Help with esxi mangement
-
Hello new to the forum so please excuse my ignorance that maybe forth coming. I have pfsense setup as my main router (router on a stick configuration). I would like to go virtual with pfsense to allow me to basically create a security server to experiment with. Possibility of running something like security onion along side it. But the part that I can't wrap my head around is how to manage the esxi host if pfsense is my my edge router. Currently I have a few vlans setup that pfsense is managing. Not sure what information you may need about my install to help answer this question. Maybe I missed a post in the forums somewhere that answers my question? Any help would be appreciated.
-
You end up directly connecting one of your hypervisor NICs to the public Internet. You set up a vSwitch for WAN and LAN. Assign one of your hypervisor NICs to that switch and another one to the LAN switch.
https://doc.pfsense.org/index.php/PfSense_2_on_VMware_ESXi_5
-
Thanks for your reply, I think it has sunk in. 2 switchs and assign the esx management an ip on the lan switch. If I understand right then easy enough.
Does it matter that the lan is 192.168.1.* and then my vlans change over to 10.... Just assign it an ip on the 192.168.1. address and it should work?
-
I don't have any experience with ESXi, pfSense and VLANs unfortunately so I can't guide you in that area.
-
If possible you would put your vmkern on its own physical interface in esxi, even if same network as your lan. Sharing same vswitch and physical nic as lan going to be a hit on vmkern performance moving files to and from the datastore.
And in a perfect world your vmkern would be on its own network isolated from your lan so that only management box(es) can access.
-
Thanks for the reply johnpoz. Yes, I well agree with you about splitting up traffic; managmenet vmnic0, iSCSI traffic vmnic1, etc.. and this now makes sense. In a worst case scenario, one could literately could jack into the esxi server through the dedicated nic. I am thinking in my configuration where pfsense actually brings up the entire network. I am an idiot, 2 labs servers setup this exact way but I could not see the trees through the forest. The rest is just virtual switch's to port the lan of pfsense into security onion and then out to the actual lan nic. I am just wondering if 802.1q is going to be lost going through security onion. Well, in any case thanks for all the help, a new project is on the horizon.
