Several iSCSI SAN on different VLANS

Similar Questions

• NFS/iSCSI ports vmkernel - different VLAN?

  I have a question, if you already have a vmkernel port defined for NFS (in vlanX), and if you want to set the iSCSI on the same physical network adapter vmkernel port/ports, then you would give this NIC iSCSI even vlan like NFS or vlanY for iSCSI?

  If you have found this device or any other answer useful please consider useful or correct buttons using attribute points

  I would create different VGA (and VLAN) for the types of traffic.  It's simple, and it will stand the test of time and changes in your iSCSI environment.  You can add network cards later, you can separate the iSCSI network in main switch.

  My situation is a little different to yours I have NFS coming through vPC on Nexus s 2148 (here 1000V) and traffic iSCSI in France via 3750 s (here 1000V).  The NFS traffic using vPC and iSCSI traffic uses MAC pinning and iSCSI MPIO.  Very different profiles.  A time ago I would have found myself in a situation similar to yours, and I took a simple approach to share the same VLAN I would be regret and detangle it right about now

  Andrew.

• How to get iSCSI SAN connected to ESX when the SAN is on a different subnet?

  Hi all

  I have two machines ESX which are directly connected to a San that are on a different subnet other network cards.  Other network cards are 10.x.x.x and the SAN is on 172.16.x.x, however whenever I try to add the iSCSI storage, the system will never find the LUN.  I put the vmkernel 172.16.x.x but it does not always find them.  I know that the LUNS are configured correctly if its ESX just having problems with the other subnet.

  You need to activate the Service Console to see the iSCSI SAN, too. This is because you use the initiator software. For example, you can add a second SC in the vSwitch that your VMKernel Port is connected and align on the same subnet.

  Kind regards

  Gerrit Lehr

  If you have found this or other useful information, please consider awarding points to 'Correct' or 'useful '.

• Cannot migrate VM on iSCSI SAN. Failure at the helm of the 10%. Peut vmping to all addresses

  Hello everyone

  Impossible to migrate virtual machines on iSCSI SAN. Failure at the helm of the 10%. Peut vmping to all addresses

  I recently installed a new configuration of the VM and I feel the above. My configuration is:

  2 HP DL380 with 1CPU 16 GB of ram and 500 GB shared space on iSCSI SAN.

  Installation of the network as follows:

  each host has the 6 network ports that is load balanced and fault tolrated in 3 VMSwitches. VMSwitch0 goes to 2 ports to shared resources on a 4510th cisco. On this switch, I use VLAN tagging to different servers that perform different functions. It works fine.ie. VLAN 5 is for the management vlan 31 is for secure vlan servers 37 is forinternal Web servers.

  VMSwitch1 is a vmkwenelport for the connection of iSCSI SAN. It is set on vlan 200 on the switch, so does tagging vlan put it. We have separated our san network ourusual networks.

  vmswitch2 is used for backup purposes and is used in a similar manner as vmswitch0. the ports of trunkied and backup services is vlan tag to go to the correct servers.

  I am able to ping betwneen the VLANS allowed. I can also vmkping to all the ip addresses of the two hosts san.

  What I can't do is to migrate direct customers between the hosts. He is still unable to 10% with the following error:

  Migrate the computer virtual iws3xx - pop1.mns.tlg.private a general error has occurred: the VMotion failed because the ESX hosts were not able to connect to the network for VMotion.  Please check your physical network configuration and settings network VMotion.

