Configuring vSphere

Networking

© 2022 VMware, Inc.

Importance
When you successfully configure ESXi networking, virtual machines can communicate with
other machines, both virtual and physical. Additionally, a successfully configured ESXi network
allows the VMkernel to operate remote host management and IP-based storage effectively.
vSphere standard switches provide effective networking for small environments. As you scale
your vSphere environment, the built-in features and functions of vSphere distributed switches
can help you manage networking in larger environments.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1-2

Module Lessons
1. vSphere Standard Switches
2. Virtual Switch Networking Policies
3. vSphere Distributed Switches

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1-3

vSphere Standard Switches

© 2019 VMware Inc. All rights reserved.

Learner Objectives
• Identify virtual switch connection types
• Configure and view standard switch configurations

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1-5

About Virtual Switches
Virtual switches connect VMs to the physical network.
They provide connectivity between VMs on the same ESXi host or on different ESXi hosts.
They also support VMkernel services, such as vSphere vMotion migration, iSCSI, NFS, and
access to the management network.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1-6

Types of Virtual Switches
A virtual network supports standard and distributed switches. Both switch types are elastic,
ports are created and removed automatically:

• Standard switch: • Distributed switch:

– Virtual switch that is configured for a – Virtual switch that is configured for an
single host. entire data center.
– Up to 2,000 hosts can be attached to the
same distributed switch.
– The configuration is consistent across all
attached hosts.
– Hosts must either have an Enterprise Plus
license or belong to a vSAN cluster.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1-7

Types of Virtual Switch Connections
A virtual switch has specific connection types:
• VM ports
• VMkernel ports
– IP storage, vSphere vMotion migration, vSphere Fault Tolerance, vSAN, vSphere
Replication, and the ESXi management network
• Uplink ports
VM ports and VMkernel ports exist in port groups.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1-8

Virtual Switch Connection Examples
Networks (port groups) can coexist on the same virtual switch or on separate virtual switches.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1-9

About VLANs and Virtual Switch Tagging
ESXi provides VLAN support by assigning a
VLAN ID to a port group. ESXi supports 802.1Q
VLAN tagging.
Virtual switch tagging is one of the supported
tagging policies:
• Frames from a VM are tagged as they exit
the virtual switch.
• Tagged frames arriving at a virtual switch
are untagged before they are sent to the
destination VM.
• The effect on performance is minimal.
Physical switch ports must be configured as
trunk ports.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 10

Viewing Standard Switches
In the vSphere Client, you can view a host’s standard switch configuration by selecting Virtual
Switches on the Configure tab.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 11

Adding Standard Switches
You can add new standard switches to an ESXi host or configure existing ones using the
vSphere Client or VMware Host Client.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 12

VMkernel Adapter Properties
The VMkernel adapters pane shows details about the VMkernel interfaces, such as its name,
the switch on which it is located, the IP address, and enabled services.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 13

VMkernel Adapter Properties: Enabled Services
You can activate services for the VMkernel adapter.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 14

Physical Adapter Properties
The Physical adapters pane shows adapter details such as speed, duplex, and networks.
Although the speed and duplex settings are configurable, the best practice is to leave the
settings to auto negotiation.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 15

Lab 1: Creating Standard Switches
Create a standard switch and a port group for virtual machines:
1. View the Standard Switch Configuration
2. Create a Standard Switch with a Virtual Machine Port Group
3. Attach Virtual Machines to the Virtual Machine Port Group

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 16

Review of Learner Objectives
• Identify virtual switch connection types
• Configure and view standard switch configurations

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 17

Virtual Switch Networking Policies

© 2019 VMware Inc. All rights reserved.

Learner Objectives
• Explain how to set security policies for a virtual switch
• Explain how to set traffic shaping policies for a virtual switch
• Explain how to set NIC teaming and failover policies for a virtual switch

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 19

About Networking Policies
As an administrator, you set networking policies on virtual switches to configure virtual
network properties, such as security, performance, and availability.
Depending on the virtual switch type, networking policies can be applied at different levels of
the virtual switch.

Virtual Switch Type Set Default Policy At Override Default Policy At

vSphere Standard Switch Standard switch level Port group level
vSphere Distributed Switch Distributed port group level Individual port level

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 20

Configuring Security Policies
As an administrator, you can define security policies at both the standard switch level and the
port group level:
• Promiscuous mode: Allow or disallow all traffic to be forwarded, regardless of the
destination.
• MAC address changes: Accept or reject inbound traffic when the MAC address is altered
by the guest.
• Forged transmits: Accept or reject outbound traffic when the MAC address is altered by
the guest.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 21

Traffic-Shaping Policies
Network traffic shaping is a mechanism for limiting a virtual machine’s consumption of
available network bandwidth.
Average rate, peak rate, and burst size are configurable.
Network traffic shaping is deactivated by default.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 22

Configuring Outbound Traffic Shaping
A traffic-shaping policy is defined by average bandwidth, peak bandwidth, and burst size.
Parameters apply to each virtual NIC in the standard switch.
On a standard switch, traffic shaping controls only outbound traffic. Outbound traffic travels
from the VMs to the virtual switch and out onto the physical network.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 23

Configuring NIC Teaming and Failover
With NIC teaming, you can
increase the network capacity
of a port group by including
two or more physical NICs in a
team.
Add the physical NICs (or
uplinks) to the Active uplinks
group.

