VMware ESXi and vSphere Cluster Management

Physical and Virtual Networking in VMware ESXi

Learn how ESXi physical NICs, virtual NICs, virtual switches, uplinks, port groups, VLANs, and teaming provide connectivity for VMs and host services.

What ESXi Virtual Networking Does

VMware ESXi provides software-defined network connectivity for virtual machines and host services. Instead of connecting every virtual machine to its own physical network cable and switch port, ESXi uses software components that forward Ethernet traffic inside the host and, when necessary, through physical network adapters.

An ESXi host is the physical server running the ESXi hypervisor and hosting virtual machines. Traffic can remain inside that host, or it can leave through a physical NIC when the destination is outside the host.

  • Local traffic: Two virtual machines on the same host and the same relevant Layer 2 network can communicate through the ESXi virtual switch without using a physical switch.
  • External traffic: Traffic destined for a physical server, another ESXi host, an internet router, or another external network needs an appropriate physical uplink and physical-network path.

Local switching still follows Ethernet principles. Virtual machines use virtual Ethernet adapters, MAC addresses, Ethernet frames, and Layer 2 forwarding even though no separate physical switch is required for traffic that stays within the host.

Core ESXi Networking Components

ESXi networking is easier to understand when each component is assigned a specific role.

Physical NIC (pNIC): A physical Ethernet adapter installed in the ESXi host. It connects the host to a physical switch.

Virtual NIC (vNIC): A virtual Ethernet adapter presented to a virtual machine. A VM can have one or more vNICs.

Virtual switch: A software Layer 2 switch inside ESXi. It connects VM network ports and host network ports, then forwards Ethernet frames.

Port group: A named collection of virtual switch ports with common settings, such as VLAN membership and traffic policies. A VM vNIC or VMkernel adapter connects to a port group.

Uplink: The association between a virtual switch and a physical NIC. An uplink carries traffic between the virtual switch and the external physical network.

Physical switch: The external Ethernet switch to which ESXi pNICs are connected. Its port configuration must agree with the ESXi VLAN and uplink design.

A useful simplified relationship is:

VM vNIC -> Port group -> Virtual switch -> Uplink -> ESXi pNIC -> Physical switch

How a Virtual Machine Connects to a Network

Each vNIC in a virtual machine is connected to a selected port group. The port group places that vNIC on a particular virtual network and applies the relevant VLAN and network policies.

  1. Add or identify a vNIC in the virtual machine configuration.
  2. Connect the vNIC to the intended port group.
  3. Ensure the guest operating system has the correct IP address, subnet mask, default gateway, and other required settings.
  4. Verify that the port group has a usable virtual-switch path and, for external connectivity, an appropriate physical uplink.

A VM can have multiple vNICs. For example, one vNIC can connect to a Production-VMs port group while another connects to a separate Backup port group. This lets the guest participate in two networks, provided that its routing and security configuration are designed intentionally.

Local VM-to-VM Communication

Suppose two VMs are connected to the same port group, VLAN, and virtual switch on one ESXi host. When one VM sends an Ethernet frame to the other, the virtual switch can forward the frame internally. The traffic does not need to travel out a pNIC and return through a physical switch.

If two VMs are connected to different isolated virtual switches, their ports are not automatically connected. Communication requires an intentional connection between the networks, such as a suitable routed or firewall-based design. Merely placing both switches in the same ESXi host does not bridge them.

Communication with an External Network

When a VM needs to reach an external server, router, or another network, the frame travels from the vNIC to its port group and virtual switch. The virtual switch forwards it through an available uplink and pNIC to the physical switch. The physical network then supplies the remaining Layer 2 and Layer 3 path.

For a VM on one ESXi host to reach a VM on another host, the traffic normally leaves the first host through a pNIC, crosses the physical switching infrastructure, and enters the second host through one of its pNICs. The hosts and physical switches must provide a compatible network and VLAN path.

