Planning and Configuring vSphere Networking

Date: Oct 11, 2012

Bill Ferguson covers configuring vSphere standard switches in this excerpt from The Official VCP5 Certification Guide.

In our discussion on vSphere networking, I will address many topics such as vSphere standard switches (vSS), vSphere distributed switches (vDS), port groups, and the properties for all of these. It’s easy to get overwhelmed in all the terminology, especially when most of the components are not something that you can see or hold in your hand. To keep from becoming overwhelmed with the technology, I want you to focus on two primary questions. The first question is, “What type of connections can I create and what do they do?” The second is, “Where does the ‘virtual world’ meet the ‘physical world,’ and how is that point of reference defined?” If you just focus on these two questions, I believe that the rest of the picture will come to your mind.

That said, this section covers configuring vSSs, configuring vDSs, and configuring vSS and vDS policies. In each section, I will explain why these should be configured, and then I will discuss how you can configure them. In addition, I will walk you through the steps to configure each of these settings.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz allows you to assess whether you should read this entire chapter or simply jump to the “Exam Preparation Tasks” section for review. If you are in doubt, read the entire chapter. Table 2-1 outlines the major headings in this chapter and the corresponding “Do I Know This Already?” quiz questions. You can find the answers in Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes and Chapter Review Questions.”

Table 2-1. “Do I Know This Already?” Section-to-Question Mapping

Foundations Topics Section	Questions Covered in This Section
Configuring vSphere Standard Switches	1–3
Configuring vSphere Distributed Switches	4–6
Configuring vSS and vDS Policies	7–10

Which of following will result if you choose Add Networking on the Networking link of your ESXi host?
1. You can add a new VMkernel port to an existing switch.
2. You can add a new VM port to an existing switch.
3. You will be creating a new vSS.
4. You can add a new vmnic to an existing switch.
Which of the following is not a common use of a VMkernel port?
1. IP storage
2. Storage vMotion
3. vMotion
4. Management
Which of the following is true about switch and port group policies on a vSS?
1. Switch settings override port group settings.
2. You cannot configure port group settings different from switch settings.
3. There are no switch settings on a vSS.
4. Port group settings override switch settings for the VMs on the port group.
What is the maximum number of hosts that can be connected to a single vDS?
1. 32
2. 1000
3. 350
4. 100
Which of the following is the minimum license requirement to create a vDS?
1. Enterprise Plus
2. Enterprise
3. Advanced
4. Essentials
Which view should you be in to add a host to an existing vDS?
1. Hosts and Clusters
2. Networking
3. vSphere
4. VMs and Templates
Which of the following is not a common policy for vSS switch and port groups?
1. Traffic shaping
2. NIC teaming
3. Permissions
4. Security
Which of the following is true about vDS policies?
1. Policies set at the port group level override those are the port level.
2. Policies cannot be set at the port level.
3. Policies are always set at the port level.
4. Policies set at the port level override policies set at the port group level.
Which of the following is not a load-balancing option in vSphere?
1. Route based on the originating virtual port ID
2. Beacon probing
3. Route based on source MAC hash
4. Route based on IP hash
Which of the following is not a type of private VLAN?
1. Isolated
2. Trunking
3. Promiscuous
4. Community

Foundation Topics

Configuring vSphere Standard Switches

A vSphere standard switch (vSS) is a logical construct within one ESXi host that connects virtual machines (VMs) to other VMs on the same switch. In addition, using connections called uplinks, it can connect VMs to other virtual or physical machines on other ESX/ESXi hosts, other vSSs in the same host, or anywhere in the physical environment. In this section I will discuss vSS capabilities and how to create and delete them. In addition, I will cover adding, configuring, and removing vmnics; configuring VMkernel ports and services; adding and removing port groups; and determining use cases for a vSS.

