VMware ESXi – Add Secondary IP to ESXi Host from Different Subnets

iprouteroutervmware-esxi

I have to add a secondary IP to an ESXi host running ESXi 6.5. My objective is to allow communication between some machines running on a different local network and the VMs present inside ESXi through a secondary interface. Here is a map depicting my intention:

As you can see, I have a primary router connected through the primary interface with 192.168.1.0/24 and I need to connect to the other network managed by another router with a different IP range (192.168.6.0/24).

I tried to create a new port group connected to a new vSwitch that has a new VMKNIC and I created a new custom TCP/IP stack.
The problem is that:

I can set the gateway neither from the CLI nor from the interface in the new TCP/IP stack.
The VMs connected to the new vSwitch do not reach the other machines, even if they are correctly configured.

Any suggestion is more than welcome!

Best Answer

For what I understand you want to connect the 2 LANs using the host, this will not be possible, the host will not act as a router.

Having 2 interfaces in the host will only make it to be part of both LANs (if they are able to reach the GW), but you can not add the capability of redirect/route the traffic from one interface to the another inside the host.

For doing that, you need to fix your routing in the routers, having a direct connection between them and having a routing protocol enabled

Related Solutions

Virtual Machines on same ESXi 5 host: what kind of throughput should I expect

Have you actually installed the VMWare guest OS drivers in your Ubuntu VM's? That makes a veeery big difference.

DHCP – Server with Multiple Network Interfaces and Different Subnets

So here we go with a little explanation what happens. PLEASE note that I would strongly advise to run the configurations inside a testing environment to make sure, everything works as you want it to!

Edit: Please also note that your switches need to be properly configured. We are using CISCO switches. To generate an OMAPI Key, you can follow guide1 or guide2.

How to make isc-dhcp-server listen on mulitple subnets. This mini-guide will give you a basic configuration idea and some additional material to read to fully understand what's going on.

dhcpd.conf:

omapi-port 7911;
omapi-key omapi_key;

key omapi_key {
     algorithm hmac-md5;
     secret your-secret-key;
}

# The ddns-updates-style parameter controls whether or not the server will
# attempt to do a DNS update when a lease is confirmed. We default to the
# behavior of the version 2 packages ('none', since DHCP v2 didn't
# have support for DDNS.)
ddns-update-style none;

# option definitions common to all supported networks...
# option domain-name-servers x.x.x.x,y.y.y.y;
option netbios-node-type 2;

default-lease-time 7200;
max-lease-time 7200;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

# Failover Configuration

failover peer "failover-partner" {
        primary;
        # this servers ip address
        address A.A.A.A;
        port 519;
        # dhcp failover ip address
        peer address B.B.B.B;
        peer port 520;
        max-response-delay 60;
        max-unacked-updates 10;
        mclt 3600;
        split 128;
        load balance max seconds 3;
}

# No service will be given on this subnet, but declaring it helps the
# DHCP server to understand the network topology.

# here we include specific configuration files for our different subnets.
# I'll provide an example for a configuration file, all other subnet configuration files
# are (in my scenario) written the same way.

include "/etc/dhcp/X.Y.1.Z.conf";
include "/etc/dhcp/X.Y.2.Z.conf";
include "/etc/dhcp/X.Y.3.Z.conf";

X.Y.1.Z.conf:

#____________________________________
# subnet information  X.Y.1.0/24
#____________________________________
subnet X.Y.1.0 netmask 255.255.255.0 {
        deny client-updates;
        deny unknown-clients;
        # gateway of this subnet  
        option routers X.Y.1.254;
        # DNS server(s)
        option domain-name-servers 123.123.123.1, 123.123.123.2;
        # search domain(s) for this subnet. Needs the "" to work!
        option domain-search "domain1", "domain2";
        # name of domain of this subnet (if exists, otherwise comment out)
        option domain-name "mydomain";
        # ntp server if you are running one
        option ntp-servers X.Y.Z.254;
        default-lease-time 86400;
        max-lease-time 86400;

        group {
            use-host-decl-names on;

            # Infodisplay
            host dns-name-1 {
            # mac address of client
                hardware ethernet 00:00:00:00:00:00;
            # ip address the above mac address will receive
                fixed-address 123.123.123.1;
            }
       }

Other configuration files for subnets are built equally. Be sure, if you run a DHCP VM inside ESXi, to make the VM available to all your networks / VLANs. The isc-dhcp-server then needs to listen on all networks it's expected to so it can handle differen subnets all within one running instance of isc-dhcp-server. If you want to omit downtime or a non working network, you can of course run a second VM with isc-dhcp-server in slave mode like this:

slave dhcpd.conf:

omapi-port 7911;
omapi-key omapi_key;

key omapi_key {
     algorithm hmac-md5;
     secret your-secret-key;
}

# The ddns-updates-style parameter controls whether or not the server will
# attempt to do a DNS update when a lease is confirmed. We default to the
# behavior of the version 2 packages ('none', since DHCP v2 didn't
# have support for DDNS.)
ddns-update-style none;

# option definitions common to all supported networks...
# option domain-name-servers x.x.x.x,y.y.y.y;
option netbios-node-type 2;

default-lease-time 7200;
max-lease-time 7200;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

# Failover Configuration

failover peer "failover-partner" {
        primary;
        # this servers ip address
        address B.B.B.B;
        port 519;
        # dhcp master ip address
        peer address A.A.A.A;
        peer port 520;
        max-response-delay 60;
        max-unacked-updates 10;
        mclt 3600;
        split 128;
        load balance max seconds 3;
}

# No service will be given on this subnet, but declaring it helps the
# DHCP server to understand the network topology.

# here we include specific configuration files for our different subnets.
# I'll provide an example for a configuration file, all other subnet configuration files
# are (in my scenario) written the same way.

include "/etc/dhcp/X.Y.1.Z.conf";
include "/etc/dhcp/X.Y.2.Z.conf";
include "/etc/dhcp/X.Y.3.Z.conf";

Make sure the secret keys are the same on both machines, otherwise client and server are not able to communicate or to even do a failover switch if server fails and slave is expected to take over the dhcp-functionality.

If you have the hardware/setup options, please setup all this in an experimental environment.

PLEASE DO NOT INSTANTLY RUN THIS IN A PRODUCTION ENVIRONMENT.

You can stop making your network clients work within seconds and that's what your boss will not like.

Best Answer

Related Solutions

Virtual Machines on same ESXi 5 host: what kind of throughput should I expect

DHCP – Server with Multiple Network Interfaces and Different Subnets

Related Topic