VMware ESXi and vSphere Cluster Management

Configure an NFS Datastore on a VMware ESXi Host

Learn how to prepare VMkernel networking, verify NFS export permissions, and mount a writable or read-only NFS datastore in the vSphere client.

An NFS datastore lets an ESXi host use a directory exported by an NFS server as shared storage for virtual machine files. You prepare network connectivity, authorize the host on the NFS server, and then mount the export through the vSphere client.

How an NFS datastore works

NFS, or Network File System, is a protocol that presents a remote file export to an authorized client. An NFS datastore is an ESXi datastore backed by an exported directory on an NFS server.

The main components are:

ESXi host: The VMware hypervisor that mounts and uses the datastore.
VMkernel adapter: An ESXi host network interface, commonly named vmk0, vmk1, and so on, used for services such as storage traffic.
Virtual switch: A standard vSwitch or distributed switch that connects the VMkernel adapter to physical network uplinks.
Physical network: Switches, VLANs, routers, and links that carry traffic between ESXi and the storage system.
NFS server: The server or storage appliance that hosts the directory.
NFS export: The directory made available to approved clients.

ESXi uses the VMkernel storage network to contact the NFS server, mounts the exact export path, and exposes that remote directory as a datastore in vSphere. Virtual machine configuration files, virtual disks, templates, and other files can then be stored there.

Prerequisites

Complete the following preparation before opening the datastore wizard:

Requirement	Why It Is Needed	How to Verify
NFS export exists	ESXi can mount only a directory that the NFS server has exported.	Confirm the export with the storage administrator.
ESXi host is permitted by the export	Server-side access control determines whether the host can mount and write.	Check the export's client list or host access policy.
VMkernel adapter has an IP address	NFS storage traffic uses a VMkernel interface rather than a virtual machine port group.	Review the host's VMkernel networking configuration.
VLAN and physical uplinks are correct	The storage VMkernel traffic must reach the intended physical network.	Check the port group VLAN, switch configuration, and active uplinks.
NFS server is reachable	The mount operation requires a valid network path and permitted NFS traffic.	Validate addressing, routing, firewall rules, and reachability.
Exact export path is known	The folder field accepts the NFS server's export path, not a local ESXi path.	Copy the path supplied by the NFS administrator.
Access mode is decided	Virtual machine storage normally needs write access, while an ISO repository may intentionally be read-only.	Confirm whether the mount and server export should be read-write or read-only.

Prepare VMkernel networking for NFS

A VMkernel port is a host-side network endpoint used by ESXi services. NFS traffic should use a VMkernel adapter because it is host storage traffic; a virtual machine port group is not the correct interface for mounting an NFS datastore.

Configure or identify the storage VMkernel adapter

Choose a standard vSwitch or vSphere Distributed Switch that has connectivity to the NFS storage network.
Create or identify a VMkernel adapter, such as vmk1, assigned to the appropriate storage port group.
Assign an IP address and the correct subnet mask or prefix length. For example, a storage interface might use 192.0.2.21 with a storage subnet appropriate to your design.
Apply the correct VLAN configuration. The VLAN must be consistent across the ESXi port group, physical switch configuration, and NFS server network.
Confirm that the virtual switch has an operational physical uplink connected to the storage network.
When the NFS server is on another subnet, confirm routing and the applicable default gateway or VMkernel routing design.

A dedicated storage network is commonly used to isolate NFS traffic from management and virtual machine traffic. Isolation can improve predictability and limit access to storage services. In larger designs, consider multiple storage adapters or network paths, redundant uplinks, and the availability behavior supported by the ESXi and storage platform configuration.

For background on VLAN configuration, see Configure VLANs. If the VMkernel adapter is not ready, first review your procedure for storage network configuration concepts and your vSphere networking design.

Validate connectivity and access

Verify that the VMkernel IP, subnet mask or prefix length, and VLAN are correct.
Confirm that the NFS server address is reachable through the selected storage network.
Check physical switch links, uplinks, routing, and firewall rules.
Ensure required NFS traffic is allowed between the ESXi host and server.
If using a hostname, verify reliable DNS resolution from the ESXi environment and confirm that the resolved address is the intended storage address.

Create the NFS datastore in the vSphere client

The labels can differ slightly between vSphere releases, but the workflow follows the same sequence.

Select the intended ESXi host in the vSphere inventory. In a cluster, start with the host that should receive the mount.
Open the host's Datastores view.
Start the New datastore or equivalent datastore creation workflow.
Choose the correct host or location when the wizard asks where to create or mount the datastore.
Select NFS as the datastore type.
Enter a meaningful datastore name, such as NFS-Production-01.
Enter the NFS server hostname or IP address, such as 192.0.2.50.
Enter the exact exported folder path supplied by the NFS administrator, such as /exports/vmware/production.
Leave Mount NFS read only disabled for normal virtual machine storage. Enable it only when the datastore is intentionally a read-only repository, such as an ISO library.
Review the values, finish the wizard, and wait for vSphere to validate and mount the export.

