Private VLAN in VMware - PVLANs
PVLANs allow you to isolate traffic between VMs in the same VLAN. The main purpose of this network setup is to create additional security amongst the VMs on the same VLAN. Concept of PVLAN also resolves the VLAN ID limitations. This setup is commonly used to provide security for servers in DMZ. For eg: If we have MOSS servers and Exchange servers in DMZ, with the help of PVLAN we could prevent any communication between these servers. So any intruder who hacked on to the exchange server will not have any access to the MOSS server.
In short, PVLAN is a network setup that is used to logically divide the VLAN( Primary VLAN) into secondary VLANs.
3 Types of PVLANs
Promiscuous PVLAN
Virtual Machines in these PVLANs can communicate with any machines in the same primary VLAN.
Community PVLAN
Virtual Machines in these PVLANs can communicate with eachother and with the any virtual machines in the Promiscuous PVLAN.
Isolated PVLAN
Virtual Machines in these PVLANs can communicate only with the machines in the Promiscuous PVLAN. Please note that in an isolated PVLAN , even the communication of virtual machines in the same PVLAN is denied.
To use private VLANs between an ESXi host and the rest of the network, the physical switch connected to ESXi host must be PVLAN capable and configured with the VLAN IDs used by ESXi for PVLAN functionality. When we create a primary PVLAN, a secondary PVLAN with the same PVLAN ID will be created. This secondary PVLAN will be a promiscuous PVLAN. Once a primary PVLAN is created , we could create secondary PVLANs with the desired PVLAN ID and mark it as either Isolated or Community PVLAN. PVLANs could be created only in a distributed switch.
This is a VMware proprietary image
In short, PVLAN is a network setup that is used to logically divide the VLAN( Primary VLAN) into secondary VLANs.
3 Types of PVLANs
Promiscuous PVLAN
Virtual Machines in these PVLANs can communicate with any machines in the same primary VLAN.
Community PVLAN
Virtual Machines in these PVLANs can communicate with eachother and with the any virtual machines in the Promiscuous PVLAN.
Isolated PVLAN
Virtual Machines in these PVLANs can communicate only with the machines in the Promiscuous PVLAN. Please note that in an isolated PVLAN , even the communication of virtual machines in the same PVLAN is denied.
To use private VLANs between an ESXi host and the rest of the network, the physical switch connected to ESXi host must be PVLAN capable and configured with the VLAN IDs used by ESXi for PVLAN functionality. When we create a primary PVLAN, a secondary PVLAN with the same PVLAN ID will be created. This secondary PVLAN will be a promiscuous PVLAN. Once a primary PVLAN is created , we could create secondary PVLANs with the desired PVLAN ID and mark it as either Isolated or Community PVLAN. PVLANs could be created only in a distributed switch.
Comments
Post a Comment