VM Port Group: How to prevent vLAN cross talk inside of a VM across Virtual Nics
Deathmage
Banned Posts: 2,496
Hey guys,
So I've run into a small issue, I have setup a VM which crosses into 3 different Port Groups each with there own vLAN and IP scheme. However one of the Port Groups is the primary connection for Active Directories DNS. But for whatever reason the traffic is preferred over the other Port Groups whenever I do a ping in cmd of the device on a different VM with the same Port Group setup while I just want it to go over the DNS linked Port Group interface.
Is there a way to make a Port Group the primary interface for that VM and make all the others just sit there and be accessible to the other devices in those Port Group vLAN's.
Curious if anyone ever knows what I'm referring too..
So I've run into a small issue, I have setup a VM which crosses into 3 different Port Groups each with there own vLAN and IP scheme. However one of the Port Groups is the primary connection for Active Directories DNS. But for whatever reason the traffic is preferred over the other Port Groups whenever I do a ping in cmd of the device on a different VM with the same Port Group setup while I just want it to go over the DNS linked Port Group interface.
Is there a way to make a Port Group the primary interface for that VM and make all the others just sit there and be accessible to the other devices in those Port Group vLAN's.
Curious if anyone ever knows what I'm referring too..
Comments
-
blargoe
Member Posts: 4,174 ■■■■■■■■■□
Unless I'm missing something, I think your only option here would be the routing configuration inside the guest OS of your VM.
I.e, set up a persistent static route in the guest OS for that AD/DNS subnet, or make that network's gateway your default gateway.IT guy since 12/00
Recent: 11/2019 - RHCSA (RHEL 7); 2/2019 - Updated VCP to 6.5 (just a few days before VMware discontinued the re-cert policy...)
Working on: RHCE/Ansible
Future: Probably continued Red Hat Immersion, Possibly VCAP Design, or maybe a completely different path. Depends on job demands... -
iBrokeIT
Member Posts: 1,318 ■■■■■■■■■□
I have setup a VM which crosses into 3 different Port Groups each with there own vLAN and IP scheme.
If the VM isn't a router or contains some sort of routing software then this sounds like poor design, especially for a domain controller!
You can manually set metics on your TCP/IP interfaces and then like blargoe mentioned, set static routes.2019: GPEN | GCFE | GXPN | GICSP | CySA+
2020: GCIP | GCIA
2021: GRID | GDSA | Pentest+
2022: GMON | GDAT
2023: GREM | GSE | GCFA
WGU BS IT-NA | SANS Grad Cert: PT&EH | SANS Grad Cert: ICS Security | SANS Grad Cert: Cyber Defense Ops | SANS Grad Cert: Incident Response -
Deathmage
Banned Posts: 2,496
If the VM isn't a router or contains some sort of routing software then this sounds like poor design, especially for a domain controller!
You can manually set metics on your TCP/IP interfaces and then like blargoe mentioned, set static routes.
it's basically like this:
So say this was a Terminal Server, and it had two Virtual Nic's. Say one Port Group is for normal server traffic on a server vlan, one Port Group is for Backups on another vlan in a OOB fabric. Both of which are on Etherchannel's with properly flowing and configured network-layer fabric.
What I'm running into, probably lack there of in the form of knowledge of this type of setup (I will blatantly admit this), is if I setup servers on the Backups vLAN by assigning this vLAN to a say a Port Group with a vLAN ID of say 400 to the virtual nic, what I'm running into is the fact it's completely random on each VM but some prefer the server vLAN'd virtual nic IP address with a ping and other prefers the Backups vLAN IP address when pinging across servers that have the same configuration, it's essentially staying at Layer 2 switching. When this happens, as we all know is it essentially disconnects it from the network unwillingly.
As for persistent routes, I'll give that a go. it may-be the only thing I can do in this type of setup.
As for wrong design probably, never did this before with 3 Virtual Nics, if you have suggestions I humbly appreciate them or maybe a known resource on this topic that others have done.
I mean I've done this with a normal Nic's in Windows XP, just been ages since I've touched persistent routes in Windows... -
Deathmage
Banned Posts: 2,496
Unless I'm missing something, I think your only option here would be the routing configuration inside the guest OS of your VM.
I.e, set up a persistent static route in the guest OS for that AD/DNS subnet, or make that network's gateway your default gateway.
That worked, been sooo long (5+ years) since I've done persistent routes inside of Windows, literally forgot about it....
Added it to the virtual interface's too and that helped, and the -p, as I remember was needed. -
jibbajabba
Member Posts: 4,317 ■■■■■■■■□□
and the -p, as I remember was needed.
Only if you want the route to stick around after a reboot
My own knowledge base made public: http://open902.com -
Deathmage
Banned Posts: 2,496
jibbajabba wrote: »Only if you want the route to stick around after a reboot
I know.... rather not have a reboot some morning a few months down the road and things stop working and people start flipping out.... the obvious of persistent routes would be my luck the last thing I'd troubleshoot.... just safer this way
