VMware port groups and STACKIT networks, mapped

From vNetwork rows to STACKIT networks

Left: the vNetwork sheet of a demo estate written for this page, seven VMs on six port groups, five of them on a distributed switch and one on a standard switch. Right: the six network blocks of the Terraform the run wrote, without the review comments that sit above each block in the file.

VM,NIC label,Adapter,Network,Switch,Connected,IPv4 Address,VM UUID
web01,Network adapter 1,Vmxnet3,PG-Web-DMZ-VLAN110,dvs-prod,True,10.10.110.11,4202-vm08-0001
web02,Network adapter 1,Vmxnet3,PG-Web-DMZ-VLAN110,dvs-prod,True,10.10.110.12,4202-vm08-0002
app01,Network adapter 1,Vmxnet3,PG-App-VLAN120,dvs-prod,True,10.10.120.21,4202-vm08-0003
app01,Network adapter 2,Vmxnet3,PG-Backup-VLAN900,dvs-prod,True,10.10.90.21,4202-vm08-0003
db01,Network adapter 1,Vmxnet3,PG-DB-VLAN130,dvs-prod,True,10.10.130.31,4202-vm08-0004
db01,Network adapter 2,Vmxnet3,PG-Backup-VLAN900,dvs-prod,True,10.10.90.31,4202-vm08-0004
legacy01,Network adapter 1,E1000,VM Network,vSwitch0,True,192.168.50.5,4202-vm08-0005
jump01,Network adapter 1,Vmxnet3,PG-Mgmt-VLAN10,dvs-prod,True,10.10.10.5,4202-vm08-0006
jump01,Network adapter 2,Vmxnet3,PG-Backup-VLAN900,dvs-prod,False,10.10.90.5,4202-vm08-0006
tpl-rhel9,Network adapter 1,Vmxnet3,PG-App-VLAN120,dvs-prod,False,,4202-vm08-0007

resource "stackit_network" "network_PG_App_VLAN120" {
  project_id       = var.project_id
  name             = "pg-app-vlan120"
  ipv4_prefix      = var.network_PG_App_VLAN120_ipv4_prefix
  ipv4_nameservers = var.network_PG_App_VLAN120_ipv4_nameservers
}

resource "stackit_network" "network_PG_Backup_VLAN900" {
  project_id       = var.project_id
  name             = "pg-backup-vlan900"
  ipv4_prefix      = var.network_PG_Backup_VLAN900_ipv4_prefix
  ipv4_nameservers = var.network_PG_Backup_VLAN900_ipv4_nameservers
}

resource "stackit_network" "network_PG_DB_VLAN130" {
  project_id       = var.project_id
  name             = "pg-db-vlan130"
  ipv4_prefix      = var.network_PG_DB_VLAN130_ipv4_prefix
  ipv4_nameservers = var.network_PG_DB_VLAN130_ipv4_nameservers
}

resource "stackit_network" "network_PG_Mgmt_VLAN10" {
  project_id       = var.project_id
  name             = "pg-mgmt-vlan10"
  ipv4_prefix      = var.network_PG_Mgmt_VLAN10_ipv4_prefix
  ipv4_nameservers = var.network_PG_Mgmt_VLAN10_ipv4_nameservers
}

resource "stackit_network" "network_PG_Web_DMZ_VLAN110" {
  project_id       = var.project_id
  name             = "pg-web-dmz-vlan110"
  ipv4_prefix      = var.network_PG_Web_DMZ_VLAN110_ipv4_prefix
  ipv4_nameservers = var.network_PG_Web_DMZ_VLAN110_ipv4_nameservers
}

resource "stackit_network" "network_VM_Network" {
  project_id       = var.project_id
  name             = "vm-network"
  ipv4_prefix      = var.network_VM_Network_ipv4_prefix
  ipv4_nameservers = var.network_VM_Network_ipv4_nameservers
}

• One port group, one network

  Six port groups give six networks. They form the first wave of the run, and every server waits for the networks it uses.

• The VLAN lives on only in the name

  PG-App-VLAN120 becomes pg-app-vlan120. The reason text of the run says that VLAN IDs and virtual switches have no meaning on STACKIT, so the number is a label now, and a Platform Architect step asks you to confirm the name against whatever refers to the old one.

• Prefix and DNS become variables

  The draft sets no address range and no name servers. Both are variables per network that you fill in; a later section shows one of them.

• A default name is cleaned up

  The standard-switch network VM Network is written as vm-network. The comment above the block says the name was made valid for STACKIT and keeps the source name.

Each part of a port group and where it goes

Figures and statements of the left and middle columns come from assessment.json, engineering/architect-report.md and terraform/ of the run; statements about STACKIT limits come from the STACKIT documentation listed under the sources.

A server on two networks

The application server app01 sits on the application network and on the backup network. Left: its two vNetwork rows. Right: the two interfaces and the server of the draft, without the review comments.

