WEBVTT 00:00:00.000 --> 00:00:06.600 Welcome to vSphere 8 in the real world. Now we're going to discuss network policies. 00:00:06.600 --> 00:00:12.260 So, you can set network policies for standard switches. You can also set network policies for distributed virtual switches. 00:00:12.260 --> 00:00:19.700 You have a lot more options with your distributed virtual switches than you do with a standard switch or a standard virtual switch. 00:00:19.700 --> 00:00:27.299 So, on a standard virtual switch, you can set the policy for the entire virtual switch, 00:00:27.299 --> 00:00:32.799 or you can override a switch's settings at the port group level. So, you have two levels you can configure it at. 00:00:32.799 --> 00:00:41.799 You can do it at the switch level or at the port group level. On a distributed virtual switch, you can set it on the virtual switch level, 00:00:41.799 --> 00:00:49.299 the distributed virtual switch. You can do it at a port group level. You can do it at an individual port level. 00:00:49.299 --> 00:00:56.299 And you can also do it on for uplinks. Also, they can carry uplink policies for things like VLAN settings and things like that. 00:00:56.299 --> 00:01:08.300 So, you have a lot more granular control, a lot more broader control with a distributed virtual switch than you do with a standard switch and standard port groups. 00:01:08.300 --> 00:01:17.300 Also, different types of devices will have different policies available. You have different policies for a port group than you would, say, for example, for an uplink or something like that. 00:01:17.300 --> 00:01:24.300 So, obviously, your network devices aren't able to predict what you're trying to do. Unfortunately, we're not quite there yet. 00:01:24.300 --> 00:01:29.300 We're getting close with AI. But right now, you kind of have to tell it specifically what you want. 00:01:29.300 --> 00:01:37.300 So, if you have something tagged on your virtual switch, say, at a port group or a virtual switch level or a distributed virtual switch level, 00:01:37.300 --> 00:01:47.300 but you don't create the VLAN tag, for example, on the link to your adapters on this physical switch, then the VLAN traffic isn't going to pass. 00:01:47.300 --> 00:01:57.300 So, if you were to tag a VLAN, say, 10 at a port group level, but you don't have VLAN trunked on the physical switch interface, 00:01:57.300 --> 00:02:04.300 then traffic isn't going to pass on VLAN 10, and it'll look like that virtual machine, for some reason, doesn't have network connectivity. 00:02:04.300 --> 00:02:12.300 So, that's something you need to be aware of. Make sure that when you're making changes, that the changes on the physical switch match up 00:02:12.300 --> 00:02:18.300 and are going to work with the changes you've made on your virtual switch, on your port group, on your distributed virtual switch, and all that. 00:02:18.300 --> 00:02:24.300 And especially with your distributed virtual switches, because they have a lot more functions, a lot more features, 00:02:24.300 --> 00:02:30.300 but those features usually require some kind of configuration on the physical network to make those things work. 00:02:30.300 --> 00:02:36.300 So, make sure that whatever you're configuring, it works out on both sides. Your VLAN is configured on both sides correctly. 00:02:37.300 --> 00:02:43.300 If you're having any kind of security enabled, you need to make sure that your switch is configured to allow that as well. 00:02:45.300 --> 00:02:49.300 So, network policies. You can see we have a bunch of different types of policies. 00:02:49.300 --> 00:02:54.300 Some things we can configure on a distributed virtual switch, as well as a standard virtual switch. 00:02:54.300 --> 00:03:00.300 Other things we can only do on a distributed virtual switch. So, teaming and failover, that can be done on both. 00:03:00.300 --> 00:03:04.300 Security settings, like your MAC address booping, that kind of thing, that can be set on both. 00:03:04.300 --> 00:03:10.300 Traffic shaping. Traffic shaping can be set on both for your outbound traffic, but if you want to do inbound traffic, 00:03:10.300 --> 00:03:14.300 traffic shaping, that can only be done on a distributed virtual switch. 00:03:15.300 --> 00:03:18.300 VLANs, obviously, that can be configured for both. 00:03:18.300 --> 00:03:23.300 Monitoring. So, if you want to use NetFlow, for example, that's only on a distributed virtual switch. 