03-29-2017 05:54 PM - modifié 03-01-2019 01:08 PM
Hi,
This is a configuration guidance questions so hoping someone can assist.
We are in the process of migrating our internal environment onto UCS environment shared with our Hosting/Customer environment. Unfortunately there are VLAN conflicts so we are hoping to workaround this rather than resolving the actual conflicts.
The current plan is as follows.
Implement new Nexus switching and create dedicated port channels for the internal environment. These switches will deal with all the internal VLANs while the existing switches deal with the hosting/customer VLANs. Basically we are separating the VLAN conflicts using different port channels.
My question is will this actually work? On the Fabric Interconnects there is a Global VLAN list so I'm worried the network traffic will get confused on the interconnects and not know which port channel to push the communication up since the conflicting VLANs will exist on both. A colleague suggested looking into VLAN Pin groups and tieing the VLANs to specific vNic's but I've never used Pin groups so don't want to waste time looking at this if it won't work anyway.
Appreciate any thoughts or suggestions from someone who has dealt with a similar situation in the past.
Thanks.
Résolu ! Accéder à la solution.
le 03-29-2017 06:04 PM
Hello,
If I understand correctly, you want to pin and allow certain VLANs on network uplinks, while allowing other VLANs on another segmented layer 2 network uplink? You will want to utilize disjointed layer 2 to accomplish this. UCS will pin vNICs only to network uplinks that satisfy all of the VLANs defined on that vNIC.
http://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/unified-computing/white_paper_c11-692008.html
HTH,
Wes
le 03-30-2017 04:06 AM
Greetings.
If your individual tenants have blade level control/ownership, then the blades and OSs running on them, that share the same vlans, are going to see each others broadcast & arp traffic, and ability to contact each other (not withstanding individual blade OS firewall implementations) >>>This is something you already realize, and why you created this post.
We see customers needed to deploy multi-tenant type configurations similar to yours, using private vlans to segregate individual tenants.
There are limitations, and private vlans don't always fit all requirements.
Thanks,
Kirk...
le 03-29-2017 06:04 PM
Hello,
If I understand correctly, you want to pin and allow certain VLANs on network uplinks, while allowing other VLANs on another segmented layer 2 network uplink? You will want to utilize disjointed layer 2 to accomplish this. UCS will pin vNICs only to network uplinks that satisfy all of the VLANs defined on that vNIC.
http://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/unified-computing/white_paper_c11-692008.html
HTH,
Wes
le 03-29-2017 06:59 PM
Hi Wesley,
Thanks very much for the quick response.
I'm trying to find a way to have overlapping/conflicting VLANs present on the fabric interconnects yet have functional networks presented up.
I was told that this can be done by pinning vNICs to certain uplinks like you mentioned. I will read through the article you linked in more depth, my only concern is that it says 'this scenario assumes no overlapping VLANs are present' and I want then present.
le 03-29-2017 08:37 PM
Greetings.
Like Wes has mentioned, UCSM won't let you have overlapping vlans on the UCSM configuration. Having your upstream switch port vlan config not configured the same as your UCSM, will result in potential designated receiver issues, which will negativelly impact broadcasts, arp, etc.
Maybe it would be easier if you draw a pic of what you are intending, and label where vlans are, and aren't allowed on UCSM uplink ports as well as the upstream switch, and we can confirm if your intended config will work or not (I'm guessing it won't).
Thanks,
Kirk...
le 03-29-2017 09:43 PM
Hi Kirk,
Thanks for your response, as this is a multi tenancy environment there are overlapping VLANs and there will continue to be overlaps created as the various tenants have their own VLAN schemas.
Here's a diagram of what we are needing to implement. Could you please take a look and let me know what the solution would be for an environment such as ours ie. multi tenanted. From our perspective the only place the VLAN's will overlap is at the fabric interconnects because that's where they are presented to the blades. Tenant 1's VLANs will never be presented to the Tenant 2 port channel or to any Tenant 2 blades/templates etc.
Thanks.
le 03-30-2017 04:06 AM
Greetings.
If your individual tenants have blade level control/ownership, then the blades and OSs running on them, that share the same vlans, are going to see each others broadcast & arp traffic, and ability to contact each other (not withstanding individual blade OS firewall implementations) >>>This is something you already realize, and why you created this post.
We see customers needed to deploy multi-tenant type configurations similar to yours, using private vlans to segregate individual tenants.
There are limitations, and private vlans don't always fit all requirements.
Thanks,
Kirk...
le 03-30-2017 08:05 PM
Thanks very much for the advice, will look into private vlans.
Découvrez et enregistrez vos notes préférées. Revenez pour trouver les réponses d'experts, des guides étape par étape, des sujets récents et bien plus encore.
Êtes-vous nouveau ici? Commencez par ces conseils. Comment utiliser la communauté Guide pour les nouveaux membres