Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 11753 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG and VLAN under Hyper-V or vSphere

Tobias_F

Hello,

I am Home User and I am running XG in a virtualized environment with VLAN network structure. I am running Hyper-V 2016 but my question is generic and also refers to Vsphere that I was running before migration to Hyper-V. The physical Box has two NIC where one is dedicated to WAN (PPPoE) and the other one is a VLAN connecting several internal networks (LAN, WLAN, DMZ) in Hyper-V as well physical ones connected via VLAN capable physical switch.

What is the better way for VLAN set-up to XG in virtualized environment (Hyper-V)?

  • creating e separate virtual NIC on Hyper-V and doing VLAN tagging on Hyper-V switch?
  • having only one virtual NIC on Hyper-V and doing VLAN tagging on XG by creating VLAN network interfaces for each network

Technically both is possible. But what are the advantages or disadvantages between both ways?

Thanks.



This thread was automatically locked due to age.
Parents
  • +1

    My preference is the second option - one virtual NIC on Hyper-V and trunk everything over that. Especially if your Hyper-V only has the one physical adapter (like my Intel NUC).

    There area  few limitations under XG that make this less than ideal for your WAN interface though (I can't tell from your post if you want to combine the WAN interface as a VLAN in the new setup):

    • When doing initial config, XG assumes you have a LAN and a WAN interface and while it's possible to get through the registration/synchronisation process with a bit of creativity, it's a pain
    • MTU is set on the physical NIC, so if you need to set a lower MTU on an interface (common for a WAN interface if it's PPPoE) you won't be able to. You can't even set an MSS mangle rule.

    The disadvantages for splitting out all the VLAN's into separate virtual NIC's are:

    • Adding a new VLAN to your network later is harder. A reboot is probably required after adding the virtual NIC to get XG to recognise it (i'm guessing - i've not tested this)
    • There is a limit to the number of virtual NIC's you can have in a VM. It was 8 in previous editions of Hyper-V, and i've not heard that it has increased.

    I'd go with 1 virtual interface for each WAN link, and 1 for everything else.

    James

Reply
  • +1

    My preference is the second option - one virtual NIC on Hyper-V and trunk everything over that. Especially if your Hyper-V only has the one physical adapter (like my Intel NUC).

    There area  few limitations under XG that make this less than ideal for your WAN interface though (I can't tell from your post if you want to combine the WAN interface as a VLAN in the new setup):

    • When doing initial config, XG assumes you have a LAN and a WAN interface and while it's possible to get through the registration/synchronisation process with a bit of creativity, it's a pain
    • MTU is set on the physical NIC, so if you need to set a lower MTU on an interface (common for a WAN interface if it's PPPoE) you won't be able to. You can't even set an MSS mangle rule.

    The disadvantages for splitting out all the VLAN's into separate virtual NIC's are:

    • Adding a new VLAN to your network later is harder. A reboot is probably required after adding the virtual NIC to get XG to recognise it (i'm guessing - i've not tested this)
    • There is a limit to the number of virtual NIC's you can have in a VM. It was 8 in previous editions of Hyper-V, and i've not heard that it has increased.

    I'd go with 1 virtual interface for each WAN link, and 1 for everything else.

    James

Children
  • 0 in reply to jamesharper

    There was a typing mistake in my post. I corrected. One of the two physical nics is connected to WAN with PPPoE. WAN has separte vswitch in Hyper-V and is connected to the WAN interface in XG. So, all my questions are not related to the WAN network. 

    All other networks (LAN, WLAN, DMZ) are connected via the 2nd physical nic and a VLAN capable physical switch as well inside Hyper-V via a vswitch by using VLAN tagging.

    Beside some minor points I found in the answers so far it seems to be that there are no major aspects for the one or the other solution out of my original post.

    • limitation number of vswitch in Hyper-V 
      --> Not relevant for me as Home user
    • No posibility of creating VLAN in XG without having IP on LAN.
      --> This is the reason why so far I havn't do it. I do not understand the philosophy of the XG developers for this limitatiion.
    • Reboot required in case of solution with more virtual nics in Hyper-V
      --> Not relevant for me as Home user.

    But anything related to security, performance or function I could not find so far to prefer the one option (VLAN tagging in Hyper-V with several nics) or the other option (one nic with VLAN tagging in XG).