00:03:24.300 --> 00:03:31.300 Filtering and marking. So, any kind of unwanted traffic, like quality of service options, only on a distributed virtual switch. 00:03:31.300 --> 00:03:34.300 Resource allocation, only on a distributed virtual switch. 00:03:34.300 --> 00:03:38.300 And port blocking is also only available on a distributed virtual switch. 00:03:38.300 --> 00:03:43.300 So, if you have some of those more advanced features you want to do, you want to make sure you have an Enterprise Plus license, 00:03:43.300 --> 00:03:47.300 and you can get a distributed virtual switch and use those features. 00:03:49.300 --> 00:03:51.300 So, VLAN policies. 00:03:53.300 --> 00:03:58.300 You need to make sure that you have, again, your virtual switches, whether it be distributed or standard, 00:03:58.300 --> 00:04:01.300 and your physical switches configured the same, right? 00:04:01.300 --> 00:04:04.300 You want to make sure that traffic is allowed to flow back and forth. 00:04:04.300 --> 00:04:10.300 So, what a VLAN basically is, if you're not familiar, it's like a virtual switch. 00:04:10.300 --> 00:04:16.299 Whereas a switch is a Layer 2 device, a VLAN is a way of creating different Layer 2 broadcast domains. 00:04:17.299 --> 00:04:26.299 So, if I have ports 2 and 3, both on VLAN 10, if the machine on interface 2 were to send out a Layer 2 broadcast, 00:04:26.299 --> 00:04:28.299 the device on Layer 3 is going to get it. 00:04:28.299 --> 00:04:35.299 But if a device on Layer 4 is on a different VLAN, it won't see the broadcast, because that would be a different broadcast domain. 00:04:35.299 --> 00:04:38.299 So, VLANs are broadcast domains, they're Layer 2 concepts. 00:04:39.299 --> 00:04:45.299 Unlike, say, for example, an IP address, which is a Layer 3 concept, and a whole different type of broadcasting happens there. 00:04:47.299 --> 00:04:50.299 You do have dependency on your network devices, obviously, for configuration. 00:04:51.299 --> 00:04:56.299 So, tagged means there's two different concepts that you'll deal with with your physical switches with VLANs. 00:04:57.299 --> 00:04:58.299 It's going to be tagged and untagged. 00:04:59.299 --> 00:05:04.299 So, for example, a VLAN can be untagged on a physical switch interface, 00:05:05.299 --> 00:05:12.299 which means that traffic coming from, say, a workstation into that interface without a VLAN is going to be presumed to be on VLAN 10. 00:05:13.299 --> 00:05:14.299 It'll put the traffic on VLAN 10. 00:05:14.299 --> 00:05:18.299 If a packet is tagged for a VLAN, say, VLAN 20, 00:05:19.299 --> 00:05:26.299 then the device sending that packet needs to add the VLAN tag, needs to add VLAN 20 to the packet before sending it to that interface. 00:05:27.299 --> 00:05:33.299 And because the device that is sending the packet puts the VLAN tag on when it sends it out before it gets to the switch, 00:05:34.299 --> 00:05:37.299 a port can actually allow multiple tagged VLANs. 00:05:38.299 --> 00:05:40.299 So, I can say I'm going to allow tagged VLANs 10, 20, and 30. 00:05:40.299 --> 00:05:45.299 And an ESXi host, for example, can send a packet out with tags for VLAN 10, 00:05:46.299 --> 00:05:48.299 and the switch will say, oh, I allow tagged VLAN 10. 00:05:49.299 --> 00:05:50.299 And VLAN 20, I allow tagged VLAN 20. 00:05:51.299 --> 00:05:52.299 And 30, you know, so on. 00:05:53.299 --> 00:05:58.299 But if it sends VLAN 40 and 40 isn't set for tagged, it won't allow it. 00:05:59.299 --> 00:06:05.299 So, if the host were to tag VLAN 40 on a packet and then send it and it's not tagged on the interface, the physical switch, 00:06:06.299 --> 00:06:07.299 then it's not going to allow that packet. 00:06:07.299 --> 00:06:14.299 And you can also have what's either referred to as the untagged or the default VLAN for an interface. 00:06:15.299 --> 00:06:20.299 And that would be if a packet comes through with no VLAN tag, what VLAN are we going to put it on? 00:06:21.299 --> 00:06:23.299 And that, you know, would be what is considered untagged. 00:06:24.299 --> 00:06:25.299 All right. 00:06:25.299 --> 00:06:29.299 So, those are different concepts you might want to be aware of when you're dealing with your ESXi host 00:06:30.299 --> 00:06:32.299 and configuring your physical switches. 00:06:32.299 --> 00:06:35.299 So, a lot of times, like VM kernel ports, that would be a untagged. 00:06:36.299 --> 00:06:37.299 You can tag them. 00:06:38.299 --> 00:06:39.299 That's an option. 00:06:39.299 --> 00:06:41.299 You saw it in one of our demos earlier. 