Welcome to vSphere 8 in the real world. Now we're going to discuss network policies.
So, you can set network policies for standard switches. You can also set network policies for distributed virtual switches.
You have a lot more options with your distributed virtual switches than you do with a standard switch or a standard virtual switch.
So, on a standard virtual switch, you can set the policy for the entire virtual switch,
or you can override a switch's settings at the port group level. So, you have two levels you can configure it at.
You can do it at the switch level or at the port group level. On a distributed virtual switch, you can set it on the virtual switch level,
the distributed virtual switch. You can do it at a port group level. You can do it at an individual port level.
And you can also do it on for uplinks. Also, they can carry uplink policies for things like VLAN settings and things like that.
So, you have a lot more granular control, a lot more broader control with a distributed virtual switch than you do with a standard switch and standard port groups.
Also, different types of devices will have different policies available. You have different policies for a port group than you would, say, for example, for an uplink or something like that.
So, obviously, your network devices aren't able to predict what you're trying to do. Unfortunately, we're not quite there yet.
We're getting close with AI. But right now, you kind of have to tell it specifically what you want.
So, if you have something tagged on your virtual switch, say, at a port group or a virtual switch level or a distributed virtual switch level,
but you don't create the VLAN tag, for example, on the link to your adapters on this physical switch, then the VLAN traffic isn't going to pass.
So, if you were to tag a VLAN, say, 10 at a port group level, but you don't have VLAN trunked on the physical switch interface,
then traffic isn't going to pass on VLAN 10, and it'll look like that virtual machine, for some reason, doesn't have network connectivity.
So, that's something you need to be aware of. Make sure that when you're making changes, that the changes on the physical switch match up
and are going to work with the changes you've made on your virtual switch, on your port group, on your distributed virtual switch, and all that.
And especially with your distributed virtual switches, because they have a lot more functions, a lot more features,
but those features usually require some kind of configuration on the physical network to make those things work.
So, make sure that whatever you're configuring, it works out on both sides. Your VLAN is configured on both sides correctly.
If you're having any kind of security enabled, you need to make sure that your switch is configured to allow that as well.
So, network policies. You can see we have a bunch of different types of policies.
Some things we can configure on a distributed virtual switch, as well as a standard virtual switch.
Other things we can only do on a distributed virtual switch. So, teaming and failover, that can be done on both.
Security settings, like your MAC address booping, that kind of thing, that can be set on both.
Traffic shaping. Traffic shaping can be set on both for your outbound traffic, but if you want to do inbound traffic,
traffic shaping, that can only be done on a distributed virtual switch.
VLANs, obviously, that can be configured for both.
Monitoring. So, if you want to use NetFlow, for example, that's only on a distributed virtual switch.
Filtering and marking. So, any kind of unwanted traffic, like quality of service options, only on a distributed virtual switch.
Resource allocation, only on a distributed virtual switch.
And port blocking is also only available on a distributed virtual switch.
So, if you have some of those more advanced features you want to do, you want to make sure you have an Enterprise Plus license,
and you can get a distributed virtual switch and use those features.
So, VLAN policies.
You need to make sure that you have, again, your virtual switches, whether it be distributed or standard,
and your physical switches configured the same, right?
You want to make sure that traffic is allowed to flow back and forth.
So, what a VLAN basically is, if you're not familiar, it's like a virtual switch.
Whereas a switch is a Layer 2 device, a VLAN is a way of creating different Layer 2 broadcast domains.
So, if I have ports 2 and 3, both on VLAN 10, if the machine on interface 2 were to send out a Layer 2 broadcast,
the device on Layer 3 is going to get it.
But if a device on Layer 4 is on a different VLAN, it won't see the broadcast, because that would be a different broadcast domain.
So, VLANs are broadcast domains, they're Layer 2 concepts.
Unlike, say, for example, an IP address, which is a Layer 3 concept, and a whole different type of broadcasting happens there.
You do have dependency on your network devices, obviously, for configuration.
So, tagged means there's two different concepts that you'll deal with with your physical switches with VLANs.
It's going to be tagged and untagged.
So, for example, a VLAN can be untagged on a physical switch interface,
which means that traffic coming from, say, a workstation into that interface without a VLAN is going to be presumed to be on VLAN 10.
It'll put the traffic on VLAN 10.
If a packet is tagged for a VLAN, say, VLAN 20,
then the device sending that packet needs to add the VLAN tag, needs to add VLAN 20 to the packet before sending it to that interface.
And because the device that is sending the packet puts the VLAN tag on when it sends it out before it gets to the switch,
a port can actually allow multiple tagged VLANs.
So, I can say I'm going to allow tagged VLANs 10, 20, and 30.
And an ESXi host, for example, can send a packet out with tags for VLAN 10,
and the switch will say, oh, I allow tagged VLAN 10.
And VLAN 20, I allow tagged VLAN 20.
And 30, you know, so on.
But if it sends VLAN 40 and 40 isn't set for tagged, it won't allow it.
So, if the host were to tag VLAN 40 on a packet and then send it and it's not tagged on the interface, the physical switch,
then it's not going to allow that packet.
And you can also have what's either referred to as the untagged or the default VLAN for an interface.
And that would be if a packet comes through with no VLAN tag, what VLAN are we going to put it on?
And that, you know, would be what is considered untagged.
All right.
So, those are different concepts you might want to be aware of when you're dealing with your ESXi host
and configuring your physical switches.