Virtual Switch Forwarding Behavior

A virtual switch operates primarily at Layer 2, the data-link layer where Ethernet frames and MAC addresses are used. Like a physical switch, it learns which MAC addresses are reachable through which ports.

The switch maintains a MAC address forwarding table. When it receives a frame, it can use the learned destination MAC address to select the appropriate virtual port or uplink.

  • Known unicast: A destination MAC address is in the forwarding table, so the frame is sent toward the learned destination port.
  • Unknown unicast: The destination is not yet known, so the switch handles it using normal switching behavior until the destination is learned.
  • Broadcast: The frame is delivered to the applicable ports in the same Layer 2 forwarding domain.
  • Applicable multicast: The frame is handled according to normal switching and multicast-related configuration.

An ESXi host can contain multiple virtual switches. Each virtual switch is logically separate and maintains its own forwarding domain and forwarding table.

Virtual Switch Isolation and Security

Ports on separate virtual switches are not automatically able to communicate because the switches do not share a forwarding domain. This separation can reduce unintended traffic exposure between networks such as management, production, and backup.

Virtual-switch separation is not a complete security design. It does not replace deliberate VLAN segmentation, routing controls, firewalls, guest operating-system security, access control, or appropriate virtual-switch security policies. Treat isolation as one design mechanism rather than as proof that a network is secure.

Connecting a Virtual Switch to the Physical Network

An uplink maps virtual-switch traffic to a physical NIC. A virtual switch can have one uplink or multiple uplinks.

Local VM traffic:
VM A vNIC -> port group -> virtual switch -> VM B vNIC

External traffic:
VM vNIC -> port group -> virtual switch -> uplink -> pNIC -> physical switch -> destination

Traffic destined for a VM on the same host and the same relevant Layer 2 network can be switched internally. Traffic destined for an external network requires an appropriate uplink, a connected pNIC, a compatible physical-switch port, and a valid physical-network route.

The physical switch port connected to an ESXi pNIC must be configured consistently with the VLAN requirements of the ESXi uplink. If the ESXi port group expects a VLAN that the physical switch does not carry, external connectivity fails even when the VM and virtual switch configuration appears correct.

NIC Teaming, Availability, and Bandwidth

NIC teaming uses multiple physical NICs as uplinks for a virtual switch. Administrators commonly use teaming to improve availability, provide alternate physical paths, and distribute traffic.

  • Redundancy and failover: If an active pNIC, cable, or switch path fails, eligible traffic can move to another available uplink.
  • Traffic distribution: A teaming and load-balancing policy determines which uplink carries traffic during normal operation.
  • Bandwidth planning: Multiple uplinks can increase the capacity available across multiple traffic sources, but they do not necessarily combine into a larger pipe for one individual traffic flow.

For example, two pNICs may allow many VMs to use both physical links while also providing failover. A single TCP session may still use only one selected path, depending on the teaming and load-balancing design.

Availability: Multiple uplinks provide another path when an active adapter or link fails. They do not remove the need for compatible cabling and physical-switch configuration.

Traffic distribution: Policies can distribute traffic across available uplinks. The exact distribution depends on the selected policy and traffic pattern.

Single-flow bandwidth: Multiple uplinks do not automatically aggregate into greater bandwidth for one individual flow.

VLAN Segmentation

A VLAN is a logical Layer 2 network segment identified by a VLAN ID. VLANs allow multiple logical networks to share physical switching infrastructure while keeping their Layer 2 traffic separated.

In ESXi, VLAN membership is commonly configured at the port-group level. VM vNICs connected to that port group use the port group's VLAN behavior.

VLAN ID 0: No VLAN tagging by the ESXi port group. Use this when the connected design expects ordinary untagged traffic. The physical switch must be configured for the corresponding untagged or access-style behavior.

Single VLAN ID: Associates the port group with one VLAN for ordinary virtual-machine connectivity. The physical path must carry that VLAN in a compatible manner.

