Difference between VM and VMkernel portgroups?

[bhaskardixit]

I have confusion about Virtual Machine Port group & VMkernal Port.

What are difference between both and what kind of functions is provided by these both.

[vmroyale]

Note: Discussion successfully moved from 3. Network Considerations and Best Practices to VMware vSphere™ vNetwork

Virtual machine networking is used to provide network access for virtual machines only.

VMkernel networking provides access for host-based operations like ESXi management, IP storage, vMotion, FT.

I find it easiest to think VMkernel is host and virtual machine is virtual machine.

[rickardnobel]

Note: Discussion renamed from "Hi dear Ali" to "Difference between VM and VMkernel portgroups". :smileyhappy:

I think of the VMkernel ports as virtual network cards connected to the hypervisor itself. On these virtual NICs you could set IP addresses and then use them for Management, vMotion and connecting to IP based storage.

The VM portgroups attaches to virtual network cards to the Virtual Machines and does look like a normal NIC inside the guest operating system.

[bhaskardixit]

Thank you Reckard & VMroyale,

can you give me a description about the burst size, and if burst size the define the limit of user usage then what is use of peak.

[rickardnobel]

If you are thinking of bandwidth shaping then you have an average bandwidth which could be for example 10 Mbit per second. You can also set that it is allowed to go up to say 20 Mbit/s, but only use this higher speed for a certain number of bytes, for example 50 MB of traffic.

[bhaskardixit]

Thanks Mr. Rickard,

Actually I am trying to learn vmware, & I have some more doubt. May I ask here? or I will have to create new discussion. please tell me about this also,

Now My question is about security policy 1- Promiscuous mode, 2- MAC Address Changes, 3- Forged Transmits

as I know about the promiscuous mode, if I set it in ACCEPT condition then all packets in switch or particular port group will transmitted to specific port, it could be useful if I have any monitoring software on that specific VM, here my doubt is:- which port will be responsible for recieving those packets.

Please give more information about other two also.

Thanks

[rickardnobel]

bhaskardixit wrote:

as I know about the promiscuous mode, if I set it in ACCEPT condition then all packets in switch or particular port group will transmitted to specific port, it could be useful if I have any monitoring software on that specific VM, here my doubt is:- which port will be responsible for recieving those packets.

In general it is better to create new threads when the topics of the question changes, it will be easier for other people later on to find answers.

For your specific question, if I understand it correctely, is that if a portgroup has Promiscous = Accept then any VM in the portgroup could see all other traffic from other VMs and outside frames. However, the Vmkernel will not forward these frames if not the network card inside the VM is put into Promiscous Mode. This is typically done while starting a sniffer tool, e.g. Wireshark.

For best security I recommend to put the sniffer VM alone on a portgroup with Promiscous = Accept, but with the same VLAN id as the VMs that we want to monitor. This will limit this possibility to just that VM.

[bhaskardixit]

OK, Thank you

One more stupid question is here, Then I will create new one discussion,

please see the snapshot, I have two portgroup. my virtual machine (Bhaskar1) is connected with one port group named as "VM network".

Now I want to move it to another port group named as "Just for Practicle", which is in same vSwitch.

How can I do it?

[rickardnobel]

Just go the VM, edit settings, Network card and then select the new portgroup. :smileyhappy: