Using VLAN Tagging with VMware vSphere [Video]
The use of VLANs are rather common in most data center environments as a method to control traffic and partition off pieces of the network. Historically, ports on an access switch or fabric extender, such as the 3750 or Nexus 2K respectively, are connected to the physical server infrastructure NICs as access ports. Most servers never knew (nor cared) what VLAN they were on – the physical switch stripped off the 802.1 VLAN tags before sending any traffic to the server, and also added the tags when traffic was received from the server. Additionally, the typical server doesn’t need access to more than one VLAN. It was also a good security practice to isolate a server to the VLAN necessary to fulfill its role (app, web, database, etc.)
The introduction of server virtualization really shook up this practice and started the trend of requesting trunk ports (sometimes called tagged ports) to the server’s NICs. While I’m not saying that the idea of trunking to a server is completely foreign, I will admit that I didn’t see it much as a network admin.
A Simple Tutorial
As an extension to my porcupine discussion in my “It’s A Trunk! Using Portgroup VLANs with vSphere” post, I’ve created a brief demonstration of the VLAN configuration in my lab environment. I’m using VLAN tags for my Fault Tolerance (252) and vMotion (253) port groups, and a native VLAN (1) for everything else.
So it looks like there are 3 modes or ways in which you can tag packets in order for the VMs to pass 802.1q packets. I stumbled upon http://www.vmware.com/pdf/vi3_security_architecture_wp.pdf which lists the 3 different ways in which it can be done.
One of the biggest fears I have with servers being able to sit on the other end of trunk ports is VMs being able to spoof 802.1q tags, and hop VLANs that they shouldn’t be on.
Here is an excerpt from that whitepaper:
Virtual switch tagging (VST mode) — In this mode, you
provision one port group on a virtual switch for each VLAN,
then attach the virtual machine’s virtual adapter to the port
group instead of the virtual switch directly. The virtual switch
port group tags all outbound frames and removes tags for all
inbound frames. It also ensures that frames on one VLAN do
not leak into a different VLAN.
I wonder if this means that the other two modes, EST and VGT shouldn’t be used.