VMware ESXi and vSphere Cluster Management

Configure VLANs on VMware ESXi Standard vSwitch Port Groups

Learn how to create ESXi standard vSwitch VM port groups, assign VLAN IDs, configure physical switch trunks, connect VMs, and verify VLAN connectivity.

Overview

A VLAN, or virtual LAN, is a logical Layer 2 broadcast domain identified by a VLAN ID. It lets administrators separate broadcast traffic even when devices use the same physical switching infrastructure.

VLANs can span multiple physical switches when the links between those switches carry the VLAN using IEEE 802.1Q tagging. Common benefits include a smaller broadcast scope, logical grouping independent of physical location, and separation of sensitive or departmental traffic.

In ESXi, VLAN configuration for ordinary virtual-machine networking is normally assigned to a VM port group. The guest operating system usually receives ordinary Ethernet frames and does not need to configure the VLAN tag itself.

How VLANs map to ESXi networking

A standard vSwitch is a virtual switch configured on one ESXi host. A VM network adapter connects to a VM port group. The port group belongs to a standard vSwitch, and the vSwitch connects through one or more physical uplinks to physical switch interfaces.

• Virtual machine network adapter: The virtual NIC selected in the VM settings.
• VM port group: A group of virtual ports with shared settings, including a VLAN ID.
• Standard vSwitch: Connects the port group to physical uplinks.
• Physical uplink: An ESXi physical network adapter attached to the vSwitch.
• Physical switch: Carries the VLAN traffic toward gateways, servers, and other network devices.

VMs attached to the same port group use that port group's VLAN configuration. Administrators normally create separate port groups for separate VLANs, using descriptive names such as VM-App-VLAN120, VM-Management-VLAN110, or VM-DMZ-VLAN300.

802.1Q tagging behavior

IEEE 802.1Q is the Ethernet standard used to identify VLAN membership with a tag. When traffic leaves an ESXi standard vSwitch through an uplink, ESXi handles VLAN tagging according to the VLAN ID assigned to the port group. Traffic returning from the physical network is associated with the matching VLAN and delivered to the relevant port group.

Tagged traffic carries an 802.1Q VLAN tag. Untagged traffic does not carry a tag and may be associated with a physical switch's native VLAN policy. The native VLAN behavior on the physical switch must match the ESXi network design; a mismatch can produce incorrect addressing or unexpected connectivity.

Guest VLAN tagging is different from normal port-group VLAN assignment. In a guest-tagging design, the operating system adds tags and the VM connection must be able to carry the required VLANs. Use VLAN 4095 only for such specialized configurations, not as a substitute for setting a normal port-group VLAN ID.

Prepare the physical switch

Every physical switch port connected to an ESXi uplink must permit every VLAN required by the port groups that can use that uplink. If multiple VLANs are carried, configure the ESXi-facing interface as an explicitly configured static 802.1Q trunk, using the syntax supported by that switch platform.

• Set the ESXi-facing interface to static trunk mode.
• Add each ESXi port-group VLAN to the trunk's allowed VLAN list.
• Define the native VLAN according to the network design.
• Apply consistent settings to redundant ESXi-facing switch ports.
• Ensure intermediate switch links and inter-switch trunks also carry the VLAN.
• Do not rely on dynamic trunk negotiation for ESXi uplinks; use an explicitly configured trunk where supported.

An access port normally carries one VLAN as untagged endpoint traffic. It is generally not suitable for an ESXi uplink carrying several VLAN-backed port groups. Exact physical-switch commands vary by vendor and operating system, so do not copy syntax between platforms without checking the switch documentation.

Create a VM port group on an existing standard vSwitch

The Host Client and vSphere Client labels can differ by ESXi or vSphere version, but the workflow is substantially the same.

1. Open the target ESXi host's networking configuration.
2. Choose Add networking, Add port group, or the equivalent networking action.
3. Select Virtual Machine as the connection type.
4. Select the option to create a VM port group on a standard switch.
5. Choose the existing standard vSwitch with the intended physical uplink connectivity, such as vSwitch0.
6. Enter a clear network label, such as VM-App-VLAN120.
7. Enter the intended VLAN ID, such as 120.
8. Review the vSwitch, port-group label, VLAN ID, and uplink details.
9. Complete the wizard and save the configuration.
10. Confirm that the new port group appears under the selected standard vSwitch.

Assign a VM to the VLAN-backed port group

1. Edit the virtual machine's settings.
2. Select the relevant virtual network adapter.
3. Choose the newly created port group as the adapter's network.
4. Confirm that the adapter is connected and that Connect at power on is enabled when appropriate.
5. Save the VM settings.

