VMware ESXi and vSphere Cluster Management
Configure VLANs on VMware ESXi Standard Switches
Learn how to create a VLAN-backed VM port group on an ESXi standard vSwitch, configure physical trunk prerequisites, connect a VM, and troubleshoot VLAN connectivity.
A VLAN lets you divide a physical Ethernet network into separate logical Layer 2 broadcast domains. On VMware ESXi, you normally connect a virtual machine to a VLAN by creating a VM port group on a standard virtual switch and assigning that port group a VLAN ID.
This lesson focuses on VM port groups on ESXi standard switches. It does not cover the different management workflow used by distributed switches. Before continuing, review VMware ESXi fundamentals and the basics of ESXi host networking.
VLAN fundamentals
A VLAN is a logical LAN identified by a numeric VLAN ID. It defines a Layer 2 broadcast domain: the group of devices that receive a Layer 2 broadcast. Devices in different VLANs are separated at Layer 2 even when they use the same physical switches.
A VLAN can span several physical switch ports and multiple interconnected switches. Trunk links carry traffic for multiple VLANs so that the same logical broadcast domain can extend between locations. The physical placement of a server or virtual machine does not have to determine its logical network membership.
Why use VLANs?
- Reduce unnecessary broadcast processing: broadcasts remain within the appropriate broadcast domain instead of reaching every device on a larger flat network.
- Group workloads independently of location: application servers, users, management systems, or storage systems can share a logical network even when they are connected to different physical ports or hosts.
- Isolate sensitive traffic: management, backup, server, user, and restricted workloads can be placed in separate Layer 2 segments.
VLAN separation is not the same as routing or firewall enforcement. Communication between different VLANs requires a Layer 3 device or service, such as a router, Layer 3 switch, or firewall. That device determines whether inter-VLAN traffic is allowed.
Important VLAN and ESXi terms
- IEEE 802.1Q: the Ethernet standard that identifies VLAN membership with a tag on a tagged frame.
- VLAN ID: the numeric identifier assigned to a VLAN and configured on an ESXi VM port group.
- Tagged frame: an Ethernet frame containing an 802.1Q VLAN identifier.
- Untagged frame: an Ethernet frame without an 802.1Q VLAN tag.
- Standard vSwitch: an ESXi-host-local virtual switch that connects virtual machines, VMkernel adapters, and physical uplinks.
- VM port group: a named virtual network connection on a vSwitch. It supplies a network label and settings, including the VLAN ID, to attached VM NICs.
- Network label: the name displayed to administrators when selecting a port group for a VM.
- Physical uplink: an ESXi physical NIC connection between a standard vSwitch and the physical network.
- Static trunk port: a physical switch port configured to carry multiple VLANs without dynamic trunk negotiation.
How 802.1Q tagging works with ESXi
ESXi supports IEEE 802.1Q VLAN tagging. The VLAN ID on a VM port group identifies the VLAN used by traffic from virtual machines connected to that port group.
In the usual ESXi port-group tagging model, the guest operating system sends and receives ordinary Ethernet frames. ESXi applies the configured VLAN tag when VM traffic leaves the host toward the physical network and removes the tag from traffic received from the physical trunk before delivering the frame to the VM.
| Traffic Direction | VM View | ESXi Port Group Action | Physical Network View |
|---|---|---|---|
| VM outbound traffic | The VM sends an untagged Ethernet frame through its virtual NIC. | ESXi associates the frame with the port group's VLAN ID and sends it toward the uplink with an 802.1Q tag. | The trunk carries the frame as traffic for the configured VLAN. |
| Traffic received from the physical trunk | The VM receives an ordinary Ethernet frame. | ESXi identifies the VLAN tag, removes it, and delivers the frame to the VM connected to the matching port group. | The switch sends a tagged frame toward the ESXi trunk. |
Standard vSwitch and VM port groups
A standard vSwitch is a virtual switch local to one ESXi host. It can connect VM network adapters to one or more physical uplinks. A VM port group is the network connection option presented to a VM and is created on a selected standard vSwitch.
