Help with first major networking setup

[oglewilliam]

I will be as detailed as possible. I am hoping to get some help setting up a vSphere host so that I can remotely access it from the internet.

I have a couple of options available to me, and people that I know who work in this field are giving me conflicting advice.

I recently started working as a network administrator. My mission is to basically learn as much about advanced networking concepts as possible as quickly as possible. To that effect, my employer has given me an old server with 64GB of RAM and dual Xeons, on which I can build a VMware host.

Additionally, I am a student, so I get free licenses for pretty much everything (including vSphere, vCenter Server, Server 2012, etc).

The server is quite loud, and so having it in my living room is not really an option. My parents, as a result, have allowed me to have the server running in their basement. They have a 150Mbps connection through Bright House, and I can get into their Bright House modem to make any configuration changes I would like (they do not live very far away from me). Additionally, my father is a computer security engineer, so I am surrounded by reasonably competent people, in case I should ever run in to some snag.

My parents' ISP does not provide a static IP address with the service that they currently subscribe to, so over the long term, I will need to implement some sort of dynamic DNS system, so that I can access this remotely using only an internet hostname.

Now on to the fun stuff. I know that I should be able to have the Bright House modem forward all inbound, unsolicited traffic to a specific IP address on it's network. I assume that if I wanted to, I could statically bind the server NICs MAC address to a specific IP address (lets say that I decide on 192.168.1.119/24, although it isn't important right now).

My boss also offered me a Cisco ASA, which has several functions. To be clear, I do not fully understand everything that an ASA could do, but I do know that it could provide a VPN, and if I understand correctly, it could also do DHCP, VLANs, and a host of other networking functions.

Alternatively, I am sure there is a way to use something like PfSense as a virtual machine running inside the server to act as a VPN provider, firewall, etc.

My question is, if this was your lab, how would you design this network? If you would do something that requires components that I do not already have, I am quite sure that it would be reasonably easy to acquire the device necessary.

Since this server will live in my parents basement, and I do not live at their house, the ability to access this from the internet is a must. I would like to either be able to access the vCenter Server web console from the internet(preferred), or I would like to be able to have VPN access into the network where I would then be able to get into the local web interface.

Additionally, what are any security implications that I should consider. As I was explaining to others while talking about this, I don't want to just stick an ESXi host "bare-ass" on the internet.

Remember, I am fairly new to the more advanced networking stuff, so try not to make too many assumptions about what I should already know. I have the Network+ certification, so I can objectively say that I am not a complete idiot, but it's probably best to be cautious.

 

[mxnerd]

There are many tutorial about Cisco ASA and ESXi on youtube.

https://www.youtube.com/watch?v=PpKMeukhPYg&list=PL84F4575D9FB028ED

You don't need pfsense.

Cisco ASA is a router/firewall, which also support DDNS.

http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/811-cisco-router-ddns.html

 

[chemwiz]

I have an account with DYNDNS, I can let you have one free if you want. PM me or email me with the one you want and I'll set it up for you. I get 30 accounts with my package and I'm only using 10 right now for different businesses I work for.

 

[oglewilliam]

There are many tutorial about Cisco ASA and ESXi on youtube.

https://www.youtube.com/watch?v=PpKMeukhPYg&list=PL84F4575D9FB028ED

You don't need pfsense.

Cisco ASA is a router/firewall, which also support DDNS.

http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/811-cisco-router-ddns.html

Ok, I would appreciate it greatly if you could tell me whether I'm on the right track or not.

Internet comes in through Bright House modem, where I have a DMZ set to point to the Cisco ASA. The Cisco ASA will have an IP address that is assigned by the Bright House modem. To keep the internal IP address of the ASA from changing, I could just allocate the IP address to that MAC address, so that the Bright House modem always assigns the same IP address to the ASA.

In the Cisco ASA, I would set up the WAN interface to get DHCP from the Bright House modem, and then configure another network interface on the ASA to be the "internal" network. I could then plug my vSphere host into that port on the ASA, and then it should have internet access.

Once I have all of that configured, I would just have to install vCenter Server on a virtual machine running within the host, and figure out how to route incoming traffic on a certain port to that specific machine. I assume that the ASA will block any unsolicited traffic coming in.