00:06:42.299 --> 00:06:44.299 But sometimes we'll just say anything management will be untagged. 00:06:45.299 --> 00:06:47.299 That's going to be the default VLAN for those interfaces. 00:06:48.299 --> 00:06:50.299 And then we're going to tag all the other VM traffic. 00:06:51.299 --> 00:06:53.299 That's one configuration you see quite a bit. 00:06:54.299 --> 00:06:59.299 If we were dealing with, say, for interfaces that are dedicated to iSCSI, we might leave them untagged. 00:06:59.299 --> 00:07:04.299 And on those interfaces on the switch, we'll say our VLAN is our default iSCSI VLAN. 00:07:05.299 --> 00:07:06.299 Maybe it's VLAN 250 or something. 00:07:07.299 --> 00:07:14.299 And we don't have to worry about adding the tags to that because we're only putting iSCSI traffic on those interfaces. 00:07:15.299 --> 00:07:16.299 We have dedicated NICs for iSCSI. 00:07:17.299 --> 00:07:22.299 We can leave the packets untagged and just have it be a default access port with a VLAN 250 configure or something like that. 00:07:23.299 --> 00:07:24.299 All right. 00:07:24.299 --> 00:07:40.299 So VLAN policies, they can be set on a distributed virtual switch at a switch level or a port group level or an individual port level and also on an uplink group level. 00:07:41.299 --> 00:07:45.299 So there's a lot of different places you can create your VLAN tags, and I'll show you how to do that in just a little bit here. 00:07:46.299 --> 00:07:55.299 So, again, if you want to set a policy that's going to apply to a group of interfaces, you can create a VLAN policy for either a port group or for an individual port. 00:07:56.299 --> 00:07:57.299 All right. 00:07:58.299 --> 00:08:04.299 So to create a policy for a distributed port group, you're just going to go to your networking menu. 00:08:05.299 --> 00:08:06.299 You'll find your distributed virtual switch. 00:08:07.299 --> 00:08:08.299 Find the port group you want to configure it for. 00:08:09.299 --> 00:08:11.299 Go to its properties, and that's one of the properties you can set on there. 00:08:11.299 --> 00:08:17.299 We can also go to individual ports and then go to edit that port, and we can choose the setting for that. 00:08:18.299 --> 00:08:19.299 And I'll show you how to do that here in just one moment. 00:08:21.299 --> 00:08:23.299 So types of VLANs, we can say none. 00:08:24.299 --> 00:08:25.299 We're not going to tag VLANs. 00:08:26.299 --> 00:08:27.299 We can say what is allowed. 00:08:28.299 --> 00:08:34.299 So, for example, we can say we want to allow an allowed or an access port would be just the default interface. 00:08:35.299 --> 00:08:37.299 Trunking means we're going to allow more than one VLAN. 00:08:37.299 --> 00:08:47.299 So if I configure an interface as an access interface, then I'm saying I'm only going to allow one VLAN, and traffic coming through will be untagged. 00:08:48.299 --> 00:08:52.299 And whatever, you know, traffic comes through here, it's going to be on VLAN 10, right? 00:08:53.299 --> 00:08:55.299 Trunking means I'm going to allow multiple VLANs. 00:08:56.299 --> 00:09:03.299 I can say I'm going to allow, as I said in the previous example, 10, 20, 30, 40, or I could say I'm going to allow, you know, 10 through 40. 00:09:04.299 --> 00:09:06.299 That would be 10, 11, 12, all the way to 40. 00:09:07.299 --> 00:09:08.299 You can do, you know, ranges like that. 00:09:09.299 --> 00:09:14.299 You can also, on a trunk port, have what's considered the default access also. 00:09:15.299 --> 00:09:24.299 So untagged packets go into that default access, and everything else has to be tagged with one of the allowed VLANs that you have specified in your allowed VLANs. 00:09:25.299 --> 00:09:27.299 In a private VLAN, we discussed that before, too. 00:09:28.299 --> 00:09:33.299 A private VLAN simply means that machines on the same VLAN can't see each other, okay? 00:09:34.299 --> 00:09:36.299 So they're really not one broadcast domain. 00:09:37.299 --> 00:09:44.299 They're all separate domains, and they can only communicate with one interface that is usually going to be linked out to, like, for example, a firewall. 00:09:45.299 --> 00:09:51.299 So if you had a bunch of machines that you didn't want to see each other, you could put them on the same private VLAN, and they won't see each other. 00:09:52.299 --> 00:09:57.299 They'll only have access out to, for example, a firewall that gets them, for example, to the Internet. 00:10:00.299 --> 00:10:05.299 So here's how, again, uplink port policies, distributed virtual switches, right? 