VMware ESXi and vSphere Cluster Management

Network Configuration for iSCSI on VMware ESXi

Learn how to configure ESXi VMkernel networking for software iSCSI, including virtual switches, physical NICs, VLAN isolation, and multipathing.

Software iSCSI allows an ESXi host to access block storage by carrying SCSI commands over an IP network. The ESXi host uses its software iSCSI initiator to establish sessions with an iSCSI target on a SAN. Before target discovery can succeed, the host must have suitable network connectivity.

This lesson focuses on the ESXi network path between the software iSCSI initiator and the storage target. It covers VMkernel networking, virtual switches, physical NIC uplinks, network isolation, and single-path or multipath designs.

Why iSCSI Networking Matters on ESXi

iSCSI is a storage protocol that carries SCSI commands over an IP network. An ESXi host uses an iSCSI initiator to start storage sessions. The storage system provides an iSCSI target, which is the endpoint that presents block storage to the initiator.

The host needs a network path to the target's IP address. That path normally includes an ESXi VMkernel interface, a virtual switch, a physical NIC, a physical switch or storage network, and the storage system's target interface.

iSCSI traffic should be planned separately from virtual machine production traffic and host-management traffic. Separation can improve predictability, reduce contention, and limit which systems can communicate with the storage network.

Important terms

• SAN: A storage area network that provides block storage to hosts.
• Software iSCSI initiator: The ESXi software component that initiates iSCSI sessions to storage targets.
• iSCSI target: The storage-system endpoint that presents iSCSI storage to an initiator.
• VMkernel port or VMkernel adapter: An ESXi host network interface used by host services, including storage traffic.
• Virtual switch: The ESXi switching layer connecting VMkernel ports and virtual machines to physical network uplinks.
• Physical network adapter: A physical NIC in the ESXi host that connects to the physical network.
• Uplink: The association between an ESXi virtual switch and a physical NIC.
• Host-based multipathing: The use of multiple host-to-storage network paths to improve availability and potentially distribute I/O.

The VMkernel Port Requirement

Software iSCSI requires a VMkernel network adapter, also called a VMkernel port. This is a host interface for iSCSI communication; it is not a network interface assigned to guest virtual machines.

The VMkernel port is attached to an iSCSI port group on a standard virtual switch or distributed virtual switch. The virtual switch then uses one or more physical NIC uplinks to connect the VMkernel traffic to the storage network.

IPv4 settings

Configure the VMkernel adapter with the IPv4 settings required by the storage network:

• IP address: The address used by ESXi for communication with the iSCSI target.
• Subnet mask or prefix length: Defines which addresses are on the local IP subnet.
• Default gateway: The router used when the target is outside the VMkernel interface's local subnet. A gateway is not normally needed for a target on the same directly connected subnet, but routing requirements must be confirmed during design.

For example, a storage VMkernel adapter might use 10.20.30.10/24. The address must be valid for the iSCSI storage subnet and must not conflict with another device.

How the ESXi Network Components Fit Together

An iSCSI network path is built from several layers. The port group supplies the network policy and identifies the logical connection. The VMkernel port supplies the host IP identity. The virtual switch forwards the traffic, and its uplink sends the traffic through a physical NIC to the storage network.

Designing the iSCSI Virtual Switch and Uplinks

Create an iSCSI-specific port group on either a standard virtual switch or a distributed virtual switch. Attach the VMkernel adapter to that port group, then assign the physical NIC or NICs that reach the iSCSI storage network.

The physical adapter selection is important. A NIC connected only to the management network cannot provide a valid path to an isolated storage network. Confirm the physical cabling, switch port, VLAN, and target subnet before assigning the uplink.

A typical logical chain is:

VMkernel iSCSI adapter → iSCSI port group → virtual switch → physical NIC uplink → storage switch/network → iSCSI target

Single Physical NIC Setup

When only one physical NIC is available for software iSCSI, create an iSCSI port group on a virtual switch and attach a VMkernel adapter to it. Assign the available physical NIC as the virtual switch uplink.

1. Identify the physical NIC connected to the iSCSI storage network.
2. Create or select a standard or distributed virtual switch.
3. Create a port group with a name that identifies its storage purpose, such as iSCSI-Storage.
4. Assign the storage VLAN ID if the iSCSI network uses VLAN-based isolation.
5. Create a VMkernel adapter on the port group and enable it for the required storage or iSCSI service.
6. Assign an IPv4 address and subnet mask from the iSCSI storage subnet.
7. Configure a default gateway only when the target network requires routing through a gateway.
8. Verify that the physical NIC connects to the switch network containing the iSCSI target.

Example: an ESXi host has one storage NIC. The VMkernel adapter uses 10.20.30.10/24, and the physical NIC connects to the switch network that reaches a target at an address in the same storage subnet.

This design provides iSCSI connectivity, but it does not provide independent physical-path redundancy. A failed NIC, cable, switch port, or associated physical path can interrupt storage access unless another usable path exists.

Multiple Physical NICs and Host-Based Multipathing

With two or more physical NICs, separate physical paths can be used between the ESXi software initiator and the storage system. This supports host-based iSCSI multipathing, in which the host maintains more than one path to storage.

A multipath design requires distinct VMkernel networking paths associated with the intended physical uplinks. Do not assume that adding multiple NICs to one network configuration automatically creates independent storage paths. Each planned path needs working physical connectivity and must be able to reach the target.

The high-level design is:

• Use two or more physical NICs for storage connectivity.
• Connect the NICs through separate storage-network paths where possible.
• Create separate VMkernel storage interfaces or paths mapped to the intended physical adapters.
• Assign appropriate storage-subnet addresses to the VMkernel interfaces.
• Verify reachability from every intended path to the iSCSI target.
• Complete the iSCSI and storage multipathing configuration after the network paths are ready.

Multiple paths can provide redundancy and may allow I/O distribution, depending on the ESXi storage configuration, target capabilities, and selected path policy. Network redundancy is strongest when the paths do not share the same NIC, cable, switch port, or switching failure domain.

Isolating iSCSI Traffic

Storage traffic should be separated from virtual machine traffic, management traffic, and unrelated host services whenever practical. Isolation can be physical, logical, or a combination of both.

Physical isolation

Physical isolation uses dedicated ESXi NICs, dedicated physical switch ports, and dedicated switching infrastructure for iSCSI. Management and virtual machine traffic remain on separate physical paths.

This approach reduces contention and limits the effect of unrelated network problems. It also requires additional NICs, switch ports, cabling, and switching equipment.

Logical isolation with VLANs

When dedicated physical infrastructure is not possible, place iSCSI traffic on a dedicated storage VLAN. Configure the ESXi iSCSI port group with the VLAN assigned to the storage network, and configure the corresponding physical switch ports consistently.

The VMkernel storage address and the target interface address should belong to the planned iSCSI VLAN subnet. VLAN-based isolation separates traffic logically, but it still shares physical components with other networks and therefore may not provide the same fault isolation as dedicated hardware.

Network Planning Before Configuration

Plan the network before creating the VMkernel adapters. A written plan helps prevent duplicate addresses, incorrect VLANs, and designs that cannot support the intended number of paths.

• List every iSCSI target interface and its IP address.
• Choose the storage subnet or subnets for the ESXi VMkernel interfaces.
• Assign unique VMkernel IP addresses and confirm that they do not overlap with management or virtual machine networks.
• Confirm whether the target is on the local VMkernel subnet or requires routing and a default gateway.
• Count the physical adapters available for storage before choosing a single-path or multipath design.
• Map each storage NIC to its physical switch port, cable, VLAN, and intended path.
• Match the physical switch and VLAN configuration to the ESXi virtual-switch and port-group configuration.
• Verify that every intended VMkernel interface can reach the appropriate target network.

Example addressing plan

The addresses above are examples only. Use addresses, subnets, VLANs, and path relationships that match the actual storage design.

Practical Design Examples

Single-NIC iSCSI network

An ESXi host has one physical NIC assigned to storage traffic. Create an iSCSI port group on a virtual switch, attach a VMkernel adapter to it, and use the NIC as the uplink. Assign the adapter an address such as 10.20.30.10/24. Connect the NIC to the physical switch network that reaches the iSCSI target.

