Section 5.5. Port Groups and VLANs

5.5. Port Groups and VLANs

When you go to configure a virtual switch, you'll see in the same window the area in which you can configure a port group. So, what is a port group?

Port groups are VLANs basically. VLANs, or virtual local area networks, are defined by the IEEE 802.1Q standard.

A VLAN is a group of network devices on a LAN that is configured to communicate as if they were attached to the same LAN segment and were in the same broadcast domain. In reality, however, they can be geographically dispersed and connected to a number of different LAN segments. This is accomplished through VLAN tagging. VLAN tags, for example, can be switch port based, MAC address based, protocol based, or policy based. A VLAN tag is an extra four bytes that are inserted after the source and destination address in an Ethernet frame.

For more information on 802.1Q and VLAN tags, go to http://standards.ieee.org/getieee802/download/802.1Q-2003.pdf. Under the USER TYPE drop-down, we input Systems Administrator, clicked Accept/Begin Download, and got the download shown in Figure 5.24 See section 9 of this document for VLAN tag format information.

Figure 5-24. User Type Drop-Down Menu

In ESX Server, there exist three options for VLANs:

• External Switch Tagging (EST)

• Virtual Switch Tagging (VST)

• Virtual Guest Tagging (VGT)

Exterior Switch Tagging (EST) mode relies exclusively on the tagging of network traffic by the physical switch (see Figure 5.25). All traffic goes through one of your ESX Server's physical NICs, which is attached to a physical switch port providing VLAN tagging on outgoing traffic and strips the tag for incoming traffic. The limitation to this method, of course, is that it's switch port based so the number of VLANs your ESX Server can support is limited to the number of physical NICs you have in your ESX Server.

Figure 5-25. Exterior Switch Tagging

In Figure 5.26, there's one physical NIC dedicated to the virtual machines; thus, you could have only one VLAN. EST is supported by all versions of ESX.

Virtual Switch Tagging (VST) mode is the recommended configuration by VMware. This mode is used when you utilize port groups. You configure a port group to a virtual switch. You then assign one of your virtual machine's virtual network adapters to the port group itself. Figure 5.26 shows a basic VST configuration.

Figure 5-26. A Basic VST Configuration

Figure 5.27 depicts two Port Groups: VLAN10 and VLAN11. Both port groups are assigned to the same virtual switch, which is bound to one physical NIC on the ESX Server. The physical NIC is plugged into a physical switch port. All necessary switch trunks and support for 802.1Q must be established within your production switches.

VLAN10 and VLAN11 are the Port Group labels. You'll select from the list of Port Group labels when configuring your virtual machine. The following is a step-by-step process for creating a Port Group and assigning that Port roup to a virtual machine.

1. Open the MUI and click the Options tab (see Figure 5.27).

   Figure 5-27. Choosing Server Options

   

2. Click the Network Connections link.

3. From a virtual switch, click Add to the right of Port Groups (see Figure 5.28).

   Figure 5-28. Adding a Virtual Switch

   

4. The Create Port Group window appears with default values. The first value is the Port Group Label (see Figure 5.29).

   Figure 5-29. Creating a Port Group

   

5. This is set by default to VLAN1, but you may change the label to anything you like. This label is ESX-specific and it's what you will assign to your virtual machines.

6. By default, VLAN ID is set to 1, which in the VLAN world is known as the "native VLAN" (it could also be 100) and should not be used if at all possible. Ask your network engineer what the native VLAN is and avoid using it. Change the VLAN ID.

7. Notice the warning at the bottom of Figure 5.30 Heed it.

   Figure 5-30. A Warning about Switch Configurations

   

8. After you've made the changes to your Port Group click Create Port Group.

9. You should now be back in the Virtual Switches window. Under the virtual switch you created, you should see the Port Group you configured with the values you gave it (see Figure 5.31).

   Figure 5-31. Configuration of a Virtual Switch

   

10. The Port Group MyVLAN now displays with a VLAN ID of 20. However, there are no virtual machines configured for it yet. Close the window. You'll now configure a virtual machine to point to the Port Group.

11. Open the Properties… of a virtual machine and go to the Hardware tab (you may also select Configure Hardware from the virtual machine dropdown).

12. Either edit an existing virtual NIC or add a new one. When you're in the properties of the virtual adapter, you'll see MyVLAN (or whatever you've labeled it) in the drop-down menu for Network Connection (see Figure 5.32).

    Figure 5-32. Configuring a Virtual NIC

    

13. By selecting the Port Group Label and then clicking OK, you'll configure your virtual machine to the VLAN connection you configured earlier.

14. Close the virtual machine's properties page.

A quick recap: each port group represents one VLAN, and you can have multiple port groups per virtual switchthus, you can have multiple VLANs per virtual switch. This eliminates the restriction of one VLAN per physical NIC tied to the one physical switch port we found in the EST mode. VLANs (aka, Port Groups) are handled by ESX Server itself for your virtual machines, and the virtual switch is responsible for VLAN tagging. VST is available only in ESX Server 2.1.0 and later releases.

The final mode for using VLANs within your ESX environment is called Virtual Guest Tagging (VGT). VGT requires that you run VLAN 802.1Q drivers in the virtual machine itself. This allows you to run any VLAN you need since the configuration is within the virtual machine itself and not tied to any switch or physical NIC. However, VLAN tagging takes extra CPU cycles away from your virtual machine and you need to ensure you use a driver that supports VLAN hardware acceleration. VGT requires ESX Server version 2.1.1 or later and, of course, your guest operating system needs to support the 802.1Q drivers.

For more information on Port Groups, VLANs, and VMware recommendations, read the well-written whitepaper at www.vmware.com/pdf/esx_vlan.pdf.