Detailed write-up on my VMware vSphere 7 nested homelab networking setup

I have been getting quite a few inquiries about my fully nested VMware homelab setup. People seem to be struggling mostly with setting up the networking bits. I describe the overall topology in this blogpost but this blogpost will contain a lot more details on the network configuration. I also made a couple of changes, such as replacing the pfSense appliance with a Vyos appliance and the introduction of NSX-T (although this doesn’t change anything to my physical network configuration). I will use as many screenshots as possible to create a step by step process.

Update Video Tutorial

To answer some of the questions I received about my configuration, I recorded a video tutorial on setting up a nested homelab:

The physical ESXi host

I’m using a Supermicro SYS-5028D-TN4T server. It has 4 physical NICs and an IPMI port but since my lab is running fully nested, I use only a single NIC. I even shared the IPMI on the NIC so I can save a port on my switch.

Routing between physical and nested with a Vyos appliance

My home network is just a simple flat networking running in 192.168.2.0/24 with my ISP router being the 192.168.2.254 default gateway to the internet.

I use a Vyos appliance to route between my physical homelab and all the VLANs I use in my homelab environment. I configured two NICs on the appliance. One NIC is connected to my physical home network (the uplink) and the other NIC is connected to my homelab environment:

If you look at the interface configuration you will see interface eth0 configured with 192.168.2.145/24 and eth1 is subdivided in multiple vif interfaces. These are subinterfaces for all my routable VLANs:

My ESXi management network for my homelab is VLAN 1611 with subnet 172.16.11.0/24 for example. That VLAN is routed by a VIF 1611 on the Vyos appliance with IP address 172.16.11.254/24. That’s the default gateway for VLAN 1611. The Vyos router holds a 0.0.0.0/0 route to my ISP router 192.168.2.254/24 by the way.

How to enable VLANs on ESXi

For the nested environment to support the use of VLANs, we need to take a couple of steps on the physical ESXi host network configuration. If we look at the physical NICs we see the single attached 1000Mbps interface. The other 3 NICs are disconnected:

First of all, we need two vSwitches:

The first switch has a single uplink (the only configured physical NIC on the Supermicro). This vSwitch holds two portgroups:

1. The management vmkernel port so I can reach the physical ESXi host from my home network. This management interface is configured with the IP address 192.168.2.35/24 and default gateway 192.168.2.145/24.
2. A Virtual Machine portgroup to hold all the VMs that run inside my home network 192.168.2.0/24. These are my Windows AD / Jumphost, a Linux jumphost and the uplink interface of the Vyos appliance:

Really straightforward. The second vSwitch is where the VLAN magic happens. This is a vSwitch without any uplinks. The Vyos appliance connects the first vSwitch with the uplink to the physical network 192.168.2.0/24 to the VLANs on this isolated vSwitch. The isolated vSwitch only has two Virtual Machine portgroups:

1. Nested-ESXi
2. ESXi-Mgmt

The magic of VLAN 4095

The Nested-ESXi switch is configured with VLAN 4095. This basically turns it into a VLAN trunk port. This means it now supports guest VLAN tagging. I can now create a management interface on a nested ESXi server and tag it with VLAN 1611 on the nested ESXi host itself. The ESXi-Mgmt is a basic portgroup with VLAN 1611 because I want to run some VMware appliances directly on the physical ESXi host and not on one of my nested ESXi hosts (such as vCenter Server, NSX-T Manager and the NSX-T Edge). They need access to the ESXi Management network VLAN 1611 172.16.11.0/24 so that’s why I needed to create that VLAN backed portgroup on the physical host as well. I can imagine this is where it becomes a bit fuzzy.

Additional screenshots

I will walk you through the setup in a couple of steps / screenshots.

The Nested-ESXi vSwitch:

Pay special attention to the MTU 9000 and security settings configuration (allow promiscuous, forged transmits and MAC changes)

Next up is the Nested-ESXi portgroup configuration:

Configuring VLAN 4095 on this port group is essential to enable VLAN support in a nested homelab. Also ensure you enable the required security settings to support nested virtualization:

The ESXi-Mgmt port-group to support VMs running on the physical ESXi host in VLAN 1611:

My Windows jumphost has IP address 192.168.2.36/24 and is using the Vyos router with 192.168.2.145/24 as its default gateway. The 0.0.0.0/0 route to 192.168.2.254 (my ISP router) enables internet access:

Nested vCenter and ESXi

I deployed vCenter Server on the physical ESXi host and deployed four nested ESXi hosts with 32GB RAM and 16 CPUs in a single cluster. Heavily oversubscribed of course but this does allow me to run nested applianced with a high CPU and RAM count demand. Logging into vCenter Server and taking a closer look to the network setup there:

vCenter holds one Distributed Switch with two uplinks (the other two uplinks are for NSX-T) and a number of portgroups:

• ESXi Management VLAN 1611
• vMotion VLAN 1612
• vSAN VLAN 1613
• Overlay VLAN 1615
• Uplink 01 VLAN 50 (VLAN between NSX-T and the Vyos for north/south traffic)
• Uplink 02 VLAN 60 (VLAN between NSX-T and the Vyos for north/south traffic)

I can configure MTU 9000 wherever I like because the underlying vSwitch on the physical ESXi host is also running MTU 9000. Some screenshots:

The ESXi Management portgroup with VLAN 1611:

The network topology from the perspective of a nested ESXi host:

The configuration of the VMkernel interfaces on a nested ESXi host (don’t forget to set the proper MTU here too):

What about NSX-T?

And that’s it for now :-). I’m currently rebuilding my nested homelab configuration with vSphere 7.0 with Kubernetes and NSX-T 3.0. This is taking a bit longer due to a lack of time but I will be sure to blog about those adventures too. Make sure you stay tuned!

If you have any questions about this nested setup, you know how to reach me (best on Twitter).