  I looked in the newspaper of vmkkernel and I get the following text:

  9 Oct 15:05:38 esxn1-pop1 vmkernel: & lt; 7 & gt; fn_scroll_back not implemented & lt; 7 & gt; fn_scroll_back not implemented & lt; 7 & gt; fn_scroll_back not implemented & lt; 7 & gt; fn_scroll_back no implemented7:05:04:55.236 cpu2:6534) migrate: vm 6535:2094: info setting VMOTION: ts = 1255097135856641 Source, src = ip & lt; 172.31.207.21 & gt;

  9 Oct 15:05:38 esxn1-pop1 vmkernel: ip dest = & lt; 172.31.207.22 & gt; Dest wid = 6447 using SHARED swap

  9 Oct 15:05:38 esxn1-pop1 vmkernel: 7:05:04:55.236 cpu2:6534) Tcpip_Vmk: 1107: refining worldwide 6899 172.31.207.21, success

  (9 Oct 15:05:38 esxn1-pop1 vmkernel: 7:05:04:55.236 cpu2:6534) VMotion: 1807:1255097135856641 S: Set ip address ' 172.31.207.21 ' worldlet affinity to send the world ID 6899

  9 Oct 15:06:53 esxn1-pop1 vmkernel: 7:05:06:10.234 cpu3:6899) WARNING: MigrateNet: 668: 1255097135856641 S: Connect to & lt; 172.31.207.22 & gt; : 8000 failed: timeout

  9 Oct 15:06:53 esxn1-pop1 vmkernel: 7:05:06:10.234 cpu3:6899) WARNING: migrate: 295: 1255097135856641 S: Failed: host ESX The failed to connect on the network for VMotion (0xbad010d) @0 x 0

  9 Oct 15:06:53 esxn1-pop1 vmkernel: 7:05:06:10.245 cpu1:6538) WARNING: migrate: 3267: 1255097135856641 s: Migration, considered a failure by the VMX.  It is probably a timeout, but check the VMX log for the actual error.

  The journal of vmx says:

  16:07:38.856 Oct 09: vmx | http://Msg.checkpoint.migration.nodata the VMotion failed because the destination ESX host has not received all of the data of the source on the network for VMotion ESX host.  Please check your network VMotion settings and physical network configuration and ensure that they are correct.

  Can anyone help with this please

  No iSCSI traffic will work only if vmKernal and vmConsole are on the same vswitch. Maybe on the same vLAN according to how your VLAN.

• How to configure the different VLANs (using the E3200)?

  Hello.

  I want to implement different VLANs (using the E3200) so that I can have two different networks that cannot access each other.

  The E3200 is connected to a modem for internet access.

  I would like that the two networks to access the internet.

  The only E3200 does support the creation of VLANs?

  If not, is there another way I can satisfy the requirement by using the single E3200 (using something else than VLANs)?

  At the end of the day, I think that I would need at least another router.

  Thus, for example,.

  Router a (E3200) is connected to the configuration / modem to DHCP with a rank 192.168.1.1/24 LAN IP address.

  Router B is connected to the router and Setup for DHCP by using a LAN IP range 192.168.2.1/24.

  This peripheral way connected to the router A should not have access to devices connected to router B and vice versa, correct?  For example, X device connected to the router cannot ping or browse files on the device is connected to router B and vice versa, correct?

  Do I need to configure anything else on router B?  For example, do I need the DNS configuration settings so that devices connected to router B can connect to the internet without problem?  Do I need to specify that these VLANs are not bridged and which router, or both?

  I already know how to configure a static IP address, DHCP, beaches LAN IP and static DNS settings on a router, etc.

  With respect to wireless devices, I think that they would follow the same model; for devices connected to the router wireless (E3200) have access to other devices Wi-wired and connected to the router, but not to devices with or without wire, connected to router B and vice versa.  However, if the wireless devices have currently access to wired devices was also connected to the router, so it's good for now.

  Thank you very much!

  -Rami

  The E3200 has no support VLAN according to the manual. There is no way to configure two separate networks with this single router.

  You need to add network electronics.

  Ex:

  Managed with VLAN switch

  Another wireless router with VLAN

  If your modem provides several public or private IP addresses, then you could put a switch after the modem and two wireless routers that are attached to the switch.

