Setting the VLAN policy to VLAN trunking allows VLANs to be pruned by specifying VLANs to allow. VLAN tagging is done at the guest.
– Describe vDS Security Polices/Settings
The three network security policies on virtual distributed switches:
Promiscuous mode – vDS and vSS Default setting: Reject Setting this to Accept allows the guest operating system to receive all traffic observed on the connected vSwitch or PortGroup (think Hub instead of switch).
MAC address changes – vDS Default setting: Reject, vSS Default setting: Accept Host accepts requests to change the effective MAC
address to a different address than the initial MAC address.
Forged transmits – vDS Default setting: Reject, vSS Default setting: Accept Host does not compare source and effective MAC addresses transmitted from a virtual machine.
Each of these can be set to Reject or Accept.
Network security policies can be set on the virtual switch or on the virtual port group.
By default MAC address changes and Forged transmits are set to Accept on virtual standard switches (vSS).
– Configure dvPort group blocking policies
Port Blocking Policies in the vSphere Networking Guide on page 128.
Port blocking policies are only available on virtual distributed switches (vDS).
Ports can be blocked to prohibit them from sending or receiving data.
Port blocking can be enabled on a port group to block all ports on the port group.
Individual vDS or uplink ports can be blocked using the Web Client -> Networking -> vDS -> Manage -> Ports
Select the port and edit the settings of the port. From the Miscellaneous menu select the Override checkbox and set Block port to yes.
– Configure load balancing and failover policies
Load Balancing Algorithms Available for Virtual Switches in the vSphere Networking Guide on page 91.
vDS load balancing:
Route based on IP hash Use this when Cisco etherchannel is used on the physical switch.
Route based on source MAC hash
Route based on originating virtual port
Use explicit failover order Use adapters in the order they are configured.
Route based on physical NIC load (Only available on vDS)
Virtual switch failover order:
Active uplinks Used when network connectivity is up and active.
Standby uplinks Used when active adapter connectivity is down.
Unused uplinks Not used.
When using IP hash load balancing do not configure standby uplinks.
Failover order can be specified on the virtual switch or port group (Override Failover order on vSS).
During a failover, standby adapters activate in the order specified.
Failback – determines how/if a physical adapter is returned to active after a failure.
Notify switches – When a virtual NIC is connected to virtual switch or whenever that virtual NIC’s traffic would be routed over a different physical NIC in the team because of a failover event, a notification is sent out over the network to update the lookup tables on physical switches.
Network Failover Detection:
Link Status only Determines link availability based on if the adapter is physically up or down. Detects cable errors/pulls or physical switch failures, but not configuration issues.
Beacon Probing Sends out and listens for beacon probes on all NICs in the team and uses this information, in addition to link status, to
determine link failure.
Do not use Beacon probing with IP hash load balancing.
Do not use Beacon probing on virtual switches with less than 3 uplinks.
ESXi sends beacon packets every second.
The NICs must be in an active/active or active/standby configuration because the NICs in an unused state do not participate in beacon probing.
Traffic filtering and marking is only available on vDS.
Traffic filtering and marking:
CoS tagging
DSCP tagging
Network traffic rule actions can be to Tag, Allow, or Drop.
– Enable TCP Segmentation Offload support for a virtual machine
TCP Segmentation Offload in the vSphere Networking Guide on page 148.
TCP Segmentation Offload (TSO) improves the performance of ESXi hosts by reducing the overhead of the CPU for TCP/IP network operations. When TSO is enabled, the network adapter divides larger data chunks into TCP segments instead of the CPU.
To determine if TSO is supported on a physical network adapter use esxcli network nic tso get
Enable TSO on an ESXi host by setting the Advanced System Setting Net.UseHwTSO (for IPv4) and Net.UseHwTSO6 (for IPv6) to 1
To enable TSO on a Linux VM run ethtool -K ethX tso on (where X is the ethernet interface number)
TSO is enabled on a Window virtual machine by default when using VMXNET2 and VMXNET3 network adapters.
– Enable Jumbo Frames support on appropriate components
Jumbo Frames in the vSphere Networking Guide on page 146.
By default the MTU on vSS and vDS is set to 1500.
To enable Jumbo Frames set MTU to 9000. This needs to be set end to end for Jumbo Frames to work correctly.
9000 bytes is the maximum frame size that you can configure in vSphere.
Jumbo Frames can be enabled on a vSwitch, vDS, and VMkernel Adapter.
Enabling Jumbo Frame support on a virtual machine requires using the enhanced VMXNET adapter.
– Determine appropriate VLAN configuration for a vSphere implementation
VLAN Configuration in the vSphere Networking Guide on page 129.
VLAN Tagging Modes:
EST – External Switch Tagging VLAN ID is set to None or 0. The physical switch preforms VLAN tagging.
VST – Virtual Switch Tagging VLAN set between 1 and 4094. The virtual switch performs VLAN tagging.
VGT – Virtual Guest Tagging. VLAN set to ALL (4095) on vSS or VLAN trunking on vDS. VLANs are tagged at the virtual guest.