VLAN ID 4095: Enables VLAN trunking to a connected guest or appliance, allowing tagged traffic for multiple VLANs to reach that guest or appliance. Use this intentionally and only when the guest or appliance is designed to process VLAN tags.

Access-style usage associates a port group with one VLAN for typical VM connectivity. Trunk-style usage carries multiple VLANs and is appropriate for certain firewalls, routers, and network appliances that need to receive or generate tagged traffic.

ESXi port-group settings and physical-switch settings must agree. For a single-VLAN design, the physical switch might provide the intended access-style network. For a trunk design, the physical switch port must permit the required VLANs. Do not select VLAN ID 4095 merely to solve an unknown connectivity problem; it changes the expected behavior and can expose or mis-handle traffic if the guest and physical network are not designed for trunking.

vSphere Standard Switch and Distributed Switch

vSphere Standard Switch

A vSphere Standard Switch (vSS) is configured independently on an individual ESXi host. Its virtual ports, port groups, uplinks, VLAN settings, and policies belong to that host's configuration.

vSphere Distributed Switch

A vSphere Distributed Switch (vDS) is managed centrally and provides a switch configuration across multiple ESXi hosts. This can improve consistency for distributed port groups, VLAN settings, uplinks, and policies.

The shared concepts remain the same with either switch type: virtual ports connect to vNICs or host services, port groups apply common settings, uplinks connect to pNICs, VLANs provide Layer 2 segmentation, and the switch forwards frames. A vDS changes how configuration is managed; it does not change the basic relationship between virtual and physical networking.

Common Network Design Considerations

  • Separate management, virtual-machine, storage, vMotion, backup, and other traffic types when the environment's security, performance, or availability requirements call for it.
  • Use port-group names that clearly identify purpose, such as Management, Production-VMs, vMotion, or Backup.
  • Assign VLAN IDs according to a documented network plan rather than choosing them ad hoc.
  • Plan pNIC capacity and redundancy according to workload, service importance, and expected failure scenarios.
  • Ensure that the physical switch, virtual switch, VLAN configuration, and VM port-group placement all agree.
  • Use separate vNICs for separate VM networks only when the guest routing and security design supports that arrangement.

A simple segmented design might use one management port group, one production VM port group, and one storage or backup port group. Each can have a clearly documented VLAN and appropriate uplink and physical-switch treatment.

Configuration Checklist

Create or Identify a Virtual Switch

  • Choose a vSS or vDS design.
  • Associate the required physical NIC uplinks.
  • Review teaming and failover settings.

Create or Review a Port Group

  • Choose a descriptive port-group name.
  • Assign the port group to the intended virtual switch or distributed switch.
  • Set the VLAN ID deliberately: 0, one specific VLAN, or 4095 for an intentional trunk-to-guest or appliance design.
  • Review security and traffic policies as required by the environment.

Connect a Virtual Machine

  • Add or select the VM's vNIC.
  • Connect it to the intended port group.
  • Confirm that the virtual device is connected and that the guest operating system has correct IP configuration.

Configure the Physical Switch

  • Connect each ESXi pNIC to the intended physical switch port.
  • Match the switch-port VLAN mode to the ESXi port-group design.
  • Permit required VLANs on trunk links.
  • Provide redundant physical paths where service requirements justify them.

Practical Network Scenarios

Two VMs on One ESXi Host

Place both VMs in the same port group and VLAN on the same virtual switch. Their Ethernet traffic can be switched locally by ESXi and does not need to exit an uplink merely to reach the other VM.

A VM Reaching an External Server

The VM sends traffic through its vNIC to the assigned port group and virtual switch. The switch forwards the frame through an uplink pNIC to the physical switch, which provides the path to the external server.

Separating Production and Management

Create distinct port groups such as Production-VMs and Management, assign appropriate VLAN IDs, and connect each service to its intended port group. The separation must also be supported by physical switching, routing, firewall, and access policies.

Uplink Redundancy

Attach two pNICs to a virtual switch and configure an active/standby or another suitable teaming policy. If one physical link or adapter becomes unavailable, eligible traffic can use the remaining uplink.

