VLAN configuration on virtual switches, physical switches, and virtual machines

VMware vCenter Server VMware vSphere ESXi

This article describes the various VLAN tagging methods used with ESXi.

Virtual LAN (VLAN) implementation is recommended in ESXi networking environments because:

It integrates ESXi into a pre-existing network
It secures network traffic
It reduces network traffic congestion
iSCSI traffic requires an isolated network
Virtual Machines unable to login and unreachable due to VLAN not being configured on physical switches.
example : DMZ AD VLAN gateway unreachable," "Users unable to authenticate to DMZ servers," and "Post-deployment of vCenter 8.0 U3."

VLAN tagging methods used with ESXi:

There are three methods of VLAN tagging that can be configured on ESXi:

All VLAN tagging of packets is performed on the physical switch.
ESXi/ESX host network adapters are connected to access ports on the physical switch.
The portgroups connected to the virtual switch must have their VLAN ID set to 0.
For more information, see Sample Configuration - ESXi connecting to physical switch via VLAN access mode and External Switch VLAN Tagging (EST Mode)
See this example snippet of a code from a Cisco switch port configuration:

switchport mode access switchport access vlan #

All VLAN tagging of packets is performed by the virtual switch before leaving the ESXi/ESX host.
The ESXi/ESX host network adapters must be connected to trunk ports on the physical switch.
The port groups connected to the virtual switch must have an appropriate VLAN ID specified.
For more information, see:
- Configuring a VLAN on a portgroup
- Configuring Virtual Switch VLAN Tagging (VST) mode on a vNetwork Distributed Switch
For a sample of VST, see Sample configuration of virtual switch VLAN tagging (VST Mode)
See this example snippet of code from a Cisco switch port configuration:

switchport trunk encapsulation dot1q switchport mode trunk switchport trunk allowed vlan x,y,z spanning-tree portfast trunk

Note: The Native VLAN is not tagged and thus requires no VLAN ID to be set on the ESXi portgroup.

All VLAN tagging is performed by the virtual machine.
You must install an 802.1Q VLAN trunking driver inside the virtual machine.
VLAN tags are preserved between the virtual machine networking stack and external switch when frames are passed to/from virtual switches.
Virtual machines on which guest OS does the VLAN tagging, should be placed in port group tagged with trunk port.
Physical switch ports are set to trunk port.
See this example snippet of code from a Cisco switch port configuration:

switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan x,y,z
spanning-tree portfast trunk

`# esxcli network nic vlan stats set -n vmnic# -e true`	To enable the vlan stats on vmnic
`# esxcli network nic vlan stats get -n vmnic#`	To get the vlan stats on the vmnic.
`# esxcli network nic vlan stats set -e false -n vmnic#`	To disable the VLAN stats on the vmnic

Example : VLAN is missing on the physical switch trunk/access ports using vendor-specific checks (e.g., HP Aruba context).