vmware private vlan with HP 5820AF TOR switch

[tombosa]

Just wondering if anyone has experience on how to uplink a comware based switch to a vmware VDS? The switch does L2 only and the firewall for the primary vlan is located further downstream (via trunk Ba1).
Below is a general description of our design and some questions:

We have the requirement to build a more secure DMZ zone in our vmware environment and I am thinking of using private VLANs (in comware 5.2 world I think they term this isolate user vlan), since none of the VMs should be able to contact each other. I have attached a PDF of our environment and the configuration so far.

There isn’t much in the way of configuration examples for this particular case. The documentation available outlines what to do if a physical device is connected to the switch port (port isolate-user-vlan host) but not in the case of uplinking a trunk carrying the primary and secondary vlan to the host vmnic, which is part of a vmware dvswitch.

We have evacuated a host for trying to get this working, but I am wondering if anyone can shed light on the following:

• Is it correct to assume that Ba1, carrying VLAN 1568 (primary vlan) from the TOR switch to the core, should be configured as a promiscuous uplink with the “port isolate-user-vlan 1568 promiscious” command?
• I am stumped as to the configuration of the link between the TOR switch and the vmnic belonging to the dvswitch configured with the private VLANS (see the red circle in attached diagram). Should this operate in host mode? If it is set to host mode, what happens to all the other tagged traffic it is carrying?

A design goal is for none of the VMS in the isolated secondary VLAN (1569) be able to contact eachother, but should be able to talk to the gateway.

Thank you everyone for taking the time to look through this and help!

[tombosa · Accepted solution]

Got this to work...posting the solution below:

The key was to:

1.) Create a seperate uplink to the firewall acting as the router for primary vlan 1568. Likely not necessary but done to prevent impact to traffic flowing across the existing trunk.

2.) Configure said uplink as a promiscious port for primary vlan 1568. THis in turn changes the port to a hybrid port with the pvid matching vlan 1568, and also untags traffic for/from secondary isolated vlan 1569 to the primary vlan 1568.

3.) No special configuration for the vmnic uplink to ESXi hosts except for also tagging them with the isolated secondary private vlan.

See attached diagram.