A VM with Two Networks

Assign one vNIC to a production port group and another vNIC to a backup port group. The VM can participate in both networks while the networks remain separated by their port-group and VLAN design.

A Virtual Network Appliance Requiring Multiple VLANs

Use a dedicated trunking port group when a firewall, router, or other appliance must receive tagged traffic for multiple VLANs. Coordinate the ESXi port-group setting, guest or appliance configuration, physical-switch trunk, and allowed VLAN list.

Traffic Path Reference

VM to VM on the same virtual switch and VLAN: Usually stays inside the host. Required components are both vNICs, the common port group or compatible Layer 2 domain, and the virtual switch.

VM to VM on different isolated virtual switches: Does not automatically communicate. The networks need an intentional routing, firewall, or bridging design.

VM to an external network: Leaves the host through an uplink and pNIC. It requires a compatible physical-switch path, VLAN handling, IP configuration, and routing where needed.

VM to a VM on another ESXi host: Normally leaves the first host and enters the second through physical switching. Both hosts require compatible port groups, VLANs, uplinks, and physical paths.

Troubleshooting ESXi Network Connectivity

A VM Cannot Reach Devices Outside the ESXi Host

  • Verify that the VM vNIC is connected and assigned to the correct port group.
  • Verify that the virtual switch has a functioning physical NIC uplink.
  • Check link state and cabling on the ESXi host and physical switch.
  • Compare VLAN configuration on the ESXi port group and physical-switch uplink.
  • Verify the guest IP address, subnet mask, default gateway, and external routing.

Two VMs Expected to Communicate Cannot Reach Each Other

  • Check that both VMs are connected to the intended port groups.
  • Confirm that both port groups use the same VLAN when Layer 2 adjacency is expected.
  • Check for intentional separation by different virtual switches, VLANs, firewall rules, or guest operating-system settings.
  • Verify that the guest IP addresses are in the expected subnet.

Connectivity Fails After Moving a VM to a Different Port Group

  • Compare the old and new port-group VLAN IDs.
  • Confirm that the new port group has appropriate uplink connectivity.
  • Confirm that the destination network has a valid gateway and required services such as DHCP or DNS.
  • Check whether the new network is intentionally isolated.

Connectivity Is Lost After One Uplink Fails

  • Verify that more than one eligible pNIC is assigned to the virtual switch.
  • Review the teaming and failover policy and active or standby assignments.
  • Verify that the backup uplink is connected to a physical-switch port with compatible VLAN configuration.
  • Confirm that the upstream network supports the intended redundant topology.

A VLAN Network Works on Some Hosts but Not Others

  • Compare port-group VLAN settings across hosts or review the distributed-switch configuration.
  • Verify that all relevant physical-switch ports allow the required VLANs.
  • Check that pNIC uplinks are attached to the expected switches and ports.
  • Confirm that the VM is running on a host with connectivity to its required network.

Exam-Relevant Notes

  • A pNIC is physical; a vNIC is presented to a VM.
  • A virtual switch is a software Layer 2 switch, not a router.
  • A port group is the named connection point where shared settings such as VLAN configuration are applied.
  • An uplink connects a virtual switch to a physical NIC and therefore to the external network.
  • VMs on the same host and Layer 2 network may communicate internally without using a physical uplink.
  • Separate virtual switches are separate forwarding domains and do not automatically communicate.
  • NIC teaming improves availability and can distribute traffic, but multiple uplinks do not guarantee more bandwidth for one flow.
  • VLAN ID 0 means no VLAN tagging, while VLAN ID 4095 enables VLAN trunking to a connected guest or appliance; both must be used intentionally.
  • A vSS is configured per host, while a vDS is centrally managed across multiple hosts.

For broader ESXi study, see the VMware ESXi online course, the guide to adding an ESXi host to vCenter inventory, and the lesson on installing a guest operating system.