VMkernel Adapter Connectivity Failure Due to VLAN Pruning

Products

• VMware vSphere ESXi

Issue/Introduction

• For some servers, configure private/non routable IP under same DVS, IP is not coming online.
• Secondary VMkernel adapters (e.g., vmk1) fail to connect to the network, while the primary management interface (vmk0) connects successfully.
• Traffic for the specific VLAN assigned to the secondary VMkernel adapter is dropped.
• Connectivity is only restored when moving the affected VMkernel adapter to a newly created, secondary vSphere Distributed Switch (vDS).
  
  

 

Environment

VMware vSphere

Cause

• VLAN pruning is enabled at the uplink portgroup level, and the required VLAN is missing from the allowed VLAN range.
• The issue may intermittently occur across different host with different NIC vendors within the same cluster.
• This is due to the setting not being supported by the NIC.
  
  

Resolution

1. Navigate to the vSphere Client.
2. Locate the affected vSphere Distributed Switch (vDS) and select the designated Uplink Portgroup.
3. Edit the Uplink Portgroup settings and navigate to the VLAN configuration.
4. Verify the allowed VLAN range.
5. Add the missing VLAN (e.g., VLAN 1501) to the allowed VLAN trunk range, or revert to the default range of 0-4094 to trunk all VLANs.
6. Validate that network traffic is now passing successfully for the secondary VMkernel adapter.
7. Migrate the affected VMkernel adapter from the secondary vDS back to the primary vDS.
8. Decommission the secondary vDS.

Additional Information

• VLAN tags and modes can be set in several locations, including the portgroup of the vDS, the uplink port of the vDS, and the switchport of the upstream physical switch.
• The main point is if VLAN pruning is used on the uplink profile, the expectation is that only the configured VLAN or range of VLAN will be allowed.
• The setting is not always respected by the physical NIC.
• See also Filtering the VLANs in the DVUplinks portgroup is not dropping the packets.