Automatic Segmentation of VDI Endpoints

Automatic VLAN assignment and use of DHCP relays

Software defined datacenters (SDDC) enable us to keep many components within the hypervisors software layer. But sooner or later we need to exit that layer in order to get in touch with the user. Usually Thin- or Zeroclients are used as VDI endpoints. Those hardware boxes are connected by LAN and need to have an IP address.

I will demonstrate how to assign endpoints  to separate them into subnet segments and VLANs and still assign IP addresses by a centralized DHCP server.


  • Dedicated VLAN for VDI endpoints
  • Dedicated subnet for VDI endpoints
  • No client configuration. Endpoint needs to work out of the box.
  • Foolproof switch placement. Device needs to work on any switch ‘port.


  • Company’s centralized DHCP server has to manage leases. No dedicated DHCP server in VLAN.
  • Estimated number of endpoints >256


  • Class B intranet
  • HPE Switch infrastructure with 5700 Series as Core and 5130 series as access switches
  • Private cloud based on vSphere 6.0


Clients will get a dedicated class B subnet, because expected number will be greater than 255. This subnet will be in a dedicated VLAN. DHCP discover packets can’t traverse routers and reach the central DHCP server. Therefore we need to utilize a DHCP relay on the core switch.

VLAN and Subnet

First we need to define a VLAN on all switches involved. That’s the access switches and the core switch.

vlan 2

VLAN 2 is created.

Next we need to allow VLAN 2 on all link aggregation interfaces between switches. That has to be done on each side of the trunk.


Imagine there’s a link aggregation 1 from core switch to access switch 1 and link aggregation 2 from core to access switch 2. Then we have to excecute these commands on the core switch.

interface bridge-aggregation 1
port trunk permit vlan 2
interface bridge-aggregation 2
port trunk permit vlan 2

Now VLAN 2 is permitted on both link aggregation interfaces leading to access switch 1 and 2. We also have to grant VLAN 2 from the opposite direction on access switch 1 and access switch 2. On both access switches the link aggregation interface has number 1. These are the commands to permit VLAN 2 from an access switch to the core. They have to be issued on both access switch 1 and access switch 2.

interface bridge-aggregation 1
port trunk permit vlan 2

Now we can handle packets in VLAN 2 on access switches 1 and 2 and the core.

In addition we need a VLAN interface on the core switch as a gateway.

interface vlan-interface 2
ip address
description VDI endpoints
name VDI endpoints

We now have a VLAN interface in VLAN 2 with IP address That is the gateway address for all clients in VLAN 2. Creating a VLAN interface automatically creates a route. Clients in subnet can now communicate with clients in subnet

DHCP Relay

A client in subnet can’t reach a DHCP server in subnet directly. To make it possible we need a DHCP relay on the core switch.  It relays DHCP communication on behalf of the client.

We only need a relay on the core switch. IP address of our DHCP server in the example is

dhcp enable
interface vlan-interface 2
dhcp select relay
dhcp relay server-address

Configure DHCP server

To become responsible for subnet, our DHCP needs another scope. It can then offer leases for requests coming from the range. All others will get addresses from the default range.

Automatic VLAN assignment

You can assign devices to different VLANs according to their hardware properties. An IP phone will get a different VLAN assigned than a printer or a VDI endpoint. This should happen on the switch port without further configuration on the device. Doing so will reduce administrative errors.

A common property of all VDI endpoints (from the same vendor) are their first 24 bits of their MAC addresses. These 24 bits are called Organizationally Unique Identifier (OUI). In our example all endpoint have an OUI like 00:e0:c5 (=BCOM electronics Inc.). All endpoint devices will only get connected via access switches. Therefore we only have to configure access switches. In our example it’s a 48-port switch model. That’s why we configure ports 1/0/1 to 1/0/48.

mac-vlan mac-address 00e0-c500-0000 mask ffff-ff00-0000 vlan 2
interface range gigabitethernet 1/0/1 to gigabitethernet 1/0/48
port link-type hybrid
port hybrid vlan 2 untagged
mac-vlan enable
vlan precedence mac-vlan

Once a packet with MAC address 00:e0:c5:xx:xx:xx reaches a configured switch port, it will automatically assigned to VLAN 2. There’s no need to configure the endpoint device.

If you’re using an IRF-cluster you nee to adjust the line with the interface range accordingly. Here’s an example for an IRF-cluster consisting of 3 units:

interface range gigabitethernet 1/0/1 to gigabitethernet 1/0/48 gigabitethernet 2/0/1 to gigabitethernet 2/0/48 gigabitethernet 3/0/1 to gigabitethernet 3/0/48



Leave a Reply

Your email address will not be published. Required fields are marked *