Field	Value to Provide	Notes
Datastore name	`NFS-Production-01`	An administrator-defined label displayed in vSphere. Use a consistent naming convention.
Server	`192.0.2.50` or a reliable hostname	The NFS server address, not the ESXi address.
Folder or export path	`/exports/vmware/production`	The exact directory exported by the NFS server. It is not a local ESXi filesystem path.
Mount NFS read only	Disabled for VM storage; enabled for an intentional read-only repository	The mount option cannot provide write access if the server export itself is read-only.

Validate the mounted datastore

After the wizard completes, return to the host's datastore inventory and verify:

The datastore appears with the expected display name.
The datastore is associated with the intended ESXi host.
The capacity and free-space values are plausible for the NFS export.
The datastore reports as accessible and connected.
The mount is writable when virtual machine files will be stored there.

For a practical writable example, use the following values only as a pattern; replace them with the values from your environment:

Datastore name: NFS-Production-01
NFS server:    192.0.2.50
Export path:   /exports/vmware/production
Mount mode:    read-write

The name is chosen by the administrator, while the server address and export path must match the NFS server configuration exactly.

Access control and security

NFS server export permissions control whether an ESXi host can mount the directory and whether it can write to it. Configure host-based restrictions so that only approved ESXi VMkernel addresses or hosts can access the export.

Use read-write export permissions only for hosts and workloads that require them.
Use read-only permissions for content that hosts should consume but not modify.
Restrict NFS traffic to the authorized storage VLAN and hosts with firewall rules and switch controls.
Use a dedicated or appropriately isolated storage network where practical.
If using DNS names, ensure DNS records resolve reliably and consistently for every host that must mount the datastore.
Keep the server export policy and the vSphere mount mode aligned. Selecting read-write in vSphere cannot override a read-only server export.

Review access controls in NFS when designing export permissions. Apply least privilege: expose only the required export, to only the required ESXi hosts, over only the required network paths.

Shared datastore and operational planning

One NFS export can be mounted by multiple ESXi hosts when the NFS server permits every host and each host has a working VMkernel path to the storage network. Any host that may run a virtual machine must be able to access that VM's shared datastore.

Use consistent datastore names and export naming conventions across hosts and clusters.
Plan capacity for virtual disks, snapshots, templates, ISO files, and free-space requirements.
Plan performance for the expected workload, including network bandwidth, latency, NFS server resources, and storage media.
Use redundant network paths or uplinks where supported and test failover behavior.
Do not change an export path or server address while ESXi is actively using the mounted datastore. Plan changes, migrate or protect workloads as appropriate, and update the mount configuration through supported procedures.
For cluster features such as vMotion or high availability, confirm that all participating hosts can reach the shared datastore and that the broader cluster requirements are satisfied.

For related host administration, see add an ESXi host to vCenter Server inventory and VMware ESXi administration topics.

Troubleshoot common NFS datastore problems

Symptom	Likely Cause	Corrective Action
Mount fails	Incorrect server address or export path, missing route, blocked traffic, or missing host permission.	Confirm the exact values with the storage administrator; check the VMkernel path, VLAN, uplink, routing, firewall, and export policy.
Server cannot be reached	Incorrect IP configuration, VLAN mismatch, failed uplink, routing problem, or physical network issue.	Compare VMkernel addressing and VLAN settings with the storage network design; inspect switch links and routing.
Access denied	The NFS export does not authorize the ESXi host or its VMkernel IP address.	Add the required host to the export access policy and confirm the intended read-write or read-only permission.
Datastore is read-only	The mount option, server export, or server-side permissions prohibit writing.	Review the vSphere mount option and the NFS export policy; enable write access only when appropriate.
Datastore is not visible on another host	The second host lacks a VMkernel path, is not authorized, or has not mounted the export.	Compare VMkernel IP, VLAN, uplink, and routing settings; authorize and mount the same export on the additional host.
Hostname does not work	DNS is unavailable, resolves incorrectly, or returns an unreachable address.	Validate DNS and the resolved address. Use the approved server IP when hostname resolution is not reliable.
Slow or intermittent access	Network congestion, incorrect VLAN or uplink design, NFS server limits, or unstable physical connectivity.	Review network utilization and switch health, check NFS server performance, and verify redundancy and failover behavior.

Exam-relevant notes

NFS storage connectivity uses an ESXi VMkernel adapter, not a virtual machine port group.
The datastore name is a vSphere label; the folder value is the exact NFS server export path.
Server-side export permissions determine which ESXi hosts can mount and write to the export.
A read-only mount is appropriate only when the workload does not need to write datastore files.
Shared storage is useful only when every host that may run the workload has network access, authorization, and a mounted datastore.