Each port group can have its own network label and VLAN ID. A virtual machine joins a VLAN by selecting the corresponding port group for its virtual network adapter. The port group does not create the physical VLAN; it tells ESXi how to classify traffic leaving and entering that virtual network.
| Component | Where It Is Configured | Purpose | Example |
|---|---|---|---|
| Physical switch trunk | Physical switch interface connected to the ESXi host | Carries the required VLANs between the host and physical network | Static trunk allowing VLAN 120 |
| ESXi physical uplink | ESXi host networking configuration | Connects the standard vSwitch to the physical switch | vmnic2 assigned as a vSwitch uplink |
| Standard vSwitch | ESXi host | Provides local virtual switching between VMs, adapters, and uplinks | vSwitch0 |
| VM port group | On the selected standard vSwitch | Provides the VM network label and VLAN setting | App-VLAN120, VLAN ID 120 |
| Virtual machine network adapter | VM hardware settings | Connects the VM to a selected port group | Network connection set to App-VLAN120 |
Physical network prerequisites
The physical switch interface connected to the ESXi host must carry every VLAN required by the host's port groups. Configure that interface as a static trunk, and permit the required VLAN IDs on its allowed VLAN list.
The VLAN must exist and be active where required by the physical network design. Every intermediate physical switch trunk between the ESXi host and the destination network must also carry the VLAN. A trunk that permits VLAN 120 on the host-facing switch port does not help if an intermediate trunk removes VLAN 120.
These settings are separate from the ESXi port-group setting:
- The physical switch defines trunk behavior and which VLANs may cross the link.
- The ESXi port group assigns VM traffic to a VLAN ID within the virtual switching configuration.
- The guest operating system normally uses an IP address, subnet mask, gateway, and DNS settings for the target network; it does not normally configure the 802.1Q tag in this model.
Create a VLAN-backed VM port group
The vSphere Client labels can vary slightly by version, but the workflow is generally the following.
- Select the target ESXi host in the vSphere Client inventory.
- Open the host's networking management view.
- Start the workflow to add host networking or add a port group.
- Choose Virtual Machine Port Group for a Standard Switch.
- Select the existing standard vSwitch that will host the new port group.
- Enter a meaningful network label, such as
App-VLAN120. - Enter the required VLAN ID, such as
120. - Review the selected switch, network label, and VLAN ID.
- Finish the wizard.
- Confirm that the new port group appears under the selected standard vSwitch.
Example: application VLAN 120
Suppose an ESXi host has an existing standard vSwitch with physical uplinks, and the physical switch trunk permits VLAN 120. Create a port group with these values:
| Setting | Value | Reason |
|---|---|---|
| Switch | Existing standard vSwitch | Uses the host's existing virtual switching and physical uplinks |
| Network label | App-VLAN120 | Clearly identifies the workload network and VLAN |
| VLAN ID | 120 | Associates connected VM traffic with VLAN 120 |
The network label is an administrator-facing name. It does not need to match the physical switch's VLAN name, but using a consistent naming convention reduces mistakes.
Connect a virtual machine to the new VLAN
- Open the virtual machine's hardware or settings editor.
- Select the virtual network adapter that should use the new network.
- Set its network connection to the newly created VM port group, such as
App-VLAN120. - Confirm that the adapter is connected and, where applicable, set to connect at power on.
- Apply the change.
Changing the VM's selected port group places that VM interface on the port group's configured VLAN. The guest still needs appropriate IP addressing, subnet mask, default gateway, DNS settings, and firewall policy for the target network.
If the destination VLAN uses a different IP subnet, update the guest network configuration as part of the move. Changing only the port group does not automatically change the guest's IP address.
Validate VLAN connectivity
- Verify the port group's configured VLAN ID.
- Verify that the intended VM virtual NIC is attached to the correct port group.
- Check the guest's IP address, subnet mask, default gateway, DNS configuration, and local firewall.
