VMware ESXi vSwitch: Port Groups, VLAN IDs and Teaming

Virtual switches (vSwitches) are the software layer that connects VMs to each other and to the physical network, and almost every virtualization connectivity problem traces back to one of three concepts misunderstood: the difference between a vSwitch and a port group, the three VLAN tagging modes, or uplink teaming. This guide explains how ESXi vSwitches, port groups, VLAN IDs and physical uplinks fit together, with the values you actually enter when creating a port group.

vSwitch, Port Group, Uplink - the Model

A vSwitch is a software Layer-2 switch: VMs plug into its virtual ports, and one or more physical NICs (uplinks) connect it to the outside. Unlike a physical switch it does not learn MACs for unknown destinations - frames for MACs outside the host are simply sent to the uplink. The default vSwitch0 is created at install.

A port group is a named slice of a vSwitch with its own policy (security, shaping, teaming) and its own VLAN ID. VMs attach to a port group, not to the vSwitch directly. Two kinds exist:

• VM port groups - for virtual machine NICs.
• VMkernel port groups - for VMkernel interfaces used by management, vMotion, storage (iSCSI/NFS), vSAN.

VLAN IDs and the Three Tagging Modes

When creating a port group you enter a VLAN ID, whose meaning depends on the tagging mode:

• VST - Virtual Switch Tagging (VLAN 1-4094): the vSwitch tags/untags frames on behalf of the VM. The most common mode: assign VLAN 100 to a port group and all its VMs are on VLAN 100, with the uplink carrying tagged frames to the physical switch.
• EST - External Switch Tagging (VLAN 0): no tagging at the vSwitch; the physical switch port does the tagging (used e.g. with dedicated storage switch ports where the uplink is an untagged access port).
• VGT - Virtual Guest Tagging (VLAN 4095): trunk mode - the vSwitch passes all VLANs through untouched and the guest OS does its own tagging (used for nested virtualization or guest firewalls that need multiple VLANs).

The classic misconfiguration is entering 4095 when you meant a specific VLAN (guest sees no traffic because it never tags) or 0 when the physical port expects tagged frames.

Uplinks and Teaming

Assign two or more physical NICs to a vSwitch for redundancy. On standard switches, teaming defaults to load balancing based on the virtual port ID with failover: if an uplink dies, its port groups fail over to a surviving uplink. For best practice:

• Connect the uplinks to separate physical switches (not the same one) so switch failure does not take the host down.
• Keep management, VM traffic and storage on separate VLANs - and ideally separate vSwitches/uplinks for storage.
• Use a distributed switch (vDS, Enterprise Plus) when consistent policies across many hosts matter; vDS is configured at vCenter level instead of per host.

Verifying Connectivity

Check from the host: esxcli network vswitch standard list (vSS), esxcli network ip interface list, and esxcli network vm list for VM port connections. Confirm the physical switch port carrying the uplink is configured for the matching VLAN (trunk with the right allowed list, or access for EST) - the switch side of that configuration is exactly what our Arista EOS VLAN guide, Open vSwitch VLAN article and Linux 802.1Q tagging guide demonstrate on real switch CLI.

原文链接：https://www.nakivo.com/blog/esxi-network-concepts/