00:10:06.299 --> 00:10:07.299 We can go to distributed virtual switch. 00:10:08.299 --> 00:10:13.299 We can go to, you know, is properties, and then we can set the tag for the VLAN on the switch level. 00:10:14.299 --> 00:10:15.299 We can also do it on a port group level. 00:10:16.299 --> 00:10:21.299 We can also do it on a port, or we can do it on a uplink port group, all right? 00:10:22.299 --> 00:10:23.299 So the uplinks are physical adapters. 00:10:24.299 --> 00:10:25.299 We're saying, like, everything goes off these adapters. 00:10:26.299 --> 00:10:28.299 We want to have tags with a certain VLAN, all right? 00:10:30.299 --> 00:10:41.299 So let's go ahead and jump back into our demo environment, and I'll show you how to add tags, VLAN tags for port groups and individual ports in a port group. 00:10:46.299 --> 00:10:48.299 So here we are in our demo environment. 00:10:49.299 --> 00:10:50.299 We're in our networking. 00:10:51.299 --> 00:10:53.299 So here we have our distributed virtual switches. 00:10:54.299 --> 00:11:04.299 I can go to my switch and say I want to go distribute, edit my settings, and you see I have, for example, different options in here that I can enable and disable. 00:11:05.299 --> 00:11:06.299 Right. 00:11:06.299 --> 00:11:12.299 I can go in and see my end-to-use size, right, what uplinks are on here, my name. 00:11:13.299 --> 00:11:14.299 Okay. 00:11:14.299 --> 00:11:20.299 If I want to use an offload card, something like that, on that distributed switch, I have my port group. 00:11:22.299 --> 00:11:23.299 I have my port group. 00:11:24.299 --> 00:11:25.299 I have my port group. 00:11:26.299 --> 00:11:27.299 I have my port group. 00:11:28.299 --> 00:11:29.299 I have my port group. 00:11:30.299 --> 00:11:36.299 I have my port group in edit settings here. 00:11:38.299 --> 00:11:43.299 And for VLAN, I can go in and say I want to allow, you know, VLAN 10. 00:11:43.299 --> 00:11:45.299 I can change it to VLAN, you know, 220. 00:11:46.299 --> 00:11:47.299 I can also say a range. 00:11:47.299 --> 00:11:55.299 I want to allow 220 through 225, which means I'll allow 220, 221, 222, and so on, and I can apply that and say okay to that. 00:11:56.299 --> 00:11:59.299 Now, I also have these ports here. 00:12:00.299 --> 00:12:09.299 I can go to a port and say I want to edit, but you'll notice pretty quick I can't choose to overwrite these settings. 00:12:11.299 --> 00:12:17.299 If I want to overwrite settings on individual ports, the port group has to allow that. 00:12:18.299 --> 00:12:28.299 So, I have to go to my advanced and say for VLANs, I want to allow override policies, or for traffic shaping, I want to allow override policies. 00:12:29.299 --> 00:12:30.299 Okay, same thing for each of these. 00:12:31.299 --> 00:12:32.299 So, I'm going to go ahead and say okay to that. 00:12:34.299 --> 00:12:43.299 Now, if I go back to the same port and I go to VLANs, I can override that, right? 00:12:44.299 --> 00:12:49.299 And instead of being a trunk, I can say it's a VLAN and I want to allow VLAN 20. 00:12:51.299 --> 00:13:05.299 I do the traffic shaping, and I enabled overwriting for traffic shaping, and I can say instead of being the default disabled, I'm going to enable it and set what I want traffic shaping to be for this specific port in that port group, right? 00:13:06.299 --> 00:13:09.299 So, I can set it, you know, in multiple places I can set these VLAN tags. 00:13:10.299 --> 00:13:13.299 It's not, you know, that often you'll set it at the port level. 00:13:14.299 --> 00:13:21.299 If I am setting it at the port level, then I probably have my settings set as ephemeral, right? 00:13:22.299 --> 00:13:23.299 I'm sorry, not ephemeral. 00:13:23.299 --> 00:13:24.299 It's going to be static binding. 00:13:24.299 --> 00:13:26.299 Ephemeral means that the VMs can change back and forth. 00:13:27.299 --> 00:13:34.299 If I'm doing static binding, that means that I probably will end up doing per port or could end up doing per port settings. 00:13:35.299 --> 00:13:50.299 You probably won't do per port settings if you have ephemeral where when the VM shuts down, it releases that port because then that means I don't know what could land there next and then some random machine could get those settings, and that could obviously not be, you know, very positive for my networking environment. 00:13:51.299 --> 00:13:52.299 All right. 00:13:52.299 --> 00:13:57.299 So, that's the conclusion of configuring distributed virtual switches and standard switches.