If a VM needs multiple networks, configure each virtual NIC with the correct port group. For example, one adapter might use an application VLAN while another uses a backup or management network. The guest still needs an IP address, subnet mask, gateway, DNS settings, or a DHCP lease appropriate to each selected VLAN.

Example: application VLAN 120

An ESXi host has vSwitch0 with two physical uplinks. The physical switch uplinks allow VLAN 120. Create VM-App-VLAN120 on vSwitch0 with VLAN ID 120. Connect the application's virtual NIC to that port group, then assign or obtain an address from the VLAN 120 subnet and test the VLAN 120 gateway.

Example: departmental separation

Create a Finance port group on VLAN 210 and an Engineering port group on VLAN 220. Attach each VM to the port group matching its department. Communication between the departments requires Layer 3 routing and must be controlled by the appropriate router, firewall, or access-control policy.

Example: moving a VM to another VLAN

1. Create the destination port group before changing the VM.
2. Confirm that the destination VLAN is carried across every relevant physical uplink.
3. Change the VM network adapter to the new port group during an approved maintenance window if disruption is possible.
4. Renew DHCP or apply the new static network settings.
5. Test the new gateway and application connectivity.

ESXi Shell commands

The ESXi Shell can inspect and configure standard-switch port groups. Confirm command availability and syntax for the installed ESXi version before making a production change.

esxcli network vswitch standard portgroup list

To add the example port group to vSwitch0:

esxcli network vswitch standard portgroup add --portgroup-name=VM-App-VLAN120 --vswitch-name=vSwitch0

To assign VLAN 120:

esxcli network vswitch standard portgroup set --portgroup-name=VM-App-VLAN120 --vlan-id=120

Substitute the local vSwitch name, port-group name, and VLAN ID. Inspect the result after each change rather than assuming that a successful command proves end-to-end connectivity.

Validation and testing

1. Verify the port-group name, VLAN ID, standard vSwitch association, and assigned physical uplinks.
2. Verify that the VM adapter is connected to the intended port group.
3. Test the VM's address and connectivity to a known host or gateway in the same VLAN.
4. When DHCP is used, confirm that the lease comes from the expected VLAN scope.
5. Check the physical switch's VLAN existence, trunk status, link state, and allowed VLAN list.
6. Test a destination in another VLAN only after local VLAN connectivity works.

VLAN separation is Layer 2 separation, not a complete security policy. Communication between different VLANs requires Layer 3 routing. If routed communication is available, firewall rules, ACLs, and other policy controls determine whether that communication is allowed.

Troubleshooting

VM has no connectivity on the new VLAN

• Compare the port-group VLAN ID with the approved VLAN plan.
• Confirm that the VM NIC uses the new port group and is connected.
• Check whether the physical switch port is a trunk rather than an access port.
• Confirm that the VLAN is in the trunk's allowed list and exists on the switching path.
• Check the guest address, subnet mask, gateway, and DHCP status.
• Test the local VLAN gateway before testing remote destinations.

Some VMs fail after uplink failover

This usually indicates inconsistent redundancy configuration. Compare every physical switch port used by the vSwitch, verify that each permits the VLAN, and confirm that intermediate trunks carry it. Where operational procedures permit, test connectivity with each uplink active.

VM receives an address from the wrong subnet

• Confirm the VM's selected port group and its VLAN ID.
• Review the physical trunk's native VLAN and untagged-traffic policy.
• Check DHCP scopes and relay behavior for the intended VLAN.

VMs on different VLANs communicate unexpectedly

• Verify that the VMs are not actually attached to the same port group or VLAN.
• Review router, firewall, distributed-firewall, and ACL rules between the VLAN subnets.
• Remember that VLAN separation alone does not block traffic when inter-VLAN routing is allowed.

Operational design considerations

• Use names that identify purpose and VLAN, such as application, management, storage, or DMZ networks.
• Document VLAN IDs, subnets, gateways, port groups, standard vSwitches, and uplinks.
• Assess all attached VMs before changing a production port group's VLAN assignment.
• Keep trunk configuration consistent across active and standby uplinks.
• Ensure redundant switch paths and intermediate trunks carry the same required VLANs.
• Distinguish VM traffic port groups from VMkernel networking used for ESXi management, vMotion, storage, fault tolerance, and other host services.

For related work, see Configure VLANs.

Exam-relevant notes

• A VLAN is a logical Layer 2 broadcast domain.
• A standard vSwitch is configured per ESXi host.
• For ordinary VM networking, configure the VLAN ID on the VM port group, not inside the guest.
• An ESXi uplink carrying multiple VLANs requires a physical switch trunk with the required VLANs allowed.
• VLAN 0 means no VLAN membership or priority-tagging behavior; VLAN 4095 is specialized guest trunking, not normal VM VLAN assignment.
• VLANs reduce Layer 2 broadcast scope, but routed communication between VLANs may still be possible.