAN only.
I found another question with an answer that explains VLANs beautifully, as well as another answer that explains when to use VLANs.
I also found some discussion that suggests its not possible for Endian to support tagged and untagged VLAN frames on the same port at the same time. This configuration just sounds like it is asking for trouble.
I suspect that all of my traffic is currently untagged, but I don't know for sure.