OPNsense on VMware ESXi

[quinc]

Hi there folks,

Hoping someone will be able to help me with some networking configuration on ESXi.

We have one physical server, running VMware ESXi 6.7 or 6.5 (can't remember which).
This server hosts the virtualised OPNsense firewall we are using, as well as around 5 or 6 VMs.
These VMs are connected to the VMNetwork default network on VSwitch0, as is the LAN interface on the OPNsense firewall. The physical uplink on vswitch0 is to a physical switch on vmnic0. WAN connection from modem is to vmnic1, with a dedicated vswitch and port group, assigned to WAN interface on OPNsense.

Where I'm running into problems, is there is now a need to add a further VM, that is in a separate VLAN from the other VMs.

What I have done so far;
Created new VLAN, using the LAN interface as parent interface. Specified VLAN tag (20), and specified subnet and DHCP information. I then added a portgroup to the default vswitch, specified VLAN tag 20, and assigned as interface to new VM. However when I boot the VM - it is not receiving any DHCP information, and cannot reach the firewall using the VLAN gateway IP.

If I understand what is happening, the VLAN tags are not being passed by the physical switch.

If I understand this correctly, I could configure a new vswitch with no uplink external to the VMware instance and add the OPNsense VM and the new VM to portgroups on this switch. Going forward, would I need to create a new interface on the firewall for any future VLANs, or could I configure a VLAN trunk to the vSwitch (it has no "uplink" as such)?

[opn_nwo]

Create a new vswitch and tag the uplink. Do not tag it in OPNsense, let ESXi do the tagging and add the new vswitch port as regular interface to OPNsense.

[quinc]

How do I tag the uplink when the new vSwitch will have no connectivity outside of VMware? Ie it will have no uplink as far as vmware is concerned. Or do you mean tag the port group that corresponds to the interface on the OPNsense VM?

[opn_nwo]

If you don't need connectivity outside ESXi then don't bother with VLANs. Just create a vswitch and add it to the OPNsense VM then assign and configure it like you would with a new interface. That's all.

[quinc]

Thanks - thats what I was thinking - just was wondering if there is a way I could do it with a VLAN trunk to the OPNsense VM, so that I can use multiple VLANs across the switch. Sounds like an external physical switch would be required to do that, with a physical NIC acting as a trunk uplink on the vSwitch. Is that correct?

Either way for now I will just spin up a vswitch/port groups and add a new interface to the firewall.

[opn_nwo]

You can setup VLANs within VMs if you really want to. Look for "Virtual Guest VLAN tagging (VGT)" in the ESXi documentation. It uses a special VLAN (4095) to do some clever tricks. You can read more about it, but IMO it would be an unnecessary complication in your specific scenario, especially if you are not well versed with managing VLANs in a virtual environment.

[sorano]

Just wanted to chime in that I use a vmnic from a trunked dswitch and tag my vlans inside the virtual OPNsense.
It works great, feels very smooth to be able to add new vlans to the VM without having to do anything in vCenter.