VMware ESXi and vSphere Cluster Management
Configure an NFS Datastore on a VMware ESXi Host
Learn how to configure VMkernel storage networking and create, validate, and troubleshoot an NFS datastore on a VMware ESXi host.
An NFS datastore lets an ESXi host store virtual machine files on a directory exported by an NFS server over an IP network. The configuration has two connected parts: the ESXi host must have a reachable VMkernel storage network, and the NFS server must authorize the host to use the correct export.
This lesson covers planning, VMkernel networking, datastore creation in the vSphere Client, validation, access controls, and common troubleshooting checks.
NFS Datastore Overview
NFS means Network File System. It is a protocol for accessing shared files over an IP network. An NFS datastore is an ESXi datastore backed by a directory that an NFS server has exported to authorized clients.
The ESXi host mounts the exported directory and presents it as a datastore. Virtual machine configuration files, virtual disks, snapshots, templates, and other supported VM data can then be stored in that datastore.
The main components are:
- ESXi host: The VMware hypervisor that runs virtual machines and mounts the datastore.
- VMkernel adapter: An ESXi host networking interface used for services such as storage access.
- vSwitch or distributed switch: The virtual switching component that connects the VMkernel networking to the physical network.
- NFS server: The system that hosts and exports the directory.
- NFS export: The server directory made available to authorized NFS clients.
- Export path: The exact directory path supplied to ESXi when the datastore is mounted.
The storage path is therefore: ESXi VMkernel adapter, virtual switch or distributed switch, physical network, NFS server, and exported folder. A virtual machine's guest network interface is not used to mount the datastore.
Prerequisites and Planning
Before opening the datastore creation wizard, collect the values and permissions required for the mount.
| Item | Example | Why It Is Needed |
|---|---|---|
| ESXi host | Target host selected in the inventory | Identifies where the datastore will initially be mounted. |
| VMkernel adapter and IP configuration | vmk1, 192.0.2.21/24 | Provides the host-side network path to NFS. |
| NFS server hostname or IP address | 192.0.2.50 | Tells ESXi which server to contact. |
| NFS export path | /exports/vmware/production | Identifies the exact directory to mount. |
| Datastore name | NFS-Production | Provides an administrator-friendly label in vSphere. |
| Read-only or read-write requirement | Read-write | Determines whether ESXi may modify datastore contents. |
| NFS server client access permissions | ESXi host or storage subnet authorized | Allows the NFS server to accept the mount and data operations. |
Confirm the NFS Server Configuration
- Confirm that an NFS server is available.
- Confirm that the intended directory is exported.
- Record the server hostname or IP address.
- Record the export path exactly as configured on the server. Do not substitute a local filesystem path that is not exported.
- Authorize the ESXi host, or the applicable ESXi storage network, in the export's client access rules.
- Permit read-write access for a normal VM datastore, or explicitly plan a read-only mount for reference content.
Confirm vSphere Permissions and Reachability
The administrator needs sufficient vSphere permissions to add or create datastores on the selected host. The ESXi host also needs network reachability to the NFS server from a suitable VMkernel adapter.
Check the IP address, subnet mask or prefix, VLAN, physical uplinks, and routing. If the NFS server is on another subnet, configure a default gateway or appropriate static routing according to the organization's network design.
Configure the VMkernel Network
A VMkernel adapter is an ESXi network interface used by host services. A VMkernel port is the logical VMkernel networking connection associated with a port group on a standard virtual switch or distributed switch.
ESXi needs a VMkernel adapter connected to a virtual switch or distributed switch that can reach the NFS server. A common design uses a dedicated storage VLAN and a dedicated VMkernel adapter, although the exact design depends on the environment.
Required VMkernel Settings
- Create or identify a VMkernel adapter connected to the storage network.
- Assign a valid IP address.
- Assign the correct subnet mask or prefix length.
- Configure a default gateway or static route when the NFS server is not on the local subnet.
- Verify that the associated physical uplinks and VLAN configuration reach the NFS network.
- Confirm that the VMkernel address can communicate with the NFS server address.
For example, a dedicated storage network might use vmk1 with address 192.0.2.21/24, while the NFS server uses 192.0.2.50 on the same storage network.
Create the NFS Datastore in the vSphere Client
The labels can vary slightly between vSphere versions, but the workflow follows the same sequence.
- Select the target ESXi host in the vSphere inventory.
- Open the host's datastore-related view, such as the Datastores view.
- Start the Create datastore workflow.
- Choose the appropriate datastore location or target host if the client asks for one.
- Select NFS as the datastore type.
- Enter an administrator-selected datastore name.
- Enter the NFS server hostname or IP address.
- Enter the exact exported folder path.
- Enable Mount NFS read only only when a non-writable mount is intended. Leave it disabled for a normal writable datastore.
- Review the settings and finish the wizard.
