Virtual machine unreachable after VLAN port group change on vSphere Distributed Switch

Products

• VMware vSphere ESXi

Issue/Introduction

A virtual machine loses all network connectivity after its port group is changed to a new VLAN on a vSphere Distributed Switch (VDS). The VM shows a connected status in vCenter but is unreachable via ICMP or standard application protocols.

• Total network connectivity loss for the VM following a migration to a different VLAN port group.
• Inconsistent reachability where the VM may intermittently lose or gain connection depending on the physical uplink (vmnic) assignment.
• Packet captures using pktcap-uw on specific physical uplinks show zero ingress frames for the target VLAN.

 

Cause

This issue is caused by inconsistent VLAN provisioning on the physical upstream switch. While some physical ports in the host's uplink teaming group are correctly configured to trunk the target VLAN, others are not. When the VDS "Route Based on Originating Virtual Port" policy hashes the VM to an unprovisioned uplink, the physical switch drops the ingress traffic.

Resolution

1. Identify the switchport ID and vNIC for the affected VM by running the following command on the ESXi host:

   net-stats -l | grep "####"

   (Note: Replace #### with the VM name).
2. Determine which physical uplink the VM is currently pinned to:
   • Run esxtop.
   • Press n to enter the network view.
   • Locate the VM's world ID or port ID and identify the corresponding TEAM-PNIC (e.g., vmnic1).
3. Verify if the assigned physical uplink is receiving ingress traffic for the target VLAN:

   pktcap-uw --uplink vmnic# --capture UplinkRcvKernel --vlan #### -c 10

   
   Note: Proceed with the following steps in a maintenance window, as the following actions can affect several virtual machines connected to a portgroup.
4. Log in to the vSphere Client and navigate to the Distributed Port Group settings.
5. Select Edit Settings and navigate to Teaming and Failover.
6. Under the Uplink Order section, move the physical adapters verified to be misconfigured (e.g., vmnic1 and vmnic2) to the Unused Uplinks category.
7. Retain the functional, verified uplinks (e.g., vmnic4 and vmnic5) in the Active Uplinks category.
8. Click OK to apply the configuration and verify VM connectivity.
9. Engage the network team to ensure the target VLAN is correctly authorised and trunked on all physical switchports associated with the ESXi host's uplink team.

If connectivity is not restored, contact Broadcom Support by following the steps in Contact Broadcom Support.