Site icon Virtual Maestro

Uncovering Virtual Networking Part-3: Policy inheritance

Abhijeet D
Advertisements

Here is another instalment in this series. In my last post Part2: Virtual Switches, we discussed about switch types in vSphere. Now with this post we are entering into switch configurations and policies. Before I talk about these settings and policies in detail individually in later posts, in this post, first of all we will explore and discuss switch properties, Portgroup properties, parent child relationships and so on. This is necessary as before discussing setting up policies and settings. We need to understand how to access these policies options and where to configure them?

Though we already discussed, switches in previous post, let’s recap components in virtual switches (vSS/vDS) quickly again.

So we have Port groups, VMKernel ports and uplink port. That is all. Nothing complicated. By now we know from previous posts, what are these component and what they are used for.

Just FYI, in Standard switch we use term portgroup and in DVS we simply refer them as dv-portgroup. This does not change the concept what port groups are. They may differ in feature set that is due to the fact that they belong to their respective switch type.

Let us see quickly how to access switch properties and portgroup properties. Why?

We need to understand parent child relationship in virtual switches. Since all the policies are configured with this relationship taken into account. We cannot simply enable policies on switches only or just portgroup.

Accessing standard Switch Properties

Accessing portgroup properties on standard switch.

We will discuss standard switch and portgroup properties shortly. As of now let’s keep it to accessing properties.

Accessing DVS and it’s portgroup properties.

DVS portgroup properties

That’s how we access switch properties and portgroup properties for standard switch and DVS.

So what do we get to set once accessed the properties?

NOTE

Here we will be looking at the options we get in brief details. We will not dive into them in-depth in this post. I will discuss these settings in-depth in respective posts separately.

Standard Switch (vSS)

Let’s look at properties of a standard Switch.

I missed screenshot here, don’t worry you’ll see at portgroup level.

Load balancing

We will discuss these policies in another post. Now let’s see what we get in portgroup properties.

vSS portgroup properties

Great, these are the options under standard switches and their port groups. As you can notice, there is parent Child relationship between them as port groups are inheriting the settings of virtual standard switch with port groups allowing to override the parent settings.

Now let’s look at DVS and dv-portgroups settings.

Distributed Switches

All the policies and settings that we saw in standard switch are available in DVS. But there is a caveat here. Let’s see what it is.

Multicast filtering modes

There are two modes in multicast filtering as follows.

The distributed switch forwards traffic that is related to a multicast group based on a MAC address generated from the last 23 bits of the IPv4 address of the group.

The distributed switch forwards multicast traffic to VMs according to IPv4 and IPv6 addresses of subscribed multicast groups by using membership messages defined by the IGMP and Multicast Listener Discovery protocol.

Discovery Protocols

If you compare these settings to standard switch, it may appear that DVS does not have much settings available at switch level.

Now you may also be curious, what happened to all those policies since I also mentioned that DVS has all policies of standard switch.

Let’s explore more to understand how.

DVS portgroup

On the dv-portgroup properties page, we see similar names that we saw earlier in standard switches. But we can see bunch of new options as well.

Interestingly enough, you did not see override checkmark on port groups here in DVS. Does that mean dv-Portgroup acts as parent?

Of course it acts as parent. But then who is acting as a child? Curious again?

So in DVS, it offers management granularity unlike standard switch. In DVS, portgroup acts as parent and every individual port will act as child. ***

How does that offer granularity?

You can configure all these policy settings we talked about per individual port in DVS. That offers excellent design possibilities and control over virtual network. In standard switches, max granularity we have till portgroup level, we cannot access ports in vSS. ***

Let’s see individual port properties now.

Port properties in DVS

I will not re-write options details below as they are same to dv-portgroup and settings will be inherited from dv-portgroup.

As you can see, for each port, we can define different set of policies by overriding parent policies.

Conclusion

We have various options when it comes to setting networking policies. We can set them on Switch level or at port group level in standard switches. For DVS, We can set them at Portgroup level or at individual port level. Understand the parent child inheritance properties.

Set your policies correctly and at correct place.

That is all for this post. I hope it’s informative. Check next post in this series here Part 4: Promiscuous mode

!!!Cheers!!!

Do share, like, comment if you find it helpful.

Exit mobile version