Am I warm at all?

 

[oglewilliam]

I have an account with DYNDNS, I can let you have one free if you want. PM me or email me with the one you want and I'll set it up for you. I get 30 accounts with my package and I'm only using 10 right now for different businesses I work for.

Sure, I would be interested in this.

 

[mxnerd]

You should make ESXi works before thinking about Cisco ASA & internet.

vSphere Web Client requires only port 443, I think.

But vSphere console requires 443, 902

===

I guess you have a gateway (modem+router combo), not just a modem, since you can do port forwarding.

In theory DMZ should work like what you said, but I never use DMZ before, and I don't like the idea at all.

 

[brshoemak]

Not sure what kind of server you have, but assuming it's a Dell or HP I would highly recommend a OOB card like a DRAC or iLO, respectively.

You're dealing with hypervisors so even though you can manage most things through the GUI you should definitely have access to the pre-boot environment.

 

[oglewilliam]

You should make ESXi works before thinking about Cisco ASA & internet.

vSphere Web Client requires only port 443, I think.

But vSphere console requires 443, 902

===

I guess you have a gateway (modem+router combo), not just a modem, since you can do port forwarding.

In theory DMZ should work like what you said, but I never use DMZ before, and I don't like the idea at all.

So instead what I should do is just have the ESXi host sitting inside their network, and forward port 443 to the vCenter server? I wonder if I could just set up Dynamic DNS on the Bright House modem.

 

[oglewilliam]

Not sure what kind of server you have, but assuming it's a Dell or HP I would highly recommend a OOB card like a DRAC or iLO, respectively.

You're dealing with hypervisors so even though you can manage most things through the GUI you should definitely have access to the pre-boot environment.

Can you elaborate on this? It is an HP Proliant DL380 G5, and it does have a port labeled iLO, although I do not yet know what that is for.

I agree that it would be amazing to have access to the host remotely, even if vSphere won't boot. How does it work?

 

[mxnerd]

So instead what I should do is just have the ESXi host sitting inside their network, and forward port 443 to the vCenter server? I wonder if I could just set up Dynamic DNS on the Bright House modem.

DDNS is only for giving a name for you so you don't need to remember the dynamic IP address you get from ISP, nothing else.

So you reach your modem router IP with https://ddnsname instead https://dynamicIP

===

443 is for the case if you want to access ESXi from internet buy using vSphere Web Client.

IIRC, vcenter is a Windows Server installation, all you need is to open port 3389 Windows remote desktop (RDP) if you want to access it from internet.

======

You should start with sitting in front of your server in your parents' basement. Setup ESXi & vCenter, make sure it works before getting online.

======

Google & Youtube are your friends.

https://www.youtube.com/results?search_query=HP+iLo

 

[brshoemak]

Can you elaborate on this? It is an HP Proliant DL380 G5, and it does have a port labeled iLO, although I do not yet know what that is for.

I agree that it would be amazing to have access to the host remotely, even if vSphere won't boot. How does it work?

Most of my experience comes from Dell servers, which use a DRAC (Dell Remote Access Card/Controller) for remote access. The HP version iLO (Integrated Lights-out) is probably very similar but I don't hands on experience with it. Some use external cards, but most are built into the the motherboard currently.

Basically think of it like a phsyical computer within a computer with it's own NIC and it can pretty much act as though you are sitting in front of the computer, including but not limited to remote console (view the screen), load an entire OS, mount media, et al.

When you boot the server and some point you'll see something like "Integrated Lights-out Management" and it will prompt you to hit F8 to configure it.

Hit F8, then configure IP address information and add a username/password. Use a regular Ethernet cable to connect the iLO port to a network switch. Open a web browser and enter the IP address you configured previously. Login with the credentials you created and you should be good. You just need to be on the same network.

With the HP implementation you have some basic functionality but I believe you need to purchase a license if you want some of the higher-end features to work.

Keep in mind to access the iLO at your parents house you'll need to have a VPN setup or to make it easier, install Teamviewer on one of your parents computers, then open up a web browser and log into the iLO.