Automatic VLAN assignment and use of DHCP relays
Software defined datacenters (SDDC) enable us to keep many components within the hypervisors software layer. But sooner or later we need to exit that layer in order to get in touch with the user. Usually Thin- or Zeroclients are used as VDI endpoints. Those hardware boxes are connected by LAN and need to have an IP address.
I will demonstrate how to assign endpoints to separate them into subnet segments and VLANs and still assign IP addresses by a centralized DHCP server.
- Dedicated VLAN for VDI endpoints
- Dedicated subnet for VDI endpoints
- No client configuration. Endpoint needs to work out of the box.
- Foolproof switch placement. Device needs to work on any switch ‘port.
- Company’s centralized DHCP server has to manage leases. No dedicated DHCP server in VLAN.
- Estimated number of endpoints >256
- Class B intranet 10.1.0.0/16
- HPE Switch infrastructure with 5700 Series as Core and 5130 series as access switches
- Private cloud based on vSphere 6.0
Clients will get a dedicated class B subnet, because expected number will be greater than 255. This subnet will be in a dedicated VLAN. DHCP discover packets can’t traverse routers and reach the central DHCP server. Therefore we need to utilize a DHCP relay on the core switch.
VLAN and Subnet
First we need to define a VLAN on all switches involved. That’s the access switches and the core switch.
system-view vlan 2
VLAN 2 is created.
Next we need to allow VLAN 2 on all link aggregation interfaces between switches. That has to be done on each side of the trunk.
Imagine there’s a link aggregation 1 from core switch to access switch 1 and link aggregation 2 from core to access switch 2. Then we have to excecute these commands on the core switch.
system-view interface bridge-aggregation 1 port trunk permit vlan 2 quit interface bridge-aggregation 2 port trunk permit vlan 2 quit quit
Now VLAN 2 is permitted on both link aggregation interfaces leading to access switch 1 and 2. We also have to grant VLAN 2 from the opposite direction on access switch 1 and access switch 2. On both access switches the link aggregation interface has number 1. These are the commands to permit VLAN 2 from an access switch to the core. They have to be issued on both access switch 1 and access switch 2.
system-view interface bridge-aggregation 1 port trunk permit vlan 2 quit quit
Now we can handle packets in VLAN 2 on access switches 1 and 2 and the core.
In addition we need a VLAN interface on the core switch as a gateway.
system-view interface vlan-interface 2 ip address 10.2.0.1 255.255.0.0 description VDI endpoints name VDI endpoints quit quit
We now have a VLAN interface in VLAN 2 with IP address 10.2.0.1. That is the gateway address for all clients in VLAN 2. Creating a VLAN interface automatically creates a route. Clients in subnet 10.2.0.0 can now communicate with clients in subnet 10.1.0.0.
A client in subnet 10.2.0.0 can’t reach a DHCP server in subnet 10.1.0.0 directly. To make it possible we need a DHCP relay on the core switch. It relays DHCP communication on behalf of the client.
We only need a relay on the core switch. IP address of our DHCP server in the example is 10.1.0.100.
system-view dhcp enable interface vlan-interface 2 dhcp select relay dhcp relay server-address 10.1.0.100 quit quit
Configure DHCP server
To become responsible for subnet 10.2.0.0, our DHCP needs another scope. It can then offer leases for requests coming from the 10.2.0.0 range. All others will get addresses from the default range.
Automatic VLAN assignment
You can assign devices to different VLANs according to their hardware properties. An IP phone will get a different VLAN assigned than a printer or a VDI endpoint. This should happen on the switch port without further configuration on the device. Doing so will reduce administrative errors.
A common property of all VDI endpoints (from the same vendor) are their first 24 bits of their MAC addresses. These 24 bits are called Organizationally Unique Identifier (OUI). In our example all endpoint have an OUI like 00:e0:c5 (=BCOM electronics Inc.). All endpoint devices will only get connected via access switches. Therefore we only have to configure access switches. In our example it’s a 48-port switch model. That’s why we configure ports 1/0/1 to 1/0/48.
system-view mac-vlan mac-address 00e0-c500-0000 mask ffff-ff00-0000 vlan 2 interface range gigabitethernet 1/0/1 to gigabitethernet 1/0/48 port link-type hybrid port hybrid vlan 2 untagged mac-vlan enable vlan precedence mac-vlan
Once a packet with MAC address 00:e0:c5:xx:xx:xx reaches a configured switch port, it will automatically assigned to VLAN 2. There’s no need to configure the endpoint device.
If you’re using an IRF-cluster you nee to adjust the line with the interface range accordingly. Here’s an example for an IRF-cluster consisting of 3 units:
interface range gigabitethernet 1/0/1 to gigabitethernet 1/0/48 gigabitethernet 2/0/1 to gigabitethernet 2/0/48 gigabitethernet 3/0/1 to gigabitethernet 3/0/48