Promiscuous Mode – Why Enable It?

Securityvirtualizationvmware-vcentervmware-vspherevswitch

I'm currently using an environment lab for testing ESXi so I run nested ESX(two ESX are installed on ESX)

The problem is I was trying to install vCenter on both of my lab ESX and at the end of stage 1 of deploying vCenter, I got an error that says :

The installer is unable to connect to vcenter server management interface

After this, although it says I can start stage 2 with the port 5480 of the IP address that I entered, I couldn't connect or even ping the Center!

The interesting part is after a long time of research and trying so many ways, I couldn't still connect to Center, I've tried different versions of VCenter and ESX but the problem still existed.

So I check the Vswitch settings of my main ESX and after I enabled promiscuous mode for one of the main ESX Vswitch, the problem was solved!!

Can anyone explain why?!
what am I missing?

Best Answer

A vSwitch is different from a pSwitch in that it knows which MAC addresses are allowed to attach - MAC addresses that are spoofed by a guest or trying to use promicuous mode on the vNIC for packet capturing simply don't work.

In your case, the inner ESXi hands out MAC addresses to its guests on its own. The outer ESXi needs to allow promiscuous mode for the ESXi VM's vSwitch/port group for that to work.

In a nutshell, promiscuous mode allows a VM to use arbitrary MAC addresses and to listen to all traffic on the vSwitch (still depending on VLAN ID).

Setup the External Network

To setup the network that will be used to connect to a physical NIC do the following:

Create a Standard vSwitch (External_Switch_1) for the physical connected network. Assign a physical NIC to it.
Create a Port Group (External_Group_1) on External_Switch_1. This will be used for the gateway router VM to connect to the physical network.

Setup the Internal Network

Create a Standard vSwitch (Internal_Switch_1) for the virtual network that is only available to VMs.
Create a Port Group (Internal_Group_1) on Internal_Switch_1. This will be used to connect all the VMs to.

Setup Networking for Gateway VM

On the VM create one network adapter (vNICs) and assign it to the network External_Group_1. This will allow it to talk on the physical network.
On the same VM create a secondary network adapter (vNIC) using the same add hardware wizard. Assign this second vNIC to the Internal_Group_1 network.

Setup Networking for All other VMs

When configuring the networking for each of the other VMs you want to go through the gateway assign their vNICs to the Internal_Group_1 network.

Basically you end up with the gateway sitting on both networks and all the other VMs on the internal only network. You would then configure your router with two IP ranges, one on the external network that goes to you internet connection and the other that matches with the other VMs.

The other VMs would be configured with their default gateway or default route to the Internal_Group_1 IP address on the gateway VM.

Hope that helps.

VPN connection is open. But can’t ping internal network

The error message you are getting - cant connect MKS on 192.168.1.151:902. is most probably a dns issue - caused due the the ESXi host being added in the vCenter using a host name or fqdn. In your client computer, edit the C:\Windows\System32\Drivers\etc\hosts file and add the hostname and IP address of your esxi server. For instance,

192.168.1.50    esxihost
192.168.1.50   esxihost.mydomain.com

Best Answer

Related Solutions

Connecting same VM to two vSwitches in VMware vSphere 5.1

Setup the External Network

Setup the Internal Network

Setup Networking for Gateway VM

Setup Networking for All other VMs

VPN connection is open. But can’t ping internal network

Related Topic