Network connectivity is lost for VMs with 802.1q VLAN tagging

Products

• VMware vSphere ESXi

Issue/Introduction

This is an expected behavior in VMware ESXi.

Symptoms:

• Virtual machines configured with Virtual Guest Tagging (802.1q VLAN tagging) lose network connectivity after migrating to another ESXi host.
• Connectivity is re-established after 5-10 minutes without any user intervention.
  
  Notes:
  • VLAN Trunking is configured on the vSphere Distributed Switch (VDS) port group in use by the virtual machine.
  • VLAN 4095 is configured on the vSphere Standard Switch (VSS) port group in use by the virtual machine.

Cause

This issue occurs due to vMotion unable to send a Reverse Address Resolution Protocol (RARP) for In Guest tagged networks as the ESXi host cannot identify which VLANs are in use by the guest operating system running in the virtual machine.

 

 

This can also occur without a vMotion if the MAC address entry expires on the physical switch or in case of physical NIC failover on the host. This will only occur if there is a very long period of non communication, and can be resolved by any egress traffic generated by the virtual machine.

Resolution

This is an expected behavior in VMware ESXi.

To work around this issue, use one of these options:

• Force an ARP lookup request to occur on the tagged network which will generate egress traffic sourced from the new switchport and update the switch of the new location.
  This can be accomplished by performing a ping to another destination on the network from inside the guest operating system running in the virtual machine.
  
  Note: This must be done after every vMotion.
• Create a DRS affinity rule to ensure that the affected virtual machine does not migrate to another ESXi host. For more information, see the Using DRS Affinity Rules section of the vSphere Resource Management.

Additional Information

During a vMotion event, if the Notify Switches option is set to Yes in the Teaming and Failover options of the Virtual Switch, Virtual Port Group, or Distributed Port Group, a RARP is sent to the physical switch on the untagged network to update the physical switch of the virtual machine's new ESXi host location.

The untagged network MAC address will successfully relocate to the correct switchport.
The network MAC addresses for tagged networks will show on the switchport associated to the ESXi host of the previous location of the virtual machine, if any traffic is generated from inside the Guest on the tagged interface the issue is corrected.

Contact your physical switch vendor for information on how to review switch MAC address tables.This issue is related to Cisco Bug CSCud56753 where the Cisco Wireless Controllers encounters this problem during a vMotion event. For more information, see the Open Caveats section of the Cisco Wireless LAN Controllers and Lightweight Access points for Release 7.6.100.0 Release Notes.