- Test connectivity to an appropriate host or the default gateway on the target VLAN.
- Check the physical switch trunk status and allowed VLAN list if the test fails.
- Confirm that every intermediate trunk carries the VLAN and that the destination gateway or service is available.
A successful local ESXi configuration does not prove end-to-end VLAN reachability. The port group, uplink, physical trunk, intermediate switches, gateway, routing, and security policy must all agree.
| Check | Expected Result | What a Failure Usually Indicates |
|---|---|---|
| Port group VLAN ID | Matches the intended physical VLAN | Incorrect VLAN assignment or a mismatch between documentation and configuration |
| VM port group selection | The intended virtual NIC uses the new port group | The VM remains on its former network, or the wrong NIC was changed |
| Physical switch trunk status | The host-facing interface is an active static trunk | The uplink is connected to an access port or an incorrectly configured interface |
| Allowed VLAN list | The required VLAN is permitted on every relevant trunk | The VLAN is filtered on the host-facing or intermediate trunk |
| Guest IP configuration | Address and subnet match the target VLAN | Incorrect address, subnet mask, gateway, or local firewall settings |
| Gateway reachability | The VM can reach the target VLAN gateway | Physical VLAN, gateway, routing, ACL, or firewall problem |
Troubleshooting common failures
The VM cannot reach its default gateway
Compare the port-group VLAN ID with the intended physical VLAN. Inspect the physical switch interface and its allowed VLAN list. Confirm that the ESXi uplink is connected to the correct static trunk rather than an access port. Then verify the VM's IP address, subnet mask, gateway, and local firewall.
The port group exists, but the VM still uses its former network
Inspect the VM hardware configuration and the selected network for every virtual NIC. A VM with multiple adapters may have had the wrong adapter changed. Confirm which guest interface is active and whether its IP settings match the new network. If switch tools are available, validate the VM MAC address and the VLAN learned by the physical network.
Only one VLAN fails while other VLANs work
Compare the working and failing VLAN end to end. The failing VLAN may be omitted from an allowed VLAN list, absent or inactive on a physical switch, or blocked on an intermediate trunk. If Layer 2 transport is correct, check the VLAN-specific gateway, ACL, and firewall policy.
Separate VLANs do not communicate
This is expected without Layer 3 routing. VLANs are separate Layer 2 broadcast domains. Verify that a router, Layer 3 switch interface, or firewall interface exists for each subnet, and then check routing, ACL, and firewall rules between the VLANs.
Practical VLAN scenarios
Separate user-facing and restricted server networks
- Create one VM port group for the user-facing VLAN and another for the restricted server VLAN.
- Assign distinct VLAN IDs to the two port groups.
- Attach each VM NIC only to the port group appropriate for its role.
- Configure routing and firewall policy separately from the ESXi VLAN settings.
Layer 2 separation does not automatically enable or block routed inter-VLAN traffic. The Layer 3 gateway and security policy determine whether the networks can communicate.
Move a VM to another VLAN
- Create or confirm the destination port group and its VLAN ID.
- Change the VM's network adapter from the old port group to the destination port group.
- Update the guest IP settings if the destination VLAN uses a different subnet.
- Test gateway reachability and application connectivity.
Scope boundaries and exam notes
- A standard vSwitch is local to an individual ESXi host. Its port groups are managed in that host's standard-switch networking configuration.
- Distributed switches use a different management workflow and should not be treated as identical to standard vSwitches.
- The VLAN ID on an ESXi port group must correspond to a VLAN that the physical network carries; the port group does not create the physical VLAN.
- When ESXi performs port-group VLAN tagging, the guest normally sends untagged frames and does not need an in-guest VLAN configuration.
- VLAN configuration provides Layer 2 segmentation. Inter-VLAN communication requires Layer 3 routing and may also require firewall or ACL permission.
- When troubleshooting, check both virtual configuration and physical trunk configuration. Either side can prevent end-to-end connectivity.