Enabling Jumbo Frames on ESXi

The default maximum size for data transmission on Ethernet is 1500 bytes for legacy compatibility reasons, unfortunately for newer high-speed networks breaking up data into 1500 byte chunks called frames creates too much overhead and prevents one from utilizing the full capabilities of the network hardware.  For example on a 10Gbit link you are only able to transmit about 3-4Gbit of data between machines using 1500 byte frames due to the overhead of processing so many small frames of data while we were able to easily saturate 10Gbit when using jumbo frames. Modern full-featured network equipment can transmit larger frame sizes if configured to do so, usually up to 9000 bytes, allowing for full utilization of the available resources.  Jumbo frames are usually only used in a controlled and segmented environment, for example an iSCSI SAN, as they can cause additional overhead from the need for packet fragmentation at the point when converting between a 9000 byte frame network and a standard 1500 byte frame network.

Configuring Jumbo Frames on an ESX VM server

Support for jumbo frames is included in ESX and ESXi but is not exposed in the GUI for the default vSwitch implementation, in addition remote configuration for vSwitches is not enabled on ESXi using the free license from the API using PowerCLI or VMware CLI.

Example for vSwitch:

esxcfg-vswitch --list
esxcfg-vswitch --mtu 9000 vSwitch0

Example for VMkernel interface (for vMotion or iSCSI):

esxcfg-vmknic --list
esxcfg-vmknic --mtu 9000 "VMkernel Portgroup Name"

Note:  When configuring a VMkernel interface for Jumbo Frames make sure that the underlying vSwitch is also configured for Jumbo Frames.

Configuring Jumbo Frames on ESX VM guest

The default emulated Intel E1000 network device presented to guests in VMware ESX does not support Jumbo Frames, one must install VMware Tools and enable a VMXNET3 interface to take advantage.

Source: https://kb.wisc.edu/ns/page.php?id=17243

Realtek NIC 8169 with ESXi 4.1

Hi, ESXi does not recognize Realtek 8169 based network cards by default. So here is a little howto to enable these cards on ESXi 4.1. Simply follow the next steps and after a reboot the card will be there:

  1. Download oem.tgz
  2. Transfer the downloaded file to your ESXi 4.1 host trough SSH (e.g. with SCP or WinSCP)
  3. Enter maintenance mode:
    # vim-cmd hostsvc/maintenance_mode_enter
  4. Replace /vmfs/volumes/Hypervisor1/oem.tgz with the downloaded version of the file
  5. Reboot

Here is a nice link: how to customize esxi 4.1

Check here for more drivers.

 

Secure crypto ciphers CentOS

Here are two lists of secure (at date of writing) ciphers for the CentOS/RHEL operating system. These lists are not complete but only reduced to RSA/AES encryption ciphers which are considered secure. Use following command to get all supported ciphers on your OS:

openssl ciphers -v ALL

Following string uses secure ciphers while keeping some of the older secure ciphers available. This string can be used in apache, postfix or others:

ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5

CentOS 6+7:

ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-RSA-AES256-SHA
ECDH-RSA-AES256-GCM-SHA384
ECDH-RSA-AES256-SHA384
ECDH-RSA-AES256-SHA
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-RSA-AES128-SHA
ECDH-RSA-AES128-GCM-SHA256
ECDH-RSA-AES128-SHA256
ECDH-RSA-AES128-SHA

 

CentOS 5:

DHE-RSA-AES256-SHA
DHE-RSA-AES128-SHA