VM traffic is load balanced across the Active uplinks using

the selected Load balancing option.
© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 24
Load Balancing Method: Originating Virtual Port ID
With the load balancing method that is based on the originating virtual port ID, a virtual
machine’s outbound traffic is mapped to a specific physical NIC.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 25

Load Balancing Method: Source MAC Hash
A virtual machine's outbound traffic, when load balanced using the source MAC hash method,
is mapped to a specific physical NIC based on the virtual NIC’s MAC address.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 26

Load Balancing Method: Source and Destination IP Hash
With the IP-based load balancing method, a NIC for each outbound packet is selected based on
its source and destination IP addresses.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 27

Detecting and Handling Network Failure
Network failures are monitored and detected
by the VMkernel. The VMkernel monitors the
link state and performs beacon probing (if
selected) on one second intervals to ensure
network uptime.
If the VMkernel determines a network failure,
the VMkernel notifies physical switches of
changes in the physical location of a MAC
address.
Failover is implemented by the VMkernel
based on configurable parameters:
• Failback: How the physical adapter is
returned to active duty after recovering
from failure.
• Load-balancing option: Use explicit failover
order. Always use the vmnic uplink at the
top of the active adapter list.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 28

Physical Network Considerations
Your virtual networking environment relies on the physical network infrastructure. As a vSphere
administrator, you should discuss your vSphere networking needs with your network
administration team.
The following issues are topics for discussion:
• Number of physical switches
• Network bandwidth required
• Physical switch configuration support for 802.1Q, for VLAN tagging
• Physical switch configuration support for NIC teaming: 802.3ad, Link Aggregation Control
Protocol (LACP), or EtherChannel
• Network port security
• Link Layer Discovery Protocol (LLDP) and Cisco Discovery Protocol (CDP) and their operation
modes, such as listen, broadcast, listen and broadcast, and disabled

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 29

Activity: Networking Security Policy (1)
Which statement accurately describes Promiscuous mode when it is set to Accept?
(Choose one.)
o The ESXi host is allowed to drop network packets that seem suspicious.
o An administrator provides enhanced security to the virtual switch.
o An administrator can use a network-based intrusion detection system in a VM.
o The guest OS is given permission to change the VM's MAC address.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 30

Activity: Networking Security Policy (2)
Which statement accurately describes Promiscuous mode when it is set to Accept?
(Choose one.)
o The ESXi host is allowed to drop network packets that seem suspicious.
o An administrator provides enhanced security to the virtual switch.
 An administrator can use a network-based intrusion detection system in a VM.
o The guest OS is given permission to change the VM's MAC address.

When promiscuous mode is set to Accept, an administrator can run legitimate software such as
a network-based intrusion detection system. However, when this mode is enabled, the virtual
switch is vulnerable to security breaches.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 31

Activity: Traffic Shaping Policy (1)
Which statement accurately describes the
traffic shaping policy configuration?
(Choose one.)
o Traffic shaping is activated on the entire
standard switch.
o The traffic shaping policy for the TestDev
port group overrides the policy defined on
the standard switch.
o The bandwidth used for normal operation by
VMs on the TestDev port group is 100 Mbps.
o The Accounting port group is subject to
traffic shaping, with an average bandwidth
of 1 Gbps.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 32

Activity: Traffic Shaping Policy (2)
Which statement accurately describes the
traffic shaping policy configuration?
(Choose one.)
o Traffic shaping is activated on the entire
standard switch.
 The traffic shaping policy for the TestDev
port group overrides the policy defined on
the standard switch.
o The bandwidth used for normal operation by
VMs on the TestDev port group is 100 Mbps.
o The Accounting port group is subject to
traffic shaping, with an average bandwidth
of 1 Gbps.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 33

Activity: NIC Teaming and Failover Policy (1)
The load balancing method called Originating Virtual Port ID is only available on distributed
switches.
o True
o False

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 34

Activity: NIC Teaming and Failover Policy (2)
The load balancing method based on the originating virtual port ID is only available on
distributed switches.
o True
 False

The load balancing method based on physical NIC load is the only method supported on
distributed switches.
The load balancing method that is only available on distributed switches is the Route based
on physical NIC load option. This method ensures that physical NIC capacity in a NIC team is
optimized.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 35

Review of Learner Objectives
• Explain how to set security policies for a virtual switch
• Explain how to set traffic shaping policies for a virtual switch
• Explain how to set NIC teaming and failover policies for a virtual switch

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 36

vSphere Distributed Switches

© 2019 VMware Inc. All rights reserved.

