1

I have a pfsense appliance that serves as my router. I have four hypervisors that I want to hook up to one of the router interfaces through a switch. The hypervisors will house multiple VMs that are "bridged" to the router interface.

WAN Network

router ⇆ switch ⇆ 4 hypervisor ports (hosting up to 16 VMs at a time)

WLAN Network

  • Should I get a smart switch and create VLANs to segment the hypervisor network?
  • OR Should I set-up VLANs from the router interface? In this case will all inter-hypervisor traffic be routed through the switch or the router?
  • Will the network scale well if I add more hypervisors?

Thank you.

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:25
2

Should I get a smart switch and create VLANs to segment the hypervisor network?

Yes, if you need to segment the VMs for security or QoS. Or if you have an MPLS network. But if not, then no. A smart (managed) switch will let you monitor performance in either case, if that's important to you.

OR Should I set-up VLANs from the router interface? In this case will all inter-> hypervisor traffic be routed through the switch or the router?

It's not either/or. If you create VLANs, then you will have to set them up on the router interface.

Will the network scale well if I add more hypervisors?

Impossible to tell without knowing more details about your network: Device types, WAN bandwidth, expected performance, etc.

1

Using a managed switch with VLAN trunking to the hypervisors and the router is essential for a flexible and secure zoning setup.

The only physical alternative would be using dedicated NICs for each zone in the hypervisor and separate switches (this won't scale well).

Another, virtual alternative would be to use routing within the hypervisors - connect the VMs to internal-only port groups and route/filter them with a virtual pfSense (or similar) to the physical NIC. This variant potentially scales better when you have a lot of hypervisor-interal, inter-VM traffic. Additionally, you could control zoning on the hypervisors, requiring only a simple, routed link between the virtual routers and the external router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.