Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am building a small setup of ESX5 servers. There will be different apps running for different companies on them. Each company has a VM that has one Internet facing vNIC and one vNIC facing to this company's private virtual network (backend). The backend networks are for separate web server and database VMs.

The question is: would it be performance and/or security wise better to create a separate virtual switch for each company or just use VLAN tags? I mean if all the private networks are load-wise fully utilized, would it make a difference if they used separate virtual switches?

share|improve this question
up vote 1 down vote accepted

In general you want seperate vswitches. Each switch would have at least 1 uplink. In high traffic networks you can run into nic contention on the physical nic.

share|improve this answer
Thank you very much! – Henno Jan 15 '12 at 4:34

Separate vSwitches will require separate physical uplinks. If you can afford the NICs to do this it might be a good way to go. If there is a need to QoS an individual company's data at the physical switch as this is not something VMware's vswitch is really capable of, then this also might give you some flexibility as you'll know which company's data is coming from which physical cables more predictable. If you expect traffic to stay low, this may not be an issue.

To answer your question more directly: Yes, if you put the companies on to separate vSwitches then it will not really be possible for one to talk to the other, but VLANS will give you almost the same isolation. I'd have to see a better diagram, specifically regarding the "Internet connection" vNic and how you plan to handle that as far as subnetting goes to better answer your question.

share|improve this answer
A better diagram: – Henno Jan 15 '12 at 0:01
My concern is more performance oriented: will the separate switches approach be better in a high network utilization situation.. or worse? – Henno Jan 15 '12 at 0:28
It really is going to depend on how many uplinks you have to answer that question. Your diagram URL does not work. – SpacemanSpiff Jan 15 