VMware ESXi and vSphere Cluster Management

Create and Configure a Standard vSwitch in VMware ESXi

Learn how to create a VMware ESXi standard switch, assign physical NIC uplinks, create a VM port group, configure VLANs and failover, and verify connectivity.

A VMware standard switch, commonly called a vSS or standard vSwitch, provides Layer 2 virtual networking on one ESXi host. Virtual machines and VMkernel adapters connect to port groups, port groups connect to the standard switch, and physical NICs provide uplinks to the external network.

The vSS is not a replacement for a physical Ethernet switch. The vSS connects workloads inside the ESXi host to physical uplinks; the physical switch provides connectivity to other hosts, routers, gateways, storage systems, and clients.

How ESXi Standard Networking Fits Together

These objects form the normal traffic path:

A virtual machine network adapter or VMkernel adapter connects to a port group.
The port group applies settings such as its network label, VLAN ID, teaming policy, and security policy.
The port group connects to a standard switch.
The standard switch forwards traffic through one or more physical NICs, also called uplinks.
The external physical switch forwards traffic beyond the ESXi host.

A virtual machine therefore connects to a port group, not directly to a vSwitch. The port group is the network choice shown when you edit a VM's virtual network adapter.

Default Networking Created During ESXi Installation

A typical ESXi installation creates vSwitch0, along with a management port group and a virtual machine port group:

Object	Typical purpose	Connected endpoint	Typical initial state
vSwitch0	Default host-local virtual switch	Port groups and physical uplinks	Created during installation
Management Network	Host management traffic	ESXi management VMkernel adapter	Usually connected to vSwitch0
VM Network	Virtual machine traffic	Virtual machine network adapters	Usually connected to vSwitch0
New standard switch	A separate traffic domain or workload network	New port groups and selected uplinks	Created by an administrator
New VM port group	A named VM connection point with shared policies	Virtual machine network adapters	Created during or after switch creation

Names, uplink assignments, and even the presence of particular default port groups can vary according to installation choices and later host configuration. Confirm the actual host configuration before making changes.

Plan the New Standard Switch

Create a separate standard switch when a workload needs a distinct traffic path or operational boundary. Possible uses include production VM traffic, vMotion, storage, backup, replication, or an isolated test network. A separate switch is not automatically more secure; the VLAN, physical network, and security policies must support the intended separation.

Information to gather

The workload or traffic type and its required subnet.
The ESXi host and available physical NICs that can be assigned as uplinks.
The physical switch ports connected to those NICs.
The approved VLAN ID and whether the physical switch port is an access or trunk port.
The port group label, such as Production-VMs or Backup-Network.
The desired active, standby, and unused uplink order.
The load-balancing, failover, security, traffic-shaping, and MTU requirements.

When VMs may migrate between hosts, use consistent port group names and VLAN assignments on every participating host. A matching name with a different VLAN is not equivalent and can cause connectivity loss after migration.

Prerequisites and Access

Access to vCenter Server through the vSphere Client or vSphere Web Client equivalent for the installed release.
Privileges to configure networking on the target host.
An ESXi host present and connected in the inventory.
At least one suitable physical NIC. An unused NIC is preferred when designing a new isolated network.
Physical switch configuration that supports the chosen VLAN, trunking, link aggregation, MTU, and redundancy design.

Create a Standard Switch and VM Port Group

The Add Networking workflow can create the standard switch and its first virtual machine port group together. Interface names vary slightly between vSphere releases, but the process is conceptually the same.

Sign in to vCenter Server.
Open Hosts and Clusters and select the target ESXi host.
Open the host's networking management area. Depending on the release, this may be under Configure, Networking, or a related host management view.
Start Add Networking.
Choose Virtual Machine Port Group for a Standard Switch as the connection type.
Choose to create a new standard switch, rather than attaching the port group to an existing switch.
Select one or more physical network adapters to use as uplinks.
Review the uplink order and place adapters in Active, Standby, or Unused as required.
Enter a clear network label for the VM port group.
Enter the required VLAN ID.
Review the summary and finish the wizard.

Return to the host networking view and confirm that the new standard switch, its uplinks, and its VM port group are listed.

Example: isolated production VM network

Create vSwitch1.
Assign an available physical adapter as an active uplink.
Create the port group Production-VMs.
Set its VLAN ID to the production VLAN approved by the network team.
Attach a test VM and verify connectivity to the production subnet, gateway, DNS, and required application endpoints.

Understand Uplink Assignment and Failover Order

An uplink is a physical NIC assigned to a virtual switch. Its state controls whether it can carry traffic for a port group or switch policy.

Adapter state	Behavior	Typical use	Availability implication
Active	Eligible to carry traffic normally	Primary connectivity; multiple active uplinks when the design supports it	Provides normal service and possibly traffic distribution
Standby	Reserved until an active uplink fails	Simple failover design	Provides redundancy after failover
Unused	Does not participate in the policy	NIC reserved for another switch or deliberately excluded	Provides no connectivity for this port group

Move an available NIC from Unused to Active when it should carry traffic. Use two Active uplinks when the physical switching and teaming design supports that arrangement. Use one Active and one Standby when straightforward failover is preferred or when the upstream design does not support the selected load-balancing behavior.

A standard switch with no physical uplink can still provide communication between VMs connected to the same host-only port group, but it has no external connectivity. This is appropriate only for an intentional isolated test network.

Every selected NIC must have compatible external connectivity. Verify cabling, link state, physical switch port configuration, allowed VLANs, and any required trunk or aggregation settings.

Configure the VM Port Group

The port group label identifies the network when a VM is configured. Use a descriptive, stable label that communicates its purpose, such as Production-VMs, DMZ-VMs, or Test-Isolated.