Identifying vSphere Standard Switch (vSS) Capabilities

A vSS models a simple Layer 2 switch that provides networking for the VMs connected to it. It can direct traffic between VMs on the switch as well as link them to external networks. Figure 2-1 shows a diagram of a vSS. I’m sorry that I don’t have a photograph, but remember that they only exist in a software state. Note that there are actually two VMkernel ports on the vSS in this ESXi host. One is for management (management network), and the other is for other purposes that I will describe later in this section).

Figure 2-1. A Diagram of a vSphere Standard Switch

As I mentioned earlier, a vSS models an Ethernet Layer 2 switch on which a virtual machine network interface card (vNIC) can connect to its port and thereby be connected to other machines on the same switch; or off of the switch by way of an uplink to the physical world. Each uplink adapter also uses a port on a vSS. As I said before, one of the main questions to ask yourself is, “What type of connections can I create?” So, now I will discuss connections on vSSs.

You can create two main types of connections that you can create on vSSs; VMkernel ports and VM ports. The difference between these two types of connections is dramatic. It is important to understand how each type of connection is used.

VMkernel ports are used to connect the VMkernel to services that it controls. There is only one VMkernel on an ESXi host (also called the hypervisor), but there can be many VMkernel ports. In fact, it is best practice to use a separate VMkernel port for each type of VMkernel service. There are four main types of VMkernel services that require the use of a VMkernel port, as follows:

IP storage: iSCSI or networked-attached storage (NAS). (Chapter 3, “Planning and Configuring vSphere Storage,” covers these in more detail.)
vMotion: A VMkernel port is required and a separate network is highly recommended. (Chapter 5, “Establishing and Maintaining Service Levels,” covers vMotion in more detail.)
Management: Because ESXi does not have a service console, or service console ports, management is performed through a specially configured VMkernel port.
Fault-tolerant logging: A feature in vSphere that allows a high degree of hardware fault tolerance for the VMs involved, but also requires a separate and distinct VMkernel port. (Chapter 5 covers fault-tolerant logging in greater detail.)

VM port groups, however, are only used to connect VMs to the virtual switches. They are primarily a Layer 2 connection that does not require any configuration other than a label to identify a port group, such as Production. A VLAN can be configured for a port group, but that is optional as well. You can have multiple VM port groups on a single switch and use them to establish different polices, such as security, traffic shaping, and NIC teaming for various types of VMs. You will learn more about these in the section “Configuring vSS and vDS Policies,” later in this chapter.

Creating / Deleting a vSphere Standard Switch

The first question that you might want to ask yourself is, “Do I really need a new vSS?” The answer to this question might not be as straightforward as you think. You do not necessarily need a new vSS for every new port or group of ports, because you can also just add components to the vSS that you already have. In fact, you might make better use of your resources by adding to a vSS that you already have, instead of creating a new one. Later in this chapter, in the section “Adding/Editing/Removing Port Groups on a vNetwork Standard Switch,” I will discuss the power of using port groups and policies. In this section, I will discuss how to create a new vSS and how to delete a vSS that you no longer require.

If you decide to create a new vSS, you should select Add Networking from the Networking link and follow the wizard from there. The main thing to remember is that when you select Add Networking you are always creating a new vSS, not just adding networking components to an existing vSS. For example, if you want to create a new vSS for a VMkernel port used for vMotion, follow the steps outlined in Activity 2-1.

Activity 2-1. Creating a New vSphere Standard Switch

Log on to your vSphere Client.
Select Home and then Hosts and Clusters.
Select the ESX host on which you want to create the new vSS and then open the Configuration tab.
Click the Networking link under Hardware.
In the upper-right corner, click the Add Networking link, as shown in Figure 2-2.

Figure 2-2. The Add Networking Link on a vSS
On the Connection Type of the Add Network Wizard, select VMkernel and click Next, as shown in Figure 2-3.

Figure 2-3. Selecting the VMkernel Connection Type
In VMkernel - Network Access, select the vmnic that you will use for the VMkernel port and click Next, as shown in Figure 2-4.

