Mirror production network into a lab tenant?

[KVS7]

This is in relation to a LAB I'm building to test produciton systems in a sandbox by cloning the VM and migrating from production ESXi host to the lab ESXi host within the same vCenter. The other host has its own VMM domain (vDS) and a pair of disjoint L2 uplinks to another port on the leaf switch (not going out the production vPC port channel). Management is still on production of course. The goal is to be able to mirror bridge domains and EPGs so I can spin up DCs and other production systems to simulate the production network but in a lab environment where the IP addresses are the same but not conflicting.

I created a basic lab tenant so I can create a LAB EPG for the new disjoint L2 uplinks on the LAB hosts.

1. What is the order of operations?

I'm guessing it will be something like this.

1. Create a jump box that you can reach through the production network with an extra NIC connected to the LAB environment.

2. Create a new Tenant

3. Create a new Bridge Domain within the new tenant with the same subnet and VLAN as the production network.

4. Configure an EPG

5. Clone VMs from the same EPG and migrate to LAB tenant, configure VM networking to use the new network. 

[AshSe · Accepted solution]

Hello @KVS7 

Your plan for building a lab environment to mirror production systems while maintaining the same IP addresses but avoiding conflicts is solid. However, there are a few nuances and considerations to ensure the setup works as intended. Below, I'll refine your order of operations and provide additional details to help you achieve your goal.

Refined Order of Operations

1. Create a Jump Box for Access

   • Set up a jump box (or bastion host) that can be accessed from the production network. This jump box should have:
     • One NIC connected to the production network for management access.
     • A second NIC connected to the LAB environment to allow you to manage and access the LAB systems.
     • Ensure the jump box has proper routing and firewall rules to allow access to both environments without causing conflicts.

2. Create a New Tenant for the LAB Environment

   • In the ACI fabric, create a new tenant specifically for the LAB environment. This tenant will isolate the LAB network from the production network.
   • Name the tenant something descriptive, like LAB_Tenant, to avoid confusion.

3. Create a New Bridge Domain (BD)

   • Within the LAB tenant, create a new Bridge Domain (BD) that mirrors the production BD. Use the same subnet and VLAN ID as the production network.
   • Important: Ensure the BD in the LAB tenant is isolated from the production BD. This can be achieved by:
     • Disabling L3 Out or external connectivity for the LAB BD.
     • Ensuring the LAB BD does not advertise routes to the production network.
     • Enable ARP Flooding and Unknown Unicast Flooding in the BD if required for your specific use case (e.g., if you have legacy systems or specific broadcast/multicast requirements).

4. Create an Application Profile and EPG

   • Create an Application Profile within the LAB tenant.
   • Create an Endpoint Group (EPG) under the Application Profile. This EPG will be associated with the LAB BD and will represent the LAB network.
   • Map the EPG to the VLAN used by the LAB environment on the disjoint L2 uplinks.

5. Configure the LAB Host Networking

   • On the LAB ESXi host:
     • Create a new vSwitch or vDS (vSphere Distributed Switch) for the LAB environment.
     • Configure the uplinks on the LAB host to connect to the disjoint L2 ports on the ACI leaf switches.
     • Ensure the LAB vSwitch/vDS is mapped to the VLAN used by the LAB EPG.
   • Verify that the LAB host's uplinks are not part of the production vPC port channel to avoid any conflicts.

6. Clone and Migrate VMs

   • Clone the VMs from the production environment and migrate them to the LAB ESXi host.
   • During the migration, ensure the VMs are connected to the LAB vSwitch/vDS and the LAB EPG.
   • Update the VM network adapter settings to use the LAB network (same VLAN and IP addresses as production).

7. Test Connectivity

   • From the jump box, test connectivity to the LAB VMs to ensure they are reachable and isolated from the production network.
   • Verify that the LAB VMs can communicate with each other as expected within the LAB environment.

8. Optional: Configure Contracts (if needed)

   • If you need to control communication between different EPGs in the LAB tenant, configure contracts to allow or deny specific traffic flows.
   • For example, if you have multiple EPGs in the LAB tenant (e.g., for different application tiers), you may need to define contracts to allow communication between them.

Additional Considerations

1. Isolation from Production

   • Ensure that the LAB environment is completely isolated from the production network at Layer 2 and Layer 3. This prevents IP conflicts and unintended traffic between the two environments.
   • Use disjoint L2 uplinks and separate VLANs to achieve this isolation.

2. Management Network

   • Since the LAB ESXi host's management interface is still on the production network, ensure that the management traffic does not interfere with the LAB environment. This is typically not an issue, but it's worth verifying.

3. Routing and Overlapping IPs

   • If the LAB environment needs to communicate with external systems (e.g., for updates or testing), consider using NAT or a dedicated L3 Out for the LAB tenant. This ensures that overlapping IPs do not cause routing issues.

4. Performance and Resource Allocation

   • Ensure the LAB ESXi host has sufficient resources (CPU, memory, storage) to handle the cloned VMs. Performance in the LAB environment may differ from production, so plan accordingly.

5. Testing and Validation

   • Before deploying the full LAB environment, test with a small subset of VMs to validate the configuration and ensure there are no conflicts or connectivity issues.

---

Final Notes

Your approach is well thought out, and with the refinements above, you should be able to successfully build a LAB environment that mirrors your production network. The key is to maintain strict isolation between the LAB and production environments while ensuring the LAB environment is functional and accessible for testing.

[KVS7]

Thanks Ash, that happens to be everything I've done except instead of using the jump box, we used the VRMC for direct access to the lab VMs which works for now.