• ESXi 5.1 separating SAN traffic w / VLAN

  So I learned this week that vSphere 5.1 VmKernels no longer support multiple gateways.  This causes me some confusion with how to properly configure my for my SAN.  I thought it was best practice to separate traffic, so I created VLANS separated for management and for data traffic (SAN).  Since they are in different subnets, they have their own front door.  When you try to configure it I started having a few problems before I realized that the gateway that must remain the same.  I contacted VMware and initially they said gateways may be changed before finally stating that they were incorrect and that there may be 1 door entry.  The answer I got on their part at this time there is that I don't in fact want to split the VLAN and leave the front door on my vmkernel for only san traffic they stated that both that my VLAN was correctly setup that vmware if you just know where to send data and it wouldn't matter.  When this 'magic' was not they told me I must have a problem of vlan and they couldn't help me.

  Could someone give me an idea as to what the best method is to do this?  I found an article that says you can manually add a second gateway via the CLI, but when I tried I received an error message indicating that the route existed.

  VLAN 18 (172.27.18.x/24 w/gw 172.27.18.1) - management

  VLAN 40 (172.27.40.x/24 w/gw 172.27.40.1) - data/SAN

  Any help would be greatly appreciated.

  Hi Greg,.

  Here is an example of configuration using VSS;

  -vSwitch0 = management is on VLAN130 (port, no VLAN ID configured access)

  -vMotion = vSwitch1 is on VLAN131 (port, no VLAN ID configured access)

  -vSwitch2 = IPStorage is on VLAN132 (access port, no configured VLAN ID) - L2 subnet gateway disabled

  -vSwitch3 = comments Networking (ports of junction, tagging VLAN)

  

  In this example, management and IPStorage be separated on different VLAN and for more security VLAN IPStorage has the gateway disabled (so traffic can be routed elsewhere).

  From the storage point of view, simply presented in your storage space (NFS exports for example) on the same VLAN as your port IPStorage kernel VM (or VLAN132 in this example).

  See you soon,.

  Jon

• Make Accessible iSCSI SAN-VM via Windows iSCSI initiator

  I have a "total newbie" question that I hope can respond quickly enough.

  I added a new DELL MD3000i SAN to my storage network in order to use this SAN exclusively for Windows virtual machines. I have the vdisks large (2) 4 to 7 to each (Yes, I REALLY need unique and large volumes) defined on the MD3000i. (4) the MD3000i ports are connected to my iSCSI VLANS and have the id default host port 192.168.130.101/102 and 192.168.131.101/102.

  I have a MD3220i installed in the network and working with hosts ESXi 4.1 (2) (192.168.230.101/102, 192.168.231.101/102 of the subnets). I am quite familiar with how to make the storage available to the host via the initiator of the iSCCI, but I know not how to make accessible storage for virtual machines WITHOUT using the host to connect to the iSCSI SAN, create a data store, and then add a new virtual disk to the virtual machine.

  Only the vmnic dedicated to the iSCSI initiator have physical links to iSCSI VLANS (vSwitch01). The network switch has (2) network adapters connected to the network via vSwitch0 "inside".

  Any ideas on the best way to "get there from here"?

  Hello.

  You will need to create a group of ports in virtual machine on the same vSwitch created in your iSCSI ports group.  Give the virtual machine a 2nd NETWORK card and then assign it to the created virtual machine port group previously.

  Good luck!

• How to reconnect safely iSCSI SAN connection after new ESXi4u1 reinstall on USB?

  Hi all

  Can anyone here guide me how to add the connection to the current host of ESXi 4 iSCSI SAN?

  I think not as export the ESXi existing profile using vMA can do much because the version number is different so ESXi profile export is useless.

  Note: during the installation of 4u1 ESXi I unplug the host LAN cable.

  Thank you.

  Kind regards

  AWT

  Access to the host on the MD3000i configured?

  Cause the host will have a different IQN, you must reconfigure the access.