Dedicated physically isolated storage network

Reserve dedicated host NICs and physical switch ports for iSCSI. Keep management, virtual machine, and storage traffic on separate physical paths. Assign the VMkernel storage interfaces and target interfaces addresses from the dedicated storage subnet or subnets.

VLAN-isolated iSCSI network

When separate physical infrastructure is unavailable, place the iSCSI port group on a dedicated storage VLAN. Configure the corresponding physical switch ports to carry that VLAN and assign the VMkernel adapter an address from the VLAN's subnet.

Two-NIC multipath design

Use two physical NICs connected through separate storage-network paths. Create separate VMkernel storage paths associated with the different physical adapters. Verify that both paths can reach the same iSCSI storage system before configuring and testing multipathing.

Connection Workflow: From Networking to Datastore

1. Plan storage subnets, VLANs, target addresses, physical NICs, and path redundancy.
2. Create the iSCSI port group on a standard or distributed virtual switch.
3. Assign the correct physical NIC uplink or uplinks.
4. Create and configure the VMkernel storage adapter or adapters.
5. Verify IP configuration, VLAN consistency, physical link status, and target reachability.
6. Enable or configure the ESXi software iSCSI initiator.
7. Perform iSCSI target discovery using the configured network path.
8. Confirm that the expected storage devices appear to ESXi.
9. Configure storage multipathing where applicable.
10. Use the discovered storage for the appropriate datastore and VMFS workflow.

Network configuration is therefore a prerequisite for target discovery. If the initiator cannot reach the target network, later storage steps cannot succeed.

Troubleshooting iSCSI Network Connectivity

The ESXi host cannot discover or connect to an iSCSI target

• Verify that the iSCSI VMkernel port exists and has a valid IP address and subnet mask.
• Confirm that the VMkernel network can reach the target IP network.
• Check that the correct physical NIC is connected to the storage network.
• Confirm physical-switch connectivity, port status, VLAN configuration, and cabling.
• Check that the target is configured to accept the ESXi initiator.

The iSCSI VMkernel port is on the wrong network

• Compare the VMkernel IP address and subnet mask with the iSCSI target network.
• Verify the port group's VLAN ID.
• Verify that the physical switch port carries or assigns the intended storage VLAN.
• Check that the selected virtual switch uplink leads to the correct physical network.

A redundant design has only one usable path

• Confirm that more than one physical NIC is assigned for iSCSI.
• Check that each NIC has a functioning physical storage-network connection.
• Verify that each intended VMkernel storage path can reach the target.
• Look for shared cables, switch ports, VLAN errors, or other common failure points.
• Confirm that the additional path is configured for the intended iSCSI multipathing workflow.

Storage traffic competes with other traffic

• Determine whether iSCSI shares NICs or switching infrastructure with unrelated traffic.
• Move iSCSI to dedicated physical network components where possible.
• Otherwise confirm that a dedicated storage VLAN is applied consistently from the ESXi port group through the physical switching network.

Exam-Relevant Notes

• Software iSCSI uses an ESXi VMkernel adapter; a guest VM network adapter is not a substitute.
• The VMkernel adapter's IP address is used by the ESXi host for SAN communication.
• The virtual switch connects the VMkernel port group to physical NIC uplinks.
• One physical NIC provides connectivity but not independent physical-path redundancy.
• Multipathing requires multiple usable host-to-storage paths, not merely multiple configured IP addresses.
• Physical isolation and VLAN isolation are different: VLANs provide logical separation, while dedicated NICs and switches provide physical separation.
• The iSCSI port group must use the VLAN assigned to the storage network when VLAN isolation is used.
• Target discovery occurs after the initiator has a working network path to the target.

Summary

To configure software iSCSI networking on ESXi, provide a VMkernel adapter on an iSCSI port group, connect that port group through a virtual switch to the correct physical NIC, and assign valid storage-network IPv4 settings. Plan the storage subnet, VLAN, target reachability, and physical path count before configuration.

A single NIC can provide basic access but has a single physical failure path. Two or more correctly separated NIC paths can support host-based iSCSI multipathing and improve availability. Once network connectivity is verified, configure the software iSCSI initiator, discover the targets, and continue with storage-device and datastore configuration.

For the next storage-network reference, see Network Configuration for iSCSI.