Private VLAN (PVLAN) traffic dropped on ESXi uplink with "fwdcheckpolicy" and "vlantag mismatch" errors.
Article ID: 429803
Updated On:
Products
Issue/Introduction
- Virtual Machines in a Secondary Private VLAN (PVLAN) cannot communicate with their default gateway or external subnets (North-South traffic)..
- East-West traffic between VMs in the same Community PVLAN may still function correctly.
Symptom:
The VM is configured on a Secondary VLAN (e.g., ##91).
The VDS is configured with a Primary VLAN (e.g., ##90).
Ingress traffic from the physical switch arrives tagged with the Secondary VLAN ID (##91).
"pktcap-uw --trace --mac [MAC_Address_Of_Target_VM]" output example:
Environment
VMware vCenter Server.
VMware vSphere ESXi.
Cause
This issue occurs when the upstream physical switch port connected to the ESXi host is misconfigured to actively translate Private VLAN tags (e.g., operating as a secondary PVLAN trunk) rather than acting as a standard 802.1Q trunk.
In a vSphere Distributed Switch (VDS) PVLAN implementation, the VDS handles the translation between Secondary and Primary VLANs locally. The ESXi host's internal MAC address learning table identifies the default gateway as a Promiscuous device. Therefore, the VDS explicitly expects North-South return traffic from that gateway to arrive at the physical uplink tagged with the Primary VLAN ID.
Resolution
To resolve this issue, the physical network ports connected to the ESXi host uplinks must be configured to pass the VLAN tags completely unmodified. Work with your network administrator to apply the following changes:
- Configure as Standard 802.1Q Trunks: Ensure the physical switch ports facing the ESXi hosts are configured as standard VLAN trunks, not as Private VLAN (PVLAN) edge, promiscuous, or secondary trunk ports.
- Remove Tag Translation Commands: Remove any port-level configurations that actively rewrite or translate the Primary VLAN ID into a Secondary VLAN ID before the traffic exits the physical switch.
- Allow Both VLANs: Configure the standard trunk to simply allow both the Primary VLAN ID and the Secondary VLAN ID(s) to pass through to the ESXi host.
Additional Information
Feedback