  André

• question put on the vSphere iSCSI SAN infrastructure network

  Hi all

  We are a small company with a small virtualized environment (3 ESX servers) and are about to buy an AX-5 SAN EMC (model Ethernet not CF) to implement some of the features of high availability of vSphere. My question is related to the networking of the SAN: we switch dual Cisco 2960 G Gigabit and dual Cisco ASA 5510 firewalls in a redundant configuration.

  I understand that the best practice is to implement iSCSI traffic on a separate from all other traffic LAN switch. However, I do not have the knowledge and experience to determine the real difference than a separate switch would really vs the plan to create a separate VLAN on the switches Cisco dedicated to iSCSI traffic only. I would ensure that the iSCSI traffic has been on a VLAN dedicated Physics (not just a logic) with any other VLAN logical (subinterfaces) on the same VLAN). It is difficult for me to understand how a port gigabit on a VLAN isolated on kit Cisco will perform much poorer than on a dedicated Cisco switch somehow. But then again, I don't know what I don't know...

  The thoughts and the input would be appreciated here: I'm (very) hard not to drop another $6 + in another pair of Cisco switches, at least that this decision will significantly compromised performance iSCSI SAN.

  Enjoy your time,

  Rob

  You have 2 SP each with 2 iSCSI, for example:

  SPA: 10.0.101.1 101 VLANS and VLAN 102 10.0.102.1

  SPB: 10.0.101.2 101 VLANS and VLAN 102 10.0.102.2

  On your ESX to create 2 vSwithes, each with a port vmkernel on an iSCSI network and each with a single physical NIC.

  See also:

  http://www.DG.com/microsites/CLARiiON-support/PDF/300-003-807.PDF

  André

• iSCSI SAN, ESX4 Datastore recommended sizing

  Hi all.  I am in the final stages of our construction of vSphere and I'm looking for best practices in terms of sizing of the warehouses of data/Lun on a SAN, iSCSI for several hosts of ESX4.

  What we have:

  Two HP c7000 blade enclosure with three BL460c in each enclosure.

  All servers will run ESX4 and use an iSCSI SAN (Software initiator).

  I'm not sure of the best way to configure these elements.  A large unit number logic holding a large store of data?  A few small LUN each holding a data store? A unit number logic/data store for each ESX host?  I don't want to use vMotion and who could help narrow down the answer.

  Any help that you experienced people from VMware can each give this noob is very much appreciated.

  -Dave

  Dave

  This is my golden rule.

  Virtual machines are mixed on data warehouses to optimize storage efficiency and the efficiency of the I/O - low mix I/O virtual machines with virtual machines I/O high on the same data store.

  VMs per VMFS datastore 12-16 maximum.

  16 VMDK files per VMFS datastore maximum.

  * A VMFS volume per LUN storage.

  * At least 15% to 20% of a VMFS data store should be left as open space to meet requirements such as the virtual machine swap files and snapshots.

  According to your needs - you will initially 30 virtual machines, you must look for set 2 data warehouses-, but the number of vmdk files or e/s for a virtual machine needs can change that.

• Config network initial ESX with iSCSI SAN

  Hi all

  I want to install 2 ESX 3.5 servers which will be connected to an EqualLogic iSCSI SAN.

  The SAN is on a VIRTUAL, 10.x.x.200 with a 255.255.255.224 LAN Gateway.  This VLAN is not routable, DNS servers, etc.

  What I am trying to understand, it's for the initial setup of ESX, when I set the config network (console), should I register the IP address for the VIRTUAL LAN, example was:

  IP address: 10.x.x.201

  Gateway: 255.255.255.224

  Primary DNS: white

  Secondary DNS: white

  Or, for example B, should I use our 'public' speaking:

  IP Adress:129.x.x.201

  Gateway: 255.255.255.0

  Primary DNS:129.x.x.1

  Secondary DNS: 129.x.x.2

  I know that with the VIC, I can later add vSwitches, etc., but at least for the initial installation, I want the configuration to provide smoother operation. Thanks for any idea that you can provide!

  Chad

  Hello and welcome to the forums.

