Enable ESXi VLAN Access Mode with SR-IOV
Send and receive VLAN untagged traffic on SR-IOV interfaces
on the VM-Series firewall on ESXi.
The VM-Series firewalls on ESXi can operate
in VLAN access mode to support use cases where it is deployed as
a virtual network function (VNF) that offers security-as-a-service
in a multi-tenant cloud/data center environment. In VLAN access mode,
each VNF has dedicated virtual network interfaces (VNIs) for each
network and it sends and receives packets to/from SR-IOV virtual
functions (VFs) without VLAN tags; you must enable this capability
on the physical and virtual functions on the host hypervisor. When
you, then enable VLAN access mode on the VM-Series firewall, the
firewall can send and receive traffic without VLAN tags across all
its dataplane interfaces. Additionally, if you configure QoS policies,
the firewall can enforce QoS on the access interface and provide
differentiated treatment of traffic in a multi-tenant deployment.
By
default, the VM-Series firewall on ESXi operates in VLAN trunk mode.
- On the host system, set up the physical and virtual function to operate in VLAN access mode.
- ClickNetworkingin the VMware Host Client inventory and clickPort groups.
- In the list that you want to edit, right-click the port group and selectEdit settings.Enter a new port groupName.Enter a new value for theVLAN ID.
For best performance on the VM-Series firewall, make sure to:- Enable CPU pinning.
- Disable Replay Protection, if you have configured IPSec Tunnels.On the firewall web interface, select , select an IPSec tunnel, clickGeneral, selectShow Advanced Options, and clearEnable Replay Protection.
- Access the CLI on the VM-Series firewall.
- Enable VLAN access mode.request plugins vm-series vlan-mode access-mode ononenables VLAN access mode; to use VLAN trunk mode, enterrequest plugins vm-series vlan-mode access-mode off.
- Reboot the firewall.request restart system
- Verify the VLAN mode configuration.show plugins vm-series vlan-mode
