Dec 03

IPS in ESX with vSwitches – Config Hint

Hints and Tips, IPS, Virtualization -
1 Star2 Stars3 Stars4 Stars5 Stars (4 votes, average: 5.00 out of 5)
Loading ... Loading ...
 No Comments »

To setup properly the portgroups in VMware vSwitching environment, we had to create two portgroups per vSwitch as depicted below:

schema-for-connecting-two-vswitch-with-sg-ips-in-esx

Reason for this configuration is that “operative portgroups” where servers and machines are connected should not be in Promiscuous mode to avoid sniffing other machines’ traffic, while portgroups dedicated to IPS inline ports must:

  • be configured in promiscuous mode to receive all traffic of the vSwitch they are connected to
  • be part of VLAN ID 4095 to “pass” all VLAN IDs to Virtual Machine without any intervention

Below you can find the sample screenshot about where to configure these settings:

pgroup-properties IPS-vlanid pgroup-properties IPS

These settings can be done in portgroups’ properties in ESX and they are NOT needed if you implement similar configuration in VMWare Workstation or VMWare Free Server.

written by RoarinPenguin - 1,498 views \\ tags: , , , ,