Figure 2-4. Selecting a vmnic
In VMkernel - Connection Settings, enter the Network Label and optionally the VLAN, as shown in Figure 2-5. (The Network Label should generally indicate the purpose of the switch or port group. In this case, you might use vMotion, and then enable it for vMotion.) Click Next.

Figure 2-5. Selecting the VMkernel Connection Type
In VMkernel - IP Connection Settings, enter the IP address, subnet mask, and VMkernel Default Gateway to be used for the switch, as shown in Figure 2-6, and then click Next. (I will discuss these settings in greater detail later in this chapter in the section “Creating/Configuring/Removing Virtual Adapters.”)

Figure 2-6. Entering IP Information
In Ready to Complete, review your configuration settings and click Finish.

Deleting a vSphere Standard Switch

There might come a time when you no longer require a vSS that you have in your inventory. This might be because you have chosen to upgrade to a vSphere distributed switch (vDS) or because you are changing the networking on each of the hosts to provide consistency across the hosts, which is a very good idea. In this case, follow the steps outlined in Activity 2-2.

Activity 2-2. Deleting a vSphere Standard Switch

Log on to your vSphere Client.
Select Home and then Hosts and Clusters.
Select the ESX host on which you want to delete the vSS, and then open the Configuration tab.
Click the Networking link under Hardware.
Click the Remove link next to the switch that you want to remove and then confirm your selection by clicking Yes, as shown in Figure 2-7. (There is a Remove link for each switch, so take care to select the right one.)

Figure 2-7. Deleting a vSphere Standard Switch

Adding / Configuring / Removing vmnics on a vSphere Standard Switch

As I mentioned earlier, you might not want to create a new switch every time you need a new connection. In fact, you will make better use of your resources by adding to a current switch and thereby leveraging NIC teaming. In this section, I will discuss how to add new vmnics to a switch that you already have. In addition, I will discuss configuring vmnics and VMkernel ports on switches, including changing the IP address, VLAN, and so on. Finally, you will learn how to remove a vmnic from a switch if you no longer require it.

To add a new vmnic to an existing switch, you should not click Add Networking! As you might remember, clicking Add Networking takes you into a wizard that adds a new switch, not just into the networking properties of a switch you already have. So if you don’t click Add Networking, what do you do? Well, if you think about it, what you really want to do is edit the configuration of a switch. For example, if you want to add a new vmnic to an existing switch to be used for vMotion, follow the steps outlined in Activity 2-3.

Activity 2-3. Adding a vmnic to a switch

Log on to your vSphere Client.
Select Home and then Hosts and Clusters.
Select the ESX host on which you want to edit the vSS.
Click the Networking link under Hardware.
Click the Properties link next to the switch that you want to edit, as shown in Figure 2-8.

Figure 2-8. The Properties Link on a vSS
On the Properties dialog box for the switch, click Add, as shown in Figure 2-9.

Figure 2-9. Adding a vmnic to a Switch
On the Connection Type of the Add Network Wizard, select VMkernel and click Next, as shown in Figure 2-10.

Figure 2-10. Selecting the VMkernel Connection Type
From VMkernel > Connection Settings, enter the Network Label and optionally the VLAN, as shown in Figure 2-11. (The Network Label should generally indicate the purpose of the switch or port group. In this case, you might use “vMotion” and enable it for vMotion.) Click Next.

Figure 2-11. Entering a Network Label
From VMkernel > IP Connection Settings, enter the IP address, subnet mask, and VMkernel default gateway to be used for the switch, as shown in Figure 2-12, and then click Next.

Figure 2-12. Entering IP Information
In Ready to Complete, review your configuration settings and click Finish.

You will sometimes need to change the settings of a vmnic that you have already configured for a vSS. For example, you might want to edit the physical configuration such as the speed and duplex settings to match those of a physical switch to which your ESXi host is connected. To edit the physical configuration of the vmnic, follow the steps outlined in Activity 2-4.

