VMware ESXi and vSphere Cluster Management

Physical and Virtual Networking in VMware ESXi

Learn how VMware ESXi connects virtual machines through virtual switches, port groups, physical NIC uplinks, NIC teaming, and VLANs.

Overview

An ESXi host is a physical server running VMware's hypervisor. It can run many virtual machines (VMs), each of which behaves like a software-defined computer with virtual hardware.

Networking is one part of that virtual hardware. A VM needs a network interface to communicate with other VMs, the ESXi host environment, physical LANs, and routed external networks. ESXi provides this connection through virtual Ethernet adapters, virtual switches, port groups, physical NICs, and VLAN configuration.

Why ESXi Needs Virtual Networking

A hypervisor cannot rely on a separate physical network adapter for every VM. Instead, it creates a software networking layer that represents Ethernet connectivity inside the host.

This layer allows VMs to communicate in two important ways:

  • Internal communication: VMs on the same ESXi host can exchange Ethernet frames through a virtual switch. The frames can remain inside the host and do not need to travel through a physical switch.
  • External communication: A VM can send traffic through a virtual switch, a physical NIC, and an upstream physical Ethernet switch to reach a LAN, the internet, or another external network.

Virtual networking therefore extends the physical network into the hypervisor. It does not replace the physical network. Physical switching, VLANs, IP routing, and gateway configuration are still required when traffic must leave the host or move between IP networks.

Core ESXi Networking Components

Virtual machine

A virtual machine is a software-defined computer running on the ESXi host. Its operating system sees virtual hardware, including one or more virtual Ethernet adapters.

Virtual Ethernet adapter

A virtual Ethernet adapter is the VM's software-based network interface. It is similar in purpose to a physical network card in a conventional server.

A VM may have one adapter for a simple workload or several adapters for separate networks, such as a production network and a backup network. Each adapter is connected to a selected ESXi port group.

Virtual switch

A virtual switch is an ESXi software switch. It primarily operates at Layer 2, the data-link layer, and forwards Ethernet frames between connected virtual ports and, when configured, physical uplinks.

Virtual switches use familiar Ethernet concepts: MAC addresses, frame forwarding, ports, VLANs, and forwarding information. The difference is that the switching function is implemented in software within the ESXi host rather than in a standalone physical switch.

Port group

A port group is a logical collection of virtual switch ports with a shared label and network policy configuration. VM administrators normally connect a VM's virtual Ethernet adapter to a port group rather than selecting an arbitrary switch port.

The port group's VLAN configuration and its virtual switch determine which Layer 2 network the VM can access.

Physical NIC and uplink

A physical NIC is a network adapter installed in the ESXi server. It is also commonly called an uplink when it connects a virtual switch to the external physical network.

The physical NIC connects to a port on a physical Ethernet switch. Traffic uses the physical NIC only when it must leave the ESXi host or when the virtual network design requires an external path.

Component Relationships

Component | Location | Primary role | Connects to

Virtual Ethernet adapter | Inside a VM | Sends and receives the VM's Ethernet traffic | VM operating system and virtual switch port group

Virtual switch | In the ESXi host | Forwards Layer 2 frames | VM-facing ports and optional physical NIC uplinks

Port group | ESXi virtual networking configuration | Groups ports and applies labels, VLAN settings, and policies | Virtual Ethernet adapters and a virtual switch

Physical NIC/uplink | Installed in the ESXi host | Carries traffic between the virtual switch and external networks | Virtual switch and physical Ethernet switch

Physical Ethernet switch | External physical network | Switches frames between physical devices and network links | ESXi uplinks, servers, routers, and other network devices

How a Virtual Switch Forwards Traffic

When an Ethernet frame enters a virtual switch, the switch examines the destination MAC address. A MAC address is a hardware-style Layer 2 address used to identify an Ethernet endpoint.

The virtual switch learns which MAC addresses are reachable through which ports. This information is stored in a forwarding table. When the destination MAC address is known, the switch forwards the frame toward the corresponding port. If the destination is unknown, the switch may send the frame through eligible ports so the destination can be discovered.

This is the same basic Layer 2 behavior used by a physical Ethernet switch. The important distinction is that the ESXi switch connects virtual ports and optional physical uplinks inside the host.

Common VM Connectivity Paths

VM-to-VM communication on the same host

Suppose VM-App and VM-DB each have a connected virtual Ethernet adapter. Both adapters use the same port group, and that port group belongs to the same virtual switch.

The path is:

VM-App virtual adapter -> port group -> virtual switch -> port group -> VM-DB virtual adapter

The frame can be switched entirely inside ESXi. No physical NIC or external physical switch is required for this local path.

VM communication with an external network

Suppose a VM connects to a port group on a virtual switch that has an active physical NIC uplink. The uplink connects to a physical Ethernet switch.