VLAN ID choices

VLAN ID value or range	Meaning	Physical switch requirement	Typical use
0	ESXi does not add a VLAN tag for the port group	Usually an untagged/access design for that traffic	Untagged VM network
1-4094	Standard VLAN tagging using the selected VLAN ID	The physical path must carry the VLAN; trunk-capable ports are required when multiple tagged VLANs share an uplink	Ordinary VLAN-backed VM networks
4095	Virtual guest tagging, where applicable; guest systems handle VLAN tags	Requires a deliberate end-to-end design and appropriate physical VLAN handling	Specialized nested or guest-tagging workloads

VLAN ID 0 does not mean that traffic belongs to every VLAN. It means the ESXi port group sends the traffic without adding a VLAN tag. VLAN ID 4095 is not the normal choice for ordinary VM networks and has distinct design and security implications.

For VLAN IDs 1 through 4094, compare the port group value with the approved physical network design. If several tagged VLANs travel through one uplink, the upstream switch port must be configured to allow those VLANs, normally through a trunk configuration. Always validate VLAN changes with the network administrator before applying them.

Review Security, Teaming, and MTU Policies

Security policies

Standard switches and port groups expose policies for promiscuous mode, MAC address changes, and forged transmits. Promiscuous mode permits reception of frames not addressed to the VM. MAC address changes and forged transmits control whether a VM may change or transmit using a MAC address different from the expected address.

Default deny or reject behavior is generally appropriate. Allow an exception only for a documented workload, such as a network monitoring appliance or a particular virtualization design, and understand the security consequences before changing it.

NIC teaming and failover

NIC teaming uses multiple uplinks for redundancy and, depending on the policy, traffic distribution. The selected load-balancing method and failover behavior must match the physical switch capabilities and the cabling design. Review both the vSwitch policy and any port group-level override because a port group can use settings different from the switch defaults.

MTU

The maximum transmission unit is the largest packet size supported on a network path. If jumbo frames are required, the MTU must be consistent across the VM or VMkernel path, the standard switch, physical NICs, physical switches, and other devices in the path. A partial MTU change can cause fragmentation, dropped packets, or difficult-to-diagnose failures.

Verify the New Configuration

In the host networking view, confirm the standard switch name and the new port group.
Confirm that each intended physical NIC appears as Active or Standby according to the plan.
Check that assigned adapters report an operational link.
Inspect the port group's VLAN ID, teaming, failover, security, and traffic-shaping settings.
Connect a test VM network adapter to the new port group and ensure the adapter is connected.
Verify the VM's address, subnet mask, default gateway, and DNS configuration.
Test the expected subnet, gateway, DNS services, and workload-specific endpoints.
In a controlled maintenance window, test uplink failover if redundancy is part of the design.

Standard Switch Versus Distributed Switch

Characteristic	Standard switch	Distributed switch
Configuration scope	Configured independently on each ESXi host	Managed centrally and applied across participating hosts
Consistency across hosts	Must be repeated or standardized manually	Designed to provide shared configuration across hosts
Typical environment	Standalone hosts, small environments, or simple host-local networks	Environments needing centralized multi-host networking features
Management model	Host-level networking configuration	Central management through vCenter Server

A standard switch can be the appropriate choice for a standalone ESXi host or a small environment. In a multi-host environment, document and repeat equivalent settings on every host that may run the same VMs.

Operational Practices

Document the ESXi host, standard switch name, port group name, VLAN ID, physical NIC names, physical switch and port mappings, uplink order, load-balancing policy, MTU, and workload purpose.
Use identical port group labels and VLAN IDs on hosts that support vMotion or other VM relocation.
Confirm that destination-host uplinks reach the required VLAN before migrating a VM.
Apply active-network changes through change control and maintain a recovery plan.
When adding equivalent networking to several hosts, use a repeatable procedure or approved automation and verify each host individually.

Troubleshooting Common Problems

The port group is visible, but VMs have no external connectivity

Verify that a physical NIC is assigned as Active or Standby.
Check the physical adapter link status.
Confirm that the VM network adapter is connected to the intended port group.
Verify cabling and the physical switch-port state.

VMs connect locally but cannot reach the expected VLAN or gateway

Compare the port group VLAN ID with the approved design.
Confirm that the physical switch port allows the VLAN.
Check whether the port is configured as access or trunk as required.
Verify the guest IP address, subnet mask, and default gateway.

A VM loses connectivity after migration

Compare the port group label on the source and destination hosts.
Compare their VLAN IDs; identical names do not guarantee identical networks.
Verify that destination uplinks and upstream switch ports reach the required VLAN.

Uplink redundancy does not work

Check whether a second uplink is Active or Standby rather than Unused.
Verify the backup NIC and its physical switch port.
Review both vSwitch-level and port-group-level overrides.
Confirm that the teaming policy matches the physical switching design, then perform a controlled failover test.

The networking wizard cannot be started or completed

Confirm vCenter or host networking privileges.
Check that the ESXi host is connected and available.
Review current NIC assignments and confirm that an eligible adapter is available.

Exam-Relevant Notes

A vSS is host-local; it does not automatically synchronize configuration between ESXi hosts.
VMs connect to port groups, while VMkernel adapters provide host services such as management, vMotion, and storage.
Active uplinks carry traffic, Standby uplinks wait for failover, and Unused uplinks do not participate.
VLAN 0 means no VLAN tag is added by the port group; VLANs 1-4094 provide standard tagging; VLAN 4095 is for virtual guest tagging where applicable.
Consistent port group names alone are insufficient for migration; VLAN IDs and physical reachability must also match.

Further Study

After completing this procedure, continue with Create Standard Switches as a reference for standard-switch design and configuration.