Forum Discussion

dragonflymr's avatar
dragonflymr
Icon for Cirrostratus rankCirrostratus
Oct 19, 2015

VMWare, VLAN and LTM VE

Hi,

 

I created some test setup and was surprised by result. So either I don't get something or there is a bug...

 

Scenario:

 

  • ESX 5.1 host
  • VM with W2K8 R2
  • VM with LTM 11.5.2HF2
  • One vSwitch
  • VLAN100 with tag 100 created on vSwitch
  • vNIC with 192.168.1.1 attached to VLAN100 created on W2K8 VM
  • vNIC with 192.168.1.2 attached to VLAN100 created on LTM via VLAN assigned to Interface 1.1 and self IP
  • VLAN on LTM defined with untagged 1.1 Interface but with tag 200

My understanding is that this kind if setup equals connecting vNICs from both VMs to port access like port on vSwitch.

 

When W2K8 VM tries to connect to LTM self IP it sends ARP broadcast request, and:

 

  • Packet without tag is going to vSwitch
  • vSwitch receives untagged packet, adds tag and sends to all VMs that has vNIC assigned to VLAN100
  • VLAN tag is stripped from paacket and send to all vNICs belonging to VLAN100
  • Packet (without tag) is received by Interface 1.1 on LTM
  • Internally LTM is assigning tag 200 to received packet and process it
  • LTM sends ARP Reply without tag (stripped at egress because Interface 1.1 is untagged)
  • vSwitch receives packet, adds tag 100 and sends it to port that is assigned with target MAC from packet
  • vSwitch stripes tag 100 at target interface (W2K8 interface) and sends untagged packet
  • W2K8 vNIC receives untagged packet and can map IP to MAC address, then TCP session can be created

But it's not working like that, if vSwitch VLAN tag is different than VLAN tag defined on Interface 1.1 on LTM ping is not working. When VLAN using 4095 is assigned to vNIC on LTM then ping starts to work.

 

So question is why untagged Interface assigned to VLAN on LTM with tag other than vSwitch VLAN is not receiving packets? Interface on LTM should receive untagged frames from vSwitch, so it should not matter if vSwitch VLAN is using different tag than LTM defined VLAN to which Interface belongs.

 

Am I missing something here?

 

Potr

 

application delivery
design
LTM
TMOS

4 Replies

Sort By
  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Oct 19, 2015

    You can't have both tagged and untagged VLANs on one VMware vNIC. The vSwitch is either VST(virtual switch tagged) or VGT(Virtual guest tagged - VLAN 4095). You can't do both on one port group in VMware.

     

    • dragonflymr's avatar
      dragonflymr
      Icon for Cirrostratus rankCirrostratus
      Oct 20, 2015
      Hi, I guess my explanation was not clear enough. So here it is: On LTM I have VLAN200 defined as: tag 200, Interface 1.1 untagged Setup not working (ping failing): W2K8VM---vNIC---VLANX (tag 100)---vSwitch---VLANX (tag 100)---LTM (Interface 1.1 assigned to VLAN200) Setup working (ping OK) W2K8VM---vNIC---VLANX (tag 100)---vSwitch---VLANY (tag 4095)---LTM (Interface 1.1 assigned to VLAN200) So only change between two is attaching Interface 1.1 to VLANY on vSwitch. VLANY is for me equal to trunk port - delivering any VLAN tagged packet to vNIC on VM. VM is responsible for handling tags in frame. For not working scenario frame delivered to Interface 1.1 should be untagged, tag stripped by vSwitch before passing frame to vNIC used by LTM Interface 1.1 - or I am wrong? However for scenario working frame delivered to Interface 1.1 should be tagged so LTM should handle tag - but why? Interface 1.1 is attached to VLAN200 as untagged. So it should only accept untagged frames and then (not sure about it) add tag 200 for internal handling by LTM. Where Am I wrong? Piotr
  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    Oct 19, 2015

    You can't have both tagged and untagged VLANs on one VMware vNIC. The vSwitch is either VST(virtual switch tagged) or VGT(Virtual guest tagged - VLAN 4095). You can't do both on one port group in VMware.

     

    • dragonflymr's avatar
      dragonflymr
      Icon for Cirrostratus rankCirrostratus
      Oct 20, 2015
      Hi, I guess my explanation was not clear enough. So here it is: On LTM I have VLAN200 defined as: tag 200, Interface 1.1 untagged Setup not working (ping failing): W2K8VM---vNIC---VLANX (tag 100)---vSwitch---VLANX (tag 100)---LTM (Interface 1.1 assigned to VLAN200) Setup working (ping OK) W2K8VM---vNIC---VLANX (tag 100)---vSwitch---VLANY (tag 4095)---LTM (Interface 1.1 assigned to VLAN200) So only change between two is attaching Interface 1.1 to VLANY on vSwitch. VLANY is for me equal to trunk port - delivering any VLAN tagged packet to vNIC on VM. VM is responsible for handling tags in frame. For not working scenario frame delivered to Interface 1.1 should be untagged, tag stripped by vSwitch before passing frame to vNIC used by LTM Interface 1.1 - or I am wrong? However for scenario working frame delivered to Interface 1.1 should be tagged so LTM should handle tag - but why? Interface 1.1 is attached to VLAN200 as untagged. So it should only accept untagged frames and then (not sure about it) add tag 200 for internal handling by LTM. Where Am I wrong? Piotr