Activity 2-4. Configuring the physical aspects of a vmnic

Log on to your vSphere Client.
Select Home and then Hosts and Clusters.
Select the ESXi host on which you want to edit the vSS.
Click the Networking link under Hardware.
Click the Properties link next to the switch that you want to edit, as shown in Figure 2-13.

Figure 2-13. The Properties Link
On the Properties dialog box for the switch, open the Network Adapters tab and select the vmnic that you want to configure, as shown in Figure 2-14.

Figure 2-14. The Network Adapters Tab
Click Edit, and then select the speed and duplex that matches the physical switch to which the ESXi host is connected, as shown in Figure 2-15, and click OK.

Figure 2-15. Configuring Physical Aspects of a vmnic
Click Close to exit the Properties dialog box.

There might come a time when you need to remove a vmnic from a switch. This might happen if you are changing network settings to provide consistency or if you intend to use the vmnic on a new switch. If you need to remove a vmnic from a vSS, follow the steps outlined in Activity 2-5.

Activity 2-5. Removing a vmnic from a vSphere Standard Switch

Log on to your vSphere Client.
Select Home and then Hosts and Clusters.
Select the ESX host on which you want to remove the vmnic.
Click the Networking link under Hardware.
Click the Properties link next to the switch that contains the vmnic that you want to remove.
On the Properties dialog box for the switch, open the Network Adapters tab, select the vmnic that you want to remove, select Remove, and confirm your selection by clicking Yes, as shown in Figure 2-16.

Figure 2-16. Removing a vmnic

Configuring VMkernel Ports for Network Services

As I mentioned earlier, there are only four reasons that you would create a VMkernel port: management, IP storage, fault-tolerant logging, and vMotion. I will discuss each of these in much greater detail in the chapters that follow, but for now you should understand that they all share the same configuration requirements for network services (namely, an IP address and subnet mask). In addition, you should know that all VMkernel ports will share the same default gateway. You might also want to configure a VLAN, and you will want to enable the port with the services for which it was created (such as vMotion, management, or fault-tolerant logging).

To configure a VMkernel port with network service configuration, you should configure the IP settings of the port group to which is it assigned. I will discuss port group configuration in much greater detail later in this chapter. For now, if you want to configure the IP settings of a VMkernel port, follow the steps outlined in Activity 2-6.

Activity 2-6. Configuring a VMkernel port for Network Services

Log on to your vSphere Client.
Select Home and then Hosts and Clusters.
Select the ESX host on which you want to configure the VMkernel port.
Click the Networking link under Hardware.
Click the Properties link next to the switch that contains the port, as shown in Figure 2-17.

Figure 2-17. Properties Link for vSS
On the Properties dialog box for the switch, on the Ports tab, select the port group to which the VMkernel port is assigned and click Edit, as shown in Figure 2-18.

Figure 2-18. Editing a Port Group
Open the IP Settings tab, and enter the IP information for your network, as shown in Figure 2-19, and click OK.

Figure 2-19. Editing IP Information
If you want to configure a VLAN for the port group, open the General tab and enter the VLAN information directly under the Network Label.
On the General tab, you can also enable the vmnic for the specific services for which it was created, such as vMotion, FT Logging, or Management. If the port was only created for IP storage, you do not need to check any of the Enabled boxes.
Finally, if appropriate you can change the maximum transmission unit (MTU) for the vmnic (for example, if you are using jumbo frames for iSCSI storage). (Chapter 3 covers storage options in greater detail.) Click OK to close the Properties dialog box and save your settings.

Adding / Editing / Removing Port Groups on a vSphere Standard Switch

The main reason to use port groups is to get more than one function out of each switch. This is possible because port group configuration supersedes switch configuration. Because of this, you can have policies for security, traffic shaping, NIC teaming, and so on that apply to the switch but also have a separate policy for each that applies to any port group on which the settings differ from those of the switch. This tremendously improves your flexibility and gives you options such as those security options discussed in Chapter 1, “Planning, Installing, Configuring, and Upgrading vCenter Server and VMware ESXi.” In this section, I will discuss adding, editing, and removing port groups on a vSS.

