Alright, let's have a quick discussion on virtual servers and switches in order to get
ready for the certification exam.
So virtual servers are a really important part of our network because it allows us to
reduce our physical footprint when it comes to the number of servers that we need.
So if I was to follow security best practices, I would build a server with a single operating
system on it and a single application.
So for every application and service I need to provide on my network, I would have an
isolated server doing that.
So that way there is no way that a breach of one server service could affect another
service.
Why?
Because they're on different systems.
So if I have them on different systems, it's better from a security standpoint.
So let's say you're running DHCP and DNS, well you wouldn't want to run them on the
same servers because a breach of one affects the other, you would have them on different
servers.
So with that in mind though, that is very wasteful from a physical resource standpoint,
from an economical standpoint, from a mother nature standpoint, right, the environment
as we consume a lot of electricity and to run the devices but also cool the devices
in our environment.
So we have virtual machines, virtual servers, giving us the opportunity to get the same
level of security that we would have, that's right, same level of security, not increased
security, same level of security we would have if we would have had different physical
systems.
So with our virtual machines, we have our physical server now running a hypervisor which
is a lightweight operating system that allows us to then create these different virtual
machines, isolated environments where we can set up an operating system and an application
or service.
So I'm still going to have a different operating system for every virtual machine.
When I say different, I don't mean like a different type of operating system.
It could be Windows 11 on all of them, Windows Server on all of them, whatever it is that
we're installing on, right, and have the applications we need running on each and every single one
of those.
So now I get a reduction in space requirements, a reduction in power requirements, a reduction
in cooling requirements, and I get increased deployment speeds.
A Type 1 hypervisor is going to be a, Cisco likes to call, a production level solution.
The hypervisor itself, this operating system that allows us to do this virtualization,
runs directly on top of the physical hardware of the host machine.
It doesn't rely on some type of underlying operating itself.
It is an operating system, so it doesn't need another operating system to run, and it has
the ability to provide direct access to the CPU, memory, storage, and networking resources
for all of those different virtual machines that we build on top of it.
So Hyper-V, ESXi, examples of Type 1 hypervisors.
Type 2 hypervisors, according to Cisco, not production level solutions, fair enough, right,
more for developers, let's say, who want to run another system on their own system or
their own – a system on maybe a server or a testing machine they have.
Using a Type 2 hypervisor there might be a good solution.
In this case, you can see the hypervisor runs on top of an already existing operating system.
So we already have maybe Windows running or Linux running or Mac running on top of the
actual hardware, and then we put the hypervisor.
So VMware Workstation or Fusion or Solaris Zones or Oracle VirtualBox is installed on,
let's say, Windows as an example, and then we build virtual machines inside of that that
we can then access.
More overhead, why?
Because of that operating system here.
That operating system is consuming a lot of these resources, and so there's less resources
available for our virtual machines, and this hypervisor is not necessarily as efficient,
as effective as ESXi would be as a Type 1 hypervisor.
So a lot more efficient, a lot more effective.
That's why Type 1, more of a production-level server, farm solution than a Type 2 hypervisor.
And I agree with that, absolutely, and you should too.
So the hypervisor, though, regardless of whether it is a Type 1 or Type 2 hypervisor, it really
is our resource traffic cop, folks.
That's one way to think about it.
What we have here is the hypervisor controlling access to those hardware resources.
It is divvying up, virtualizing the CPU, virtualizing the RAM, virtualizing the storage, virtualizing
the network interface card, and then divvying up those virtualized resources to each and
every single one of our virtual machines.
So since we have our virtual servers connected to our physical box, that physical box needs
to be connected to what?
Our network.
So we have, for example, our switch here, and let's say this physical NIC is connected
to this particular port right here.
Based on this scenario here, what I want you to realize is that every single one of these
virtual machines now, notice how their VNICs are connected to the physical NIC, and then
the physical NIC goes out to the switch.
What does this mean?
In this particular scenario, it means that every single one of those virtual machines
are in the same subnet, same VLAN, same broadcast domain as the physical server, which is based
on what?
Based on our configuration of that port right there.
So if I put that port in VLAN 10, that means the physical server is in VLAN 10 and all
those VNICs are in VLAN 10 as well, because there's no other way to separate that out
right now based on the way I have this design.
So where are all the MAC addresses?
Well, every single one of the VNICs has its own MAC and own IP.
This has its own MAC and own IP.
So this right here, this switch, is going to know about each and every single one of
those MAC addresses on that port.
So the switch MAC address table says, let's say VLAN 10, we are going to find those four
MAC addresses out that port, but there's not a lot of flexibility in this.
That means every single virtual machine we put on this server is going to be stuck in
that same VLAN, same subnet as how we configure that port.
I want to move now the switch inside.
How can I do that?
That's where V switches come in, virtual switches come into play, folks.
Virtual switches allow me to extend my network inside of the server itself.
So now what can we do?
We can actually trunk.
We could trunk from here to here.
That's what we can do.
And by trunking, what does that mean?
We could pass traffic from multiple VLANs.
So since we could pass traffic from multiple VLANs now, it means that we could have different
VNICs in different VLANs based on how we configure our virtual switch.
So it doesn't matter whether we're using the VMware V switch or the Cisco AVS application
virtual switch.
We have the opportunity to essentially do everything we did out here on the physical
switch.
Now we can actually do it inside on that virtual switch, and that is highly recommended.
And don't give up, for all you network admins out there, don't give up the control of that
V switch.
To who?
To the server admins.
That is your responsibility.
The V switch is an extension of your network.
That should be under your control, not the server admins' control.
Why?
Because you still need to think about your network security controls and policies that
you want to maintain in there, because we obviously don't want to have traffic from
VLAN 10 accidentally go to 20.
That should never happen, right?
And last, what?
We do routing.
So things to keep in mind about that.
So for the certification exam, what do you want to know from this particular discussion?
What we talked about in regards to V switches and VNICs, right, and the difference between
having a V switch and not having a V switch.
I want you to know type one and type two hypervisors, yes, I do.
Type one and type two hypervisors, or else I would have never had that conversation with
you folks.
So make sure you know what I said about type one hypervisors, type two hypervisors.
Make sure you have a visual representation of the pictures I provided you in your head
to give you the ability to answer questions more efficiently and effectively on the exam.
Make sure you're aware of why we want those V switches set up.
More control, more flexibility, number one.
Number two, right?
More control, more flexibility.
We have the ability now to extend our network security policies in that virtual switch when
it's all said and done.