So, a lot of times, like VM kernel ports, that would be a untagged.
You can tag them.
That's an option.
You saw it in one of our demos earlier.
But sometimes we'll just say anything management will be untagged.
That's going to be the default VLAN for those interfaces.
And then we're going to tag all the other VM traffic.
That's one configuration you see quite a bit.
If we were dealing with, say, for interfaces that are dedicated to iSCSI, we might leave them untagged.
And on those interfaces on the switch, we'll say our VLAN is our default iSCSI VLAN.
Maybe it's VLAN 250 or something.
And we don't have to worry about adding the tags to that because we're only putting iSCSI traffic on those interfaces.
We have dedicated NICs for iSCSI.
We can leave the packets untagged and just have it be a default access port with a VLAN 250 configure or something like that.
All right.
So VLAN policies, they can be set on a distributed virtual switch at a switch level or a port group level or an individual port level and also on an uplink group level.
So there's a lot of different places you can create your VLAN tags, and I'll show you how to do that in just a little bit here.
So, again, if you want to set a policy that's going to apply to a group of interfaces, you can create a VLAN policy for either a port group or for an individual port.
All right.
So to create a policy for a distributed port group, you're just going to go to your networking menu.
You'll find your distributed virtual switch.
Find the port group you want to configure it for.
Go to its properties, and that's one of the properties you can set on there.
We can also go to individual ports and then go to edit that port, and we can choose the setting for that.
And I'll show you how to do that here in just one moment.
So types of VLANs, we can say none.
We're not going to tag VLANs.
We can say what is allowed.
So, for example, we can say we want to allow an allowed or an access port would be just the default interface.
Trunking means we're going to allow more than one VLAN.
So if I configure an interface as an access interface, then I'm saying I'm only going to allow one VLAN, and traffic coming through will be untagged.
And whatever, you know, traffic comes through here, it's going to be on VLAN 10, right?
Trunking means I'm going to allow multiple VLANs.
I can say I'm going to allow, as I said in the previous example, 10, 20, 30, 40, or I could say I'm going to allow, you know, 10 through 40.
That would be 10, 11, 12, all the way to 40.
You can do, you know, ranges like that.
You can also, on a trunk port, have what's considered the default access also.
So untagged packets go into that default access, and everything else has to be tagged with one of the allowed VLANs that you have specified in your allowed VLANs.
In a private VLAN, we discussed that before, too.
A private VLAN simply means that machines on the same VLAN can't see each other, okay?
So they're really not one broadcast domain.
They're all separate domains, and they can only communicate with one interface that is usually going to be linked out to, like, for example, a firewall.
So if you had a bunch of machines that you didn't want to see each other, you could put them on the same private VLAN, and they won't see each other.
They'll only have access out to, for example, a firewall that gets them, for example, to the Internet.
So here's how, again, uplink port policies, distributed virtual switches, right?
We can go to distributed virtual switch.
We can go to, you know, is properties, and then we can set the tag for the VLAN on the switch level.
We can also do it on a port group level.
We can also do it on a port, or we can do it on a uplink port group, all right?
So the uplinks are physical adapters.
We're saying, like, everything goes off these adapters.
We want to have tags with a certain VLAN, all right?
So let's go ahead and jump back into our demo environment, and I'll show you how to add tags, VLAN tags for port groups and individual ports in a port group.
So here we are in our demo environment.
We're in our networking.
So here we have our distributed virtual switches.
I can go to my switch and say I want to go distribute, edit my settings, and you see I have, for example, different options in here that I can enable and disable.
Right.
I can go in and see my end-to-use size, right, what uplinks are on here, my name.
Okay.
If I want to use an offload card, something like that, on that distributed switch, I have my port group.
I have my port group.
I have my port group in edit settings here.
And for VLAN, I can go in and say I want to allow, you know, VLAN 10.
I can change it to VLAN, you know, 220.
I can also say a range.
I want to allow 220 through 225, which means I'll allow 220, 221, 222, and so on, and I can apply that and say okay to that.
Now, I also have these ports here.
I can go to a port and say I want to edit, but you'll notice pretty quick I can't choose to overwrite these settings.
If I want to overwrite settings on individual ports, the port group has to allow that.
So, I have to go to my advanced and say for VLANs, I want to allow override policies, or for traffic shaping, I want to allow override policies.
Okay, same thing for each of these.
So, I'm going to go ahead and say okay to that.
Now, if I go back to the same port and I go to VLANs, I can override that, right?
And instead of being a trunk, I can say it's a VLAN and I want to allow VLAN 20.
I do the traffic shaping, and I enabled overwriting for traffic shaping, and I can say instead of being the default disabled, I'm going to enable it and set what I want traffic shaping to be for this specific port in that port group, right?
So, I can set it, you know, in multiple places I can set these VLAN tags.
It's not, you know, that often you'll set it at the port level.
If I am setting it at the port level, then I probably have my settings set as ephemeral, right?
I'm sorry, not ephemeral.
It's going to be static binding.
Ephemeral means that the VMs can change back and forth.
If I'm doing static binding, that means that I probably will end up doing per port or could end up doing per port settings.
You probably won't do per port settings if you have ephemeral where when the VM shuts down, it releases that port because then that means I don't know what could land there next and then some random machine could get those settings, and that could obviously not be, you know, very positive for my networking environment.
All right.
So, that's the conclusion of configuring distributed virtual switches and standard switches.