Suppose you decide to add a new group of VMs on which you will test software and monitor performance. Furthermore, suppose you decide that you will not create a new switch but that you will instead add the VMs to a switch that you already have in your inventory. However, suppose the VMs that are already on the switch are not for testing and development but are actually in production. Chances are good that you do not want to “mix them in” with the new testing VMs, but how can you keep them separate without creating a new vSS?

Well, if you create a new port group and assign a different vmnic to it, you can manage the new testing VMs completely separate from the production VMs, even though they are both on the same vSS. In this case, you might want to label your existing port group Production and label your new port group Test-Dev. It does not matter what label you use, but it is a best practice to relate it to the function of the port group, which is generally related to the function of the VMs that will be on it. Also, you should strive for consistency across all of your ESXi hosts in a small organization or at least across all of the hosts in the same cluster in a medium-sized or large organization. (Chapter 5 covers clusters in greater detail.)

So, what was the purpose of all of that labeling? Well, after you have done that, you will have a set of five tabs on the Properties link of the port group that only apply to that port group. You can make important changes to port group policies such as security, traffic shaping, and NIC teaming that will override any settings on the vSS properties tabs. I will discuss the details of these port group policies later in this chapter in “Configuring vSS and vDS Policies.” For now, if you want to add a new VM port group to an existing vSS, follow the steps outlined in Activity 2-7.

Activity 2-7. Adding a Port Group to a vSphere Standard Switch

Log on to your vSphere Client.
Select Home and then Hosts and Clusters.
Select the ESX host on which you want to add the port group.
Click the Networking link under Hardware.
Click the Properties link next to the switch on which you want to add the port group.
On the Ports tab, click Add, and then choose Virtual Machine, as shown in Figure 2-20. Click Next.

Figure 2-20. Adding a Virtual Machine Port Group
From Virtual Machines > Connection Settings, enter the label that you want to use (such as Test-Dev) and the VLAN if you are using a VLAN, as shown in Figure 2-21. Click Next.

Figure 2-21. Entering and Network Label
On Ready to Complete, review your configuration settings and click Finish.

Your new port group should now appear in the Properties dialog box under Configuration. This new port group is now completely configurable and will have its own set of five tabs for you to configure. Just click the port group under Configuration and select Edit, as shown in Figure 2-22. I will discuss the configuration of port group policies in detail later in this chapter in the section “Configuring vSS and vDS Policies.”

Figure 2-22. Port Group Configuration

Finally, you might want to remove a port group that you no longer need. This might happen because you are reorganizing your network or because you are no longer using the VMs to which the port group was associated. To remove the port group, click the port group, select Remove, and confirm your selection by clicking Yes, as shown in Figure 2-23.

Figure 2-23. Removing a Port Group

Determining Use Cases for a vSphere Standard Switch

Now that I have discussed how you would create and manage a vSS, let’s talk about why you would want one in the first place. In other words, what would cause you to use a vSS instead of a vDS? One very practical reason might be that you do not have the appropriate license to use a vDS. As I previously discussed in Chapter 1, in the section, “Installing and Configuring vCenter Server,” creating a vDS requires an Enterprise Plus license. Another reason might be that you have a small to medium-size organization and therefore the settings on a vSS are sufficient for your needs. Your organization can have many hosts and those hosts can communicate to each other using vSSs.

The main point to consider is how you can keep the networking that is inside of each ESXi host consistent with the networking that is inside the other hosts, or at least all the hosts in the same cluster. If possible, you should have the same number of vSSs in each of your hosts and the same port groups on each of them as well (at least the ones that are in the same clusters). In fact, the consistent spelling of the port group names is even important. In addition, to leverage the power of port groups, you should have as few vSSs on each host as possible while still maintaining consistency across the hosts. If you balance these two factors in your organization as much as possible, you will be on the right track.