VM,NIC label,Adapter,Network,Switch,Connected,IPv4 Address,VM UUID
app01,Network adapter 1,Vmxnet3,PG-App-VLAN120,dvs-prod,True,10.10.120.21,4202-vm08-0003
app01,Network adapter 2,Vmxnet3,PG-Backup-VLAN900,dvs-prod,True,10.10.90.21,4202-vm08-0003

resource "stackit_network_interface" "vm_app01_nic1" {
  project_id = var.project_id
  network_id = stackit_network.network_PG_App_VLAN120.network_id
  ipv4       = "10.10.120.21"
}

resource "stackit_network_interface" "vm_app01_nic2" {
  project_id = var.project_id
  network_id = stackit_network.network_PG_Backup_VLAN900.network_id
  ipv4       = "10.10.90.21"
}

resource "stackit_server" "vm_app01" {
  project_id        = var.project_id
  name              = "app01"
  machine_type      = var.vm_app01_machine_type
  availability_zone = var.availability_zone
  boot_volume = {
    source_type = "image"
    source_id   = var.vm_app01_image_id
    size        = 60
  }
  network_interfaces = [stackit_network_interface.vm_app01_nic1.network_interface_id, stackit_network_interface.vm_app01_nic2.network_interface_id]
}

• One interface per adapter

  Each adapter becomes its own interface in the network that replaces its port group, with the address from the export.

• The server lists both

  network_interfaces holds both interface IDs. In assessment.json the unit depends on both networks, so it moves in the wave after them.

• Fixed once created

  The documentation says an interface stays linked to its network and keeps its IPv4 address. A wrong prefix or address is therefore a decision to settle before the first apply.

The prefix the export cannot give

Three VMs use the backup port group. Left: their rows. Right: the two variables the draft declares for that network, taken from variables.tf.

VM,NIC label,Adapter,Network,Switch,Connected,IPv4 Address,VM UUID
app01,Network adapter 2,Vmxnet3,PG-Backup-VLAN900,dvs-prod,True,10.10.90.21,4202-vm08-0003
db01,Network adapter 2,Vmxnet3,PG-Backup-VLAN900,dvs-prod,True,10.10.90.31,4202-vm08-0004
jump01,Network adapter 2,Vmxnet3,PG-Backup-VLAN900,dvs-prod,False,10.10.90.5,4202-vm08-0006

variable "network_PG_Backup_VLAN900_ipv4_nameservers" {
  type        = list(string)
  description = "IPv4 DNS servers handed out on the network replacing port group PG-Backup-VLAN900 (RVTools does not export them; use the site's DNS servers, reachable from STACKIT)."
}

variable "network_PG_Backup_VLAN900_ipv4_prefix" {
  type        = string
  description = "IPv4 prefix (CIDR) for the network replacing port group PG-Backup-VLAN900. Addresses seen on it: 10.10.90.21, 10.10.90.31, 10.10.90.5."
}

• Addresses collected for you

  The description lists 10.10.90.21, 10.10.90.31 and 10.10.90.5, the addresses seen on the port group. Choose a prefix that contains all of them if the VMs keep their addresses.

• Reserved addresses

  The STACKIT documentation notes a few reserved addresses per network. Check that none of your fixed addresses falls on one of them.

• Name servers from your site

  The nameserver variable asks for servers that the new network can reach. Servers with a static guest configuration keep their own.

Where the mapping bites in practice

• Addresses are settled early

  An interface cannot move to another network and keeps its address. Decide prefix and addresses before the first apply, not during cutover.

• Inbound is closed by default

  The security group documentation says incoming traffic is blocked unless a rule or a shared group allows it, and outgoing traffic is allowed. Machines that talked freely inside a port group need rules or a common group.

• Interfaces pin MAC and IP

  With NIC security on, which is the default, an interface accepts only its own MAC and IP pair. A floating or virtual address has to be listed in the allowed addresses (allowed_addresses) of the interface.

• Waves follow the networks

  Networks are wave 1. A server with several adapters waits for all of its networks; jump01 waits for the management and the backup network.

• Default names disappear

  Anything that refers to VM Network, a script, a DNS entry or a runbook, needs the new name vm-network or a decision to rename.

• Missing sheets hide facts

  This run had no vSnapshot and no vMemory sheet. The report warns that snapshot counts and memory reservations are unknown, and each VM carries a snapshot finding marked as not verifiable. Export all sheets.

Settling the networks in order

1. 01

   List the port groups

   Read the Network and Switch columns of vNetwork. Every distinct name used by an adapter becomes a network in the draft.

2. 02

   Choose one prefix per network

   Use the addresses listed in the variable descriptions as the starting point and decide whether the machines keep their addresses.

3. 03

   Confirm the names

   Work through the Platform Architect step: keep the VLAN number in the name if people search for it there, or drop it.

4. 04

   Design the security groups

   Write down which flows the old port groups allowed, then express them as groups and rules. Nothing of this comes out of RVTools.

5. 05

   Create networks, then interfaces and servers

   Apply in the order of the plan: wave 1 networks, wave 2 interfaces and servers.

6. 06

   Check the adapters after conversion

   Legacy adapters and disconnected adapters are the ones to look at first in the guest.

Questions network teams ask

Sources

• STACKIT documentation: network interfaces, concepts
• STACKIT documentation: security groups, concepts
• STACKIT documentation: core networking, concepts
• STACKIT Terraform provider 0.121.0: stackit_network