The path is:

VM virtual adapter -> port group -> virtual switch -> physical NIC/uplink -> physical switch -> external network

This path works only when the virtual networking, VLAN settings, physical switch configuration, VM IP address, subnet, and default gateway are correct.

Traffic to another VLAN or routed network

Traffic destined for a different IP subnet normally reaches the VM's default gateway. The gateway provides Layer 3 routing between networks. The traffic may first cross the ESXi virtual switch and physical uplink, then be routed by a physical or virtual router.

A virtual switch primarily performs Layer 2 switching. It does not automatically provide IP routing simply because a VM is connected to it.

Source | Destination | Virtual switch requirement | Physical uplink required | Typical use case

VM to VM on the same virtual switch | Another VM on that switch | Both adapters use compatible ports and VLAN settings | No, if traffic remains local | Application server communicating with a local database VM

VM to VM on different isolated virtual switches | A VM attached to another switch | An intentional connection or routing path is required | Usually, unless another internal path exists | Separating production and test networks

VM to external LAN | Physical network outside the host | The VM's port group must connect to an uplinked switch | Yes | Accessing users, services, or storage on the LAN

VM to a different VLAN or routed network | Another IP network | VLAN and gateway paths must be correctly configured | Commonly yes | Reaching a management, services, or internet network

Multiple Virtual Switches and Isolation

One ESXi host can contain multiple virtual switches. Each virtual switch is a separate Layer 2 switching domain with its own ports and forwarding information.

A frame entering one virtual switch is forwarded only among eligible ports on that same switch. It is not automatically delivered to ports on another virtual switch.

This separation can support network segmentation. For example, production VMs can use one switch or port group while test VMs use another. If the test switch has no uplink, its traffic can remain isolated from the physical network. If both networks have uplinks, their VLAN and routing design must still prevent unintended access.

Isolation is not an automatic security guarantee. Incorrect port-group assignments, broad trunk configurations, unexpected routing, or unsuitable virtual switch security policies can weaken the intended separation.

Physical NIC Uplinks and NIC Teaming

A virtual switch can use one or more physical NICs to reach external networks. Associating multiple physical NICs with a virtual switch is called NIC teaming.

NIC teaming commonly provides two benefits:

  • Redundancy and availability: If one physical NIC, cable, or connected switch path fails, traffic can continue through another available uplink, provided the teaming and physical-switch design support failover.
  • Greater aggregate capacity: Multiple links can provide more total host uplink capacity across many flows.

Aggregate bandwidth is not the same as the bandwidth of one VM flow. For example, two 10 Gb/s uplinks may provide up to 20 Gb/s of combined capacity for suitable traffic, but one individual connection may still be limited by its selected path, load-balancing behavior, protocol characteristics, and the capabilities of the endpoints.

Redundancy also requires more than assigning two NICs in ESXi. The physical switch connections, VLAN permissions, link states, and failover policies must be compatible.

VLAN Segmentation

A VLAN is a logical Layer 2 network segment identified by a VLAN ID. VLANs allow multiple separate networks to share switching infrastructure while remaining separated at Layer 2.

In ESXi, a port group commonly represents a VM-facing network and includes a VLAN configuration. VMs connected to that port group are placed into the corresponding logical network, subject to the configuration of the virtual and physical switching paths.

Access-style connectivity

An access-style connection carries traffic for one VLAN. It is appropriate when the connected network path is intended to represent one specific VLAN.

Trunk-style connectivity

A trunk-style connection carries traffic for multiple VLANs, typically using VLAN tags. An ESXi uplink connected to a trunk-configured physical switch port can support several VLAN-backed port groups through shared physical infrastructure.

The physical switch port connected to the ESXi uplink must be configured compatibly. If a port group expects VLAN 10 but the physical switch does not permit VLAN 10, external connectivity will fail. If a trunk carries VLANs that are not intended for a workload, an overly broad design may create unintended connectivity.

Connectivity model | VLAN scope | Typical use | Physical-switch requirement

Single-VLAN/access-style connection | One VLAN | A VM network with one intended Layer 2 segment | The ESXi-facing path must present or permit the selected VLAN in an access-compatible design

Multi-VLAN/trunk-style connection | Multiple VLANs | Several port groups and workload networks sharing uplinks | The physical switch uplink must carry the required VLANs and use compatible tagging behavior

Isolated virtual switch with no uplink | Internal Layer 2 domain | Communication among selected local VMs without external access | No physical uplink; VM assignments must still be controlled

Physical and Virtual Networking Compared

Networking behavior | Virtual switch | Physical switch | Administrative consideration

Layer 2 frame forwarding | Software forwarding among virtual ports and uplinks | Hardware or appliance forwarding among physical ports | Both require correct endpoint and port relationships

MAC address forwarding information | Learns MAC locations on virtual ports and uplinks | Learns MAC locations on physical ports | Unexpected MAC movement can indicate configuration or topology problems

VLAN segmentation | Port groups and virtual switch paths apply VM-side VLAN connectivity | Physical switch ports permit or restrict VLANs | VLAN IDs and tagging behavior must match across the boundary

Uplink connectivity | Uses physical NICs to leave the host | Uses cables and network interfaces to connect devices | An uplink is the bridge between virtual and physical switching domains

Traffic isolation | Separate switches, port groups, VLANs, and policies can separate VMs | VLANs, port configurations, and routing controls separate physical networks | Isolation must be designed and verified end to end

Redundancy through multiple links | NIC teaming provides multiple host uplink choices | Physical switching and cabling provide alternate paths | Both sides must support the intended failover design

Security Implications of Virtual Switch Isolation

Separate virtual switches and VLANs can reduce unintended Layer 2 connectivity. A VM cannot communicate with a network merely because that network exists somewhere on the physical infrastructure. It needs an appropriate virtual adapter, port group, virtual switch path, VLAN configuration, uplink, and—when crossing subnets—an IP routing path.

However, isolation depends on correct configuration. Review the following whenever designing or auditing separation:

  • Which port group each VM adapter uses.
  • Whether the port group is connected to the intended virtual switch.
  • Whether the virtual switch has an uplink.
  • Which VLAN ID the port group uses.
  • Which VLANs the physical switch permits on the ESXi-facing port.
  • Whether routing or firewall devices intentionally connect the separated networks.
  • Whether virtual switch security policies match the required workload behavior.

Conceptual Configuration Workflow

  1. Create or identify a virtual switch on the ESXi host.
  2. Assign one or more physical NICs as uplinks when external connectivity is needed.
  3. Create VM port groups on the virtual switch.
  4. Assign the required VLAN ID to each port group when VLAN segmentation is used.
  5. Connect each VM virtual Ethernet adapter to its intended port group.
  6. Configure the connected physical switch to permit the required VLANs on ESXi-facing uplinks.
  7. Configure NIC teaming and failover behavior when multiple uplinks are present.
  8. Configure VM IP addresses, subnet masks, and default gateways appropriate to the selected network.

This workflow describes relationships rather than product-specific command syntax. Configuration must be consistent from the VM adapter through the port group and virtual switch, across the physical NIC and switch, and into the external network.

Troubleshooting Virtual Networking

Two local VMs cannot communicate

  • Verify both virtual adapters are connected and enabled.
  • Verify both adapters use the intended port group.
  • Verify their VLAN settings are compatible.
  • Verify both VMs have valid IP addresses and subnet configuration.
  • Check whether the VMs are on separate virtual switches or intentionally isolated networks.

A VM reaches local VMs but not the external network

  • Verify that the virtual switch has an active physical NIC uplink.
  • Verify the physical NIC has link connectivity.
  • Verify the physical switch port is active and configured for the required VLAN.
  • Verify the VM has the correct default gateway and that external routing is available.

VMs on one VLAN cannot communicate as expected

  • Confirm the VLAN ID assigned to the ESXi port group.
  • Confirm that the VLAN exists and is permitted across the physical switch path.
  • Check for an access-style versus trunk-style configuration mismatch.
  • Verify that the endpoints are on the same VLAN or have an appropriate Layer 3 routing path.

Connectivity stops after an uplink fails

  • Verify that more than one physical NIC is assigned to the virtual switch.
  • Verify the teaming and failover policy recognizes the secondary uplink.
  • Verify both physical switch connections support the required VLANs and redundancy design.
  • Check the physical link state and the configuration of the remaining uplink.

A workload unexpectedly reaches another segment

  • Review virtual switch and port-group assignments.
  • Review VLAN IDs and physical uplink VLAN permissions.
  • Check whether a shared port group or trunk-capable configuration was used unintentionally.
  • Review routing paths that may legitimately connect the apparently separate VLANs.

Summary

  • A VM uses a virtual Ethernet adapter to send and receive Ethernet traffic.
  • An ESXi virtual switch forwards Layer 2 frames between VM-facing ports and optional physical uplinks.
  • VMs on the same virtual switch can communicate locally without using a physical NIC.
  • External traffic normally travels through a physical NIC uplink to a physical Ethernet switch.
  • Multiple virtual switches create separate Layer 2 switching domains.
  • NIC teaming provides uplink redundancy and can increase aggregate host capacity, but does not necessarily increase the bandwidth of one flow.
  • Port groups and VLANs define which logical networks VM adapters can access.
  • Virtual networking extends the physical network design, so both ESXi and physical switch configuration must agree.

For a related reference within this course, see Physical and Virtual Networking.