1

Here's my network topology:

enter image description here

WHAT I WANT OT ACHIEVE: access virtual machines from remote network, be able to manage them through vCenter Server, run them, and see vms consoles (what's happening inside every vm, as I can see this in my local network).

WHAT I HAVE SO FAR: at the moment Im able to successfully connect from my computer in the remote network to vCenter Server, which is a virtual machine on one of my ESXi hosts. vCenter Server is the VM on ESXi 1, its IP address is 172.16.254.112/24.

WHAT I DID: I forwarded some ports on my JSRX router, forwarded 1.1.1.2:443 to 172.16.254.112:443, used this:

edit security
set zones security-zone trust address-book address accessvsphere 172.16.254.112/32
exit

edit security policies from-zone untrust to-zone trust
set policy vspherepolicy match source-address any destination-address [ accessvsphere ] application any
set policy vspherepolicy then permit
exit

edit security nat destination
set pool dst-nat-pool-vsphere address 172.16.254.112 port 443
set rule-set rs1 from zone untrust
set rule-set rs1 rule myrule1 match destination-address 1.1.1.2
set rule-set rs1 rule myrule1 match destination-port 443
set rule-set rs1 rule myrule1 then destination-nat pool dst-nat-pool-vsphere
exit

edit security nat
set proxy-arp interface ge-0/0/0.0 address 1.1.1.2

And it works great, I can connect to vCenter Server, but then I try to launch virtual machine, I see only black screen and the message: Unable to connect to the MKS: Failed to connect to server 172.16.254.11:902.

I read that vCenter Server need also port 902 and 903 for full connectivity but have no idea how to do this further. Which ports I need to forward, and - how?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 10, 2017 at 3:29

2 Answers 2

Reset to default
3

You cannot do this through NAT. When you connect to the VM console, the traffic goes to the server running the VM, not vCenter. And it's going to get the "inside" address relative to vCenter, not the "outside" address you need.

Improve this answer
6
  • So what do I need to be able to make such connection? I dont need to forward ports 902 and 903 on my JSRX? Im very new to networking, thanks for help :)
    – mirx
    Commented Mar 25, 2014 at 19:56
  • What he is saying is that this would be very difficult to setup as you have a NAT rule to point inbound traffic to the vCenter server but the Console connections come from the host itself. Currently the outbound console traffic is not being routed and translated to your remote machine which results in the MKS error and the connection timing out. Attempting to setup NAT rules for this would be difficult and most likely result in more problems than it solves. I would highly recommend a VPN connection to accomplish this as other options open up more security holes in your firewall.
    – Mike Naylor
    Commented Mar 25, 2014 at 21:01
  • @Mike, more than that... It. Cannot. Be. Done. vCenter is going to provide the local address of the esx server, which is NOT the address to which he needs to connect. This is communicated through an SSL connection were it cannot be rewritten. The only solution is to be in the LAN (directly, vpn, or using global addresses) with the servers.
    – Ricky
    Commented Mar 25, 2014 at 22:05
  • @RickyBeam: Ok thanks guyz but I need a little more help with this :) I understand that I need to setup VPN client on the computer in the remote network (lets say, its VPN IP: 10.8.0.2) and VPN server on the same virtual machine where I have my vCenter Server istalled? (lets say, 10.8.0.1). And when I setup such connection should I do a port forwarding, 10.8.0.2:443 -> 10.8.0.1:443? Will it be enough for this to work as I want?
    – mirx
    Commented Mar 26, 2014 at 7:47
  • @MikeNaylor: just another noob question: I know that its possible to setup VPN on JSRX - never done this before but will this be good for my needs? Found this art: juniper.net/techpubs/en_US/junos12.1x44/topics/example/…
    – mirx
    Commented Mar 26, 2014 at 8:26
0

You can use a web client to do this. NAT you'r public IP address to VCenter web client's IP address and connect to web client using web browser. Add Vcenter Host name to your 'host' file with public IP.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.