VMware ESXi and vSphere Cluster Management
Virtual Switches in VMware vSphere and ESXi Explained
Learn how VMware ESXi virtual switches connect virtual machines, VMkernel services, physical NIC uplinks, VLANs, and external physical networks.
A virtual switch is a software-based Layer 2 networking component in an ESXi host. It performs switching functions for virtual machines and host networking services, much like an Ethernet switch, but it runs in software on the hypervisor.
vSphere is VMware's virtualization platform and management ecosystem. ESXi is the hypervisor installed on physical servers. An ESXi host contains virtual machines, virtual network components, physical network adapters, and the virtual switches that connect them.
A virtual switch connects virtual networking components to one another. When it has physical NICs assigned as uplinks, it also connects those virtual components to the external physical network. It does not provide every advanced feature available on a dedicated physical switch, so the virtual and physical network designs must work together.
How a virtual switch forwards traffic
A virtual machine connects its virtual NIC (vNIC) to a logical switch port through a virtual machine port group. The port group selects the logical network and provides shared settings for the virtual machines attached to it.
When an Ethernet frame enters the virtual switch, the switch identifies the virtual endpoints attached to its ports and forwards the frame toward the appropriate destination. The destination may be another virtual machine, a VMkernel adapter, or a physical network reached through an uplink.
- Local traffic: If two virtual machines on the same ESXi host belong to the same appropriate logical network, their traffic can be switched internally without traversing the physical network.
- External traffic: If a frame must reach another host, a physical server, a router, storage, or another external system, the virtual switch sends it through a physical NIC uplink.
The selected port group is important because it determines the logical network to which the VM or host service belongs. VLAN association is a common port-group setting and must match the intended physical-switch design.
Virtual-to-physical connectivity
A physical NIC (pNIC) is a physical Ethernet adapter installed in an ESXi host. When assigned to a virtual switch, it serves as an uplink. The uplink connects the virtual switch to a physical switch, which then connects the host to the wider network.
Physical NICs are assigned at the virtual-switch level rather than individually to every virtual port. Therefore, all port groups and ports on that switch share the physical NIC resources assigned to the switch.
For example, an ESXi host may have two pNICs assigned to one virtual switch. Several VM port groups and VMkernel port groups can use that switch. Their traffic shares the available uplink capacity and the configured resiliency behavior.
Virtual machine port groups
A virtual machine port group is a logical network attachment point used by VM vNICs. It groups virtual switch ports and supplies shared network settings for the attached VMs.
A VM port group can connect virtual machines to:
- Other virtual machines on the same ESXi host.
- Virtual machines on other ESXi hosts through physical network connectivity.
- Physical servers, routers, services, and other external networks through switch uplinks.
A port group commonly includes a VLAN association. The VLAN configuration must be compatible with the physical switch ports and the surrounding network design. A port group alone does not create an external connection; the virtual switch must have a usable uplink when traffic needs to leave the host.
VMkernel ports and adapters
A VMkernel port is distinct from a virtual machine port group. It is a host networking interface used by ESXi itself rather than by a guest operating system. The associated VMkernel adapter has host-level IP configuration, including an IP address, subnet mask or prefix, and gateway or routing context.
VMkernel networking carries platform and host-service traffic such as:
- ESXi host management.
- vMotion, which moves a running virtual machine between compatible hosts.
- iSCSI, an IP-based block-storage protocol.
- NAS/NFS, network-attached storage access commonly using NFS.
- Fault Tolerance logging, which synchronizes protected virtual machine execution state.
These services can be separated into different VMkernel adapters and port groups. Separation can support performance planning, security isolation, troubleshooting, and different VLAN or routing requirements. A VMkernel port group is not a replacement for a VM port group: the connection type must match the traffic source.
| Connection type | Primary purpose | Endpoint connected | IP configuration | Typical traffic |
|---|---|---|---|---|
| Virtual machine port group | Connect guest network interfaces to a logical network | VM vNICs | Configured in the guest operating system | Application, user, and guest operating system traffic |
| VMkernel port | Connect ESXi host services to a logical network | VMkernel adapter | Configured on the ESXi host | Management, vMotion, iSCSI, NFS, and Fault Tolerance logging |
Relationship between virtual-switch components
The basic hierarchy is:
- Physical NICs provide uplinks from the ESXi host to physical switches.
- The virtual switch contains virtual ports and uses the assigned uplinks when traffic must reach an external network.
- Port groups are defined on the switch and represent logical networks with shared settings.
- VM vNICs connect to virtual machine port groups.
- VMkernel adapters connect to VMkernel port groups for ESXi service traffic.
| Component | Connects to | Primary role |
|---|---|---|
| Physical NIC/uplink | Virtual switch and physical switch | Carries virtual-switch traffic to and from the physical network |
| Virtual switch | Uplinks, ports, and port groups | Performs software-based Layer 2 forwarding |
| Virtual machine port group | Virtual switch and VM vNICs | Provides a logical network attachment for guest traffic |
| VMkernel port group | Virtual switch and VMkernel adapters | Provides a logical network attachment for ESXi services |
| Virtual machine vNIC | VM port group | Presents a network adapter to a guest operating system |
| VMkernel adapter | VMkernel port group | Presents an IP-configured host interface for ESXi services |
Traffic-flow examples
Two virtual machines on one host
Suppose VM-App and VM-DB each have a vNIC connected to the same virtual machine port group. The port group belongs to a vSS or vDS and represents the same logical network for both VMs. If both endpoints are local to the host, the ESXi virtual switch can forward their frames internally. The traffic does not need to leave through a pNIC.