Learner Objectives
• Recognize the difference between standard switches and distributed switches
• Identify the benefits and features of distributed switches
• Create a distributed switch

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 38

About Distributed Switches
A distributed switch functions as a single virtual switch across all associated hosts. Distributed
switches have several benefits over standard switches:
• Distributed switches centralize the virtual network administration, and simplifies the data
center administration.
• Distributed switch ports are statically assigned by vCenter and offer more granular control
over network statistics and policies.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 39

Distributed Switch Architecture
Managed by vCenter, a distributed switch is a logical entity that you can use to create and
maintain a consistent virtual networking configuration throughout all your ESXi hosts.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 40

Standard and Distributed Switches: Shared Features
Standard and distributed switches share some features.

Feature Standard Distributed

Switch Switch
Layer 2 switch ✓ ✓
VLAN segmentation ✓ ✓
802.1Q tagging ✓ ✓
IPv4 and IPv6 support ✓ ✓
NIC teaming ✓ ✓
Outbound traffic shaping ✓ ✓

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 41

Distributed Switch Features
Distributed switches have several features that standard switches do not have.

Feature Standard Distributed

Switch Switch
Inbound traffic shaping ✓
Configuration backup and restore ✓
Private VLANs ✓
Link Aggregation Control Protocol ✓
Data center level management ✓
vSphere vMotion migration of network state ✓
Network I/O Control ✓
Per-port policy settings ✓
Port state monitoring ✓
NetFlow ✓
Port mirroring ✓
Support for© 2022
NSX VMware, Inc.
✓
M05_Configuring vSphere Networking | 1 - 42
Viewing Distributed Switches
In the vSphere Client, you can view the distributed switch configuration using the Topology
pane in the Configure tab.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 43

Discovery Protocols
Switch discovery protocols help network administrators gather configuration and connection
information about physical or virtual switches.
vSphere supports the following discovery protocols:
• Cisco Discovery Protocol (CDP): For vSphere standard switches and distributed switches
connected to Cisco physical switches
• Link Layer Discovery Protocol (LLDP): A vendor-neutral protocol for distributed switches only
Standard switches can be configured to use CDP.
Distributed switches can use CDP or LLDP.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 44

Configuring CDP or LLDP
With CDP or LLDP enabled, you can configure
a virtual switch for different modes of
operation:
• Listen: Information is received from the
physical switches.
• Advertise: Information is sent to the
physical switches.
• Both: Information is both sent to and
received from the physical switches.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 45

About Port Binding
Port binding determines when and how a
VM virtual NIC is assigned to a virtual switch
port. Port binding is configured at the
distributed port group level, and binding
options include:
• Static binding (default): vCenter assigns a
permanent port for the VM or VMkernel
interface.
• Ephemeral: ESXi (not vCenter) assigns
the port to the VM. The assigned port
changes when the VM reboots.
Port allocation options for static binding:
• Elastic (default): When all ports are
assigned, a new set of eight ports is
created.
• Fixed: No additional ports are created
when all ports are assigned.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 46

Configuring Inbound Traffic Shaping
Distributed switches support inbound traffic shaping and outbound traffic shaping.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 47

Load Balancing Method: Physical NIC Load
This method is supported only on distributed switches and is the recommended policy for
distributed port groups.

Load balancing based on physical NIC load

ensures that physical NIC capacity in a NIC
team is optimized. This feature works in the
following ways:
• It moves I/O flows among uplinks.
• A flow is moved only when the mean send
or receive utilization of an uplink exceeds
75 percent of the capacity over a 30-second
period.

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 48

Lab 2: Configuring vSphere Distributed Switches
Create and configure a distributed switch:
1. Create a Distributed Switch
2. Add ESXi Hosts to the Distributed Switch
3. Verify Your Distributed Switch Configuration

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 49

Review of Learner Objectives
• Recognize the difference between standard switches and distributed switches
• Identify the benefits and features of distributed switches
• Create a distributed switch

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 50

Key Points
• Virtual switches can have the following connection types: VM ports, VMkernel port, and
physical uplinks.
• A standard switch is a virtual switch configuration for a single host.
• A distributed switch provides functions that are similar to a standard switch. But the
distributed switch defines a single configuration that is managed by vCenter and is shared
across all associated hosts.
• You set networking policies on virtual switches to configure properties for security,
performance, and availability.
• Network policies set at the standard switch level can be overridden at the port group level.
Network policies set at the distributed switch port group level can be overridden at the
individual port level.
Questions?

© 2022 VMware, Inc. M05_Configuring vSphere Networking | 1 - 51