6.5.1

Networking Best Practices 18
Consider these best practices when you configure your network.
n
To ensure a stable connection between vCenter Server, ESXi, and other products and services, do
not set connection limits and timeouts between the products. Setting limits and timeouts can affect
the packet flow and cause services interruption.
n
Isolate from one another the networks for host management, vSphere vMotion, vSphere FT, and so
on, to improve security and performance.
n
Dedicate a separate physical NIC to a group of virtual machines, or use Network I/O Control and
traffic shaping to guarantee bandwidth to the virtual machines. This separation also enables
distributing a portion of the total networking workload across multiple CPUs. The isolated virtual
machines can then better handle application traffic, for example, from a Web client.
n
To physically separate network services and to dedicate a particular set of NICs to a specific network
service, create a vSphere Standard Switch or vSphere Distributed Switch for each service. If this is
not possible, separate network services on a single switch by attaching them to port groups with
different VLAN IDs. In either case, verify with your network administrator that the networks or VLANs
you choose are isolated from the rest of your environment and that no routers connect them.
n
Keep the vSphere vMotion connection on a separate network. When migration with vMotion occurs,
the contents of the guest operating system’s memory is transmitted over the network. You can do this
either by using VLANs to segment a single physical network or by using separate physical networks
(the latter is preferable).
For migration across IP subnets and for using separate pools of buffer and sockets, place traffic for
vMotion on the vMotion TCP/IP stack, and traffic for migration of powered-off virtual machines and
cloning on the Provisioning TCP/IP stack. See VMkernel Networking Layer.
n
You can add and remove network adapters from a standard or distributed switch without affecting the
virtual machines or the network service that is running behind that switch. If you remove all the
running hardware, the virtual machines can still communicate among themselves. If you leave one
network adapter intact, all the virtual machines can still connect with the physical network.
n
To protect your most sensitive virtual machines, deploy firewalls in virtual machines that route
between virtual networks with uplinks to physical networks and pure virtual networks with no uplinks.
n
For best performance, use VMXNET 3 virtual machine NICs.
VMware, Inc.
259