A virtual machine reaching the physical network
Suppose a VM connects to a production port group. That port group belongs to a virtual switch with one or more pNIC uplinks. The uplink connects to a physical switch port, allowing the VM to communicate with systems outside the ESXi host. The VM's guest IP address, subnet, gateway, VLAN path, and physical-switch configuration must all be correct.
Management and vMotion traffic
One VMkernel adapter may be configured for host management, while another is configured for vMotion. They may use separate VMkernel port groups and VLANs, or share infrastructure according to the design. Each participating host needs suitable VMkernel IP addressing and reachable network paths.
vSphere Standard Switch
The vSphere Standard Switch (vSS) is configured and managed independently on each ESXi host. Its port groups, uplink assignments, and related settings belong to that individual host.
The operational consequence is that comparable configurations must be created and maintained separately across hosts when consistency is required. A vSS is often suitable for smaller environments, simpler deployments, or networks that are intentionally host-specific.
vSphere Distributed Switch
The vSphere Distributed Switch (vDS) presents a common logical switch configuration across multiple associated ESXi hosts in a datacenter. Distributed port groups and network settings can be managed centrally, which helps maintain consistent configuration across hosts.
A vDS does not remove the need for host-level physical connectivity. Each participating host still uses its own physical NICs as uplinks, and those NICs must be mapped correctly to the distributed switch. The vDS centralizes logical configuration; it does not turn the hosts' physical adapters into one shared physical device.
| Feature | vSS | vDS |
|---|---|---|
| Management scope | Configured separately on each ESXi host | Common logical switch configuration across associated hosts |
| Configuration consistency across hosts | Administrators compare and maintain each host independently | Distributed port groups and settings are centrally managed |
| Typical environment | Small, simple, or host-specific designs | Multi-host environments needing consistent networking |
| Relationship to host physical NIC uplinks | Each host assigns its own pNICs to its local switch | Each participating host still maps its own pNICs as uplinks |
Conceptual network design considerations
Organizations commonly separate management, migration, storage, Fault Tolerance, and virtual-machine traffic. Separation can reduce contention, simplify security policy, support different VLANs and routing, and make service-specific failures easier to diagnose.
Shared uplinks require planning for:
- Bandwidth: Multiple port groups may compete for the same physical capacity.
- Resiliency: Multiple pNICs can provide availability when configured with suitable physical paths and teaming behavior.
- Traffic isolation: VLANs, separate port groups, and physical network policy can keep traffic types logically separated.
- Physical alignment: Virtual switch settings must match the VLANs, trunk or access behavior, speed, and connectivity of the physical switch ports.
NIC teaming is the use of multiple physical NIC uplinks for availability and, depending on configuration, capacity distribution. It should be designed together with the physical switch connections rather than treated as a virtual-only setting.
Conceptual configuration sequence
- Create or identify a virtual switch.
- Assign one or more physical NICs as uplinks when external connectivity is required.
- Create a virtual machine port group for guest VM traffic.
- Create a VMkernel port group and VMkernel adapter for each required ESXi service or service group.
- Set the required IP address, subnet mask or prefix, gateway, and routing information for VMkernel services.
- Associate the required VLAN settings with the relevant port groups.
- For centralized multi-host administration, create and use a distributed switch and distributed port groups.
Troubleshooting common virtual-switch problems
A VM communicates locally but cannot reach external systems
- Verify that the VM is connected to the intended port group.
- Confirm that the virtual switch has an active pNIC uplink.
- Check physical switch connectivity and the expected VLAN configuration.
- Verify the guest IP address, subnet, default gateway, and relevant network policy.
The host is manageable but vMotion does not work
- Confirm that a VMkernel adapter is enabled for vMotion.
- Verify its IP addressing and reachability to the corresponding hosts.
- Confirm the port group, VLAN, and uplink path.
- Check that vMotion networking is configured consistently on participating hosts.
VMkernel storage traffic cannot reach iSCSI or NFS storage
- Verify the VMkernel adapter assigned to storage traffic.
- Confirm the port group, VLAN, IP addressing, and physical uplink path.
- Validate reachability between the ESXi storage network and the storage target.
- Ensure storage traffic is not connected only to a VM port group.
A configuration works on one host but not another
- With a vSS, compare each host's switch, port-group, VLAN, and uplink settings.
- With a vDS, verify that the host is associated with the distributed switch and has correct pNIC uplink mapping.
- Confirm that the physical-switch ports for each host are configured consistently.
Key points to remember
- A virtual switch is ESXi software that performs Ethernet switching for VM and host networking endpoints.
- Port groups define logical network attachments; the selected port group determines network membership.
- VM vNICs use virtual machine port groups, while VMkernel adapters use VMkernel port groups.
- pNICs provide uplinks from the virtual switch to physical switches.
- Traffic between suitable local VMs can remain inside the host; external traffic uses an uplink.
- vSS configuration is host-local, while vDS provides centrally managed logical configuration across multiple hosts.
- Virtual networking must match physical-switch connectivity, VLAN design, bandwidth requirements, and redundancy goals.
For a focused reference, see Virtual Switch Explained.