  What I am trying to understand, it's for the initial setup of ESX, when I set the config network (console), should I register the IP address for the VIRTUAL LAN, example was:

  Use example B (129.x.x.x) for the Service Console (management functions), and after that the system is in place to add an another vSwitch used to connect to the SAN VLAN.

  Good luck!

• Microsoft NLB on a virtual iSCSI SAN using computer

  Hello

  Is it possible to use the NLB network on a virtual computer that is connected to an iSCSI SAN?  I was under the impression that MSCS is not available, use an iSCSI device, but is NLB another form of consolidation?  I am unable to find a clear answer anywhere else.

  Any help would be appreciated.

  Yes its is possible, the storage has nothing to do with NLB, its pretty much traffic going to different hosts of network load balancing.

  useful info: http://blog.baeke.info/blog/_archives/2006/2/21/1775587.html

  If you found this information useful, please consider awarding points to 'Correct' or 'useful '. Thank you!

• How to connect to iSCSI SAN without compromising security

  Hello:

  How to enable server OSes (VMS or physical host computers) to connect and LUN iSCSI mount without compromising the safety of our ESX host?  We have a few Microsoft servers that need to use iSCSI initiators at Mount MON for MSCS.   We cannot use the ESX initiators because VMware doesn't support iSCSI to virtual storage with MSCS.  We have already read all the documentation and spoke with VMware support, so we know that our only option is to use the iSCSI initiators in Microsoft servers to connect to the LUN.

  Our concern is security.  If we let the servers use their iSCSI initiators to connect to the San, then they also won't have access to our service and the vkernels via the iSCSI network console?  ESX requires that you have a port the service console and the port of vkernel on the iSCSI network for each ESX box that you want to use the ESX initiator for.  We struggle to understand how to connect any machine (virtual or physical) to the iSCSI network to mount LUN without exposing our service and vkernels consoles.  I know that the best practice is to remove this VMs network for this exact reason, but of course many organizations also have physical servers (UNIX, Windows) who need to access their iSCSI SAN.  How people treat this?  How much of a security problem is it?  Is there a way to secure the service console and vkernel ports while allowing host ESX - no access to the SAN?  I know that many of you are facing this exact in your organizations situation, please help.  Obviously, it is not supposed that nobody uses their SAN iSCSI for anything else except for the ESX host.  I thank very you much.

  James

  Hello

  Check out this blog

  Use of firewall is certainly a step in the right direction for that. If you can't have separate iSCSI networks, then you will need to isolate nodes NON-ESX/VCB iSCSI using other mechanisms. I would certainly opt for firewalls or reduce the redundancy to just 2 network-by-network cards and not 4 to a single network.

  Someone at - it any other suggestions? Surely many ESX users share their iSCSI SAN with a lot of different systems and operating systems. Thanks again.

  They do, but they do not secure their networks for their VMs ESX iSCSI / other physical systems. You have asked a very important question and it's how to connect to iSCSI SAN without compromising safety. If the options are currently:

  1. Physically isolate

  2. Isolate using firewall

  Given that ESX speaks in clear text and does not support IPsec for iSCSI, you have very limited options that are available to you. The firewall you use and charge iSCSI, you send through it will determine if there is no latency. Yes its a cost extra, but if it is an independent network switches/ports/etc.

  Best regards
  Edward L. Haletky
  VMware communities user moderator, VMware vExpert 2009
  ====
  Author of the book ' VMWare ESX Server in the enterprise: planning and securing virtualization servers, Copyright 2008 Pearson Education.
  Blue gears and SearchVMware Pro items - top of page links of security virtualization - Security Virtualization Round Table Podcast

• Wake on LAN (WOL) through different VLAN on SG-300-10

  Hello

  I try to get WOL working through different VLAN on a Switch SG-300-10 in layer 3 Mode.  To achieve this, I set up a UDP relay (GUI menu Configuration IP) for UDP Port 7 to 255.255.255.255 (this should inundate all interfaces with the package), however, does not work WOL in different VLANS.  When I am connected directly to the VLAN corresponding, WOL works fine in the same subnet.  Am I missing something here?

  All comments appreciated!

  Thank you very much!

  Hi Romeo,.

  A few minutes to try it on my SG300 - 10 p mode layer 3.

  My NAS unit is capable WOL and I thought I would use it in my test environment...

  Ran a basic test to check my sender of packet Magic from my PC "awakened" my NAS unit.

  As you would expect, on the same subnet, the magic packet WOL caused my NAS unit to power, no problem.

  But this isn't really the test, just a test database to check that my sender of the packet magic WOL and NAS was working well.

  The screenshot below shows WOL software I used on my PC.  Why use this software, no reason except that it was available for free. Also, I'm sure other WOL software out there for different platforms that work just as well or with more features.

  

  First of all, I see according to your question, you used relays UDP destination port 7, well it is the default setting on the UDP relay on my switch.

  I wonder why you used or stayed with destination UDP port 7, because the Magic packet mailers may use different destination UDP ports?

  I had to use wireshark to see the real destination UDP port that uses my sender of the magic packet WOL.

  

  Notice of capturing wireshark above, that my magic packet software uses the UDP port destination 9, NOT the default value that you can see on the switch. Ignore what wireshark labels this port.

  OK, I then created a VLAN that I named "VLAN2' with a = 2 VID on my SG300 - 10 p (SRW2008P-K9-NA)

  I added a 192.168.2.1/24 IP interface to VLAN2, which is a different network from the default VLAN.

  I then added three ports this VLAN newly created as a member untagged VLAN2.

  The default VLAN (VID = 1) an IP network 192.168.10.0/24.

  My NAS (WOL capable) unit has an IP address of 192.168.10.61.

  I plugged my PCt to the vlan 2 and statically assigned 192.168.2.2/24.  It is the PC that has the magic package software.

  I added a route static to my router WAN, just so that I could access the router my PC attached to the VLAN2 WAN.

  I tried the magic packet WOL software and will not turn on my NAS.  He expected that the magic packet broadcast would never jump over a limit of LAN in one VLAN different...

  Now, I tried to install a UDP relay so that the Magic Packet WOL "would be" the VLAN2 network interface VLAN1.

  So I configure and add to my SG300 UDP relay entry - 10 p.   See the screen capture below.

  I have to admit, I'm used to using UDP relay normally take a netbios broadcast and unicast to a server Ms.

  But check the screenshot below, I put the switch to send the UDP relay to the broadcast address of VLAN1 network... The magic packet Wakeup sent from my PC into 2 VLANS must have passed over the limit VLAN that my NAS unit woke.

  

  In order to check the destination port UDP to your WOL software using wireshark, and then create an appropriate UDP relay.

  Experiment and play with that, once you get your device WOL properly powereing successfully.

  Best regards, Dave

  If I answered your question, please rate the relevance of this response

• WIndows Server with multiple IP addresses in different VLANS

  What I'm trying to achieve: -.

  A Server Windows 2008 R2 Virtual machine with of 6 vNIC each with an IP different address of VLAN different & connected to the corresponding ports on VIRTUAL LAN group.

  Now how to make sure that traffic is properly flowing as traffic for VLAN specific are coming and get out of that vnic so that it can flow through port designated group

  As a single gateway can be mentioned, I guess we need to add static routes for that to work, but if it's static routes, then please explain to me how these roads will need to be added for each IP address.

  Or if there is another way to make her even if you please let me know.

  
  

  Thanks in advance...
  

  
  

  I was wondering what I really need to add roads since I am not asking that two different VLAN is talking to each other. Guess that's when I need the static routes.

  I guess in this case if I have 3 NIC with 3 different IP addresses would not be the traffic corresponding VLAN will come automatically the corresponding card.

  That would not be in the range 1.2.3.x traffic flows automatically NIC1 & 5.6.7.x runs automatically NIC2 & etc.?