- Confirm that the datastore appears in the selected host's datastore inventory.
| Step | vSphere Client Action | Expected Result |
|---|---|---|
| Select host | Select the target ESXi host in the inventory. | The workflow applies to the intended host. |
| Open datastore creation workflow | Open the host datastore view and choose to create a datastore. | The datastore wizard opens. |
| Choose NFS | Select NFS as the datastore type. | The client requests NFS-specific connection details. |
| Provide datastore and server details | Enter the datastore name, server address, and exact export folder. | The client has enough information to identify the export. |
| Select mount mode | Choose read-only only when required; otherwise use read-write. | The intended access mode is recorded. |
| Finish and verify datastore | Complete the wizard and inspect the host datastore inventory. | The NFS datastore is mounted and listed. |
Example: Writable Production Export
Use these values for a standard writable datastore when the NFS server is configured to allow the ESXi host read-write access:
- Datastore name:
NFS-Production - NFS server:
192.0.2.50 - Export path:
/exports/vmware/production - Mount mode: Read-write
The datastore name is only the vSphere label. The server address and export path must match the NFS server configuration exactly.
Example: Read-Only Reference Datastore
A reference datastore containing protected templates or other controlled content can be mounted read-only:
- Datastore name:
NFS-Templates-RO - NFS server:
nfs.example.internal - Export path:
/exports/templates - Mount mode: Read-only
Read-only behavior must be supported by both the vSphere mount setting and the NFS server's export and underlying filesystem permissions.
Validate the Datastore
After the wizard finishes, validate both visibility and actual access.
- Verify that the datastore is listed for the intended ESXi host.
- Check that the datastore is mounted and accessible rather than merely present as a configuration entry.
- Confirm that capacity and available space are displayed.
- If the mount is read-write, browse the datastore or perform a suitable test operation that creates or updates permitted content.
- Use the datastore as a placement location for a suitable VM operation, such as placing a test file or deploying appropriate content.
- If the mount is read-only, verify that browsing works while write operations are correctly prevented.
Access Control and Storage Design Considerations
NFS export permissions control whether an ESXi host can mount and use the share. The export path, client access rules, and network connectivity must agree. A correct path is not enough if the NFS server rejects the host, and an authorized host cannot mount an export it cannot reach.
Follow the organization's storage security design for access controls, VLANs, routing, firewall rules, and network segmentation. Limit export access to the required ESXi hosts or storage network, and use the intended read-only or read-write policy.
| Characteristic | NFS | Fibre Channel |
|---|---|---|
| Storage access model | File-based access to a directory exported by an NFS server. | Block-based access to storage presented through Fibre Channel fabric and adapters. |
| Network transport | IP network. | Fibre Channel storage fabric. |
| ESXi storage presentation | ESXi mounts an NFS export as a datastore. | ESXi discovers block devices and uses the configured block-storage layer. |
| Primary configuration dependency | VMkernel IP reachability, export path, and NFS client permissions. | Fabric connectivity, zoning, host adapters, and block-storage presentation. |
Troubleshooting NFS Datastore Problems
The Wizard Cannot Complete or the Mount Fails
Likely causes include missing VMkernel reachability, an incorrect server address, an incorrect export path, or missing NFS server authorization.
- Verify VMkernel IP addressing, VLAN placement, routing, physical uplinks, and network connectivity.
- Confirm that the hostname resolves correctly when a hostname is used. If appropriate for the environment, test with the server IP address to separate name-resolution issues from storage issues.
- Compare the folder value with the NFS server's export configuration, including leading slashes and directory names.
- Review the export's client access permissions and confirm that the selected ESXi host is authorized.
The Datastore Appears but Cannot Be Written To
Check whether the datastore was mounted read-only. If it was intended to be writable, also inspect the NFS export permissions and the underlying server filesystem state.
- Review the Mount NFS read only selection made during creation.
- Verify that the NFS export grants read-write access.
- Confirm that the server-side filesystem has available space and permits writes.
The Datastore Is Not Visible on an Expected Host
A datastore added to one ESXi host does not automatically prove that every other host can access it.
- Confirm which host was selected in the datastore creation workflow.
- Verify VMkernel connectivity to the NFS network on every host that requires access.
- Authorize each required ESXi host in the NFS server's client access rules.
Exam-Relevant Notes
- NFS is file-based, IP-based storage; Fibre Channel is a different block-storage technology.
- The VMkernel adapter, not a virtual machine guest adapter, provides ESXi's NFS storage path.
- The export path must match the NFS server's exported directory exactly.
- NFS server export permissions determine which ESXi hosts can mount and use the share.
- A read-only mount prevents datastore writes even when the network connection and export are otherwise valid.
- Successful datastore creation requires both network reachability and server-side authorization.
For a repeatable configuration, plan the storage network first, verify the NFS export and client permissions, create the datastore on the intended host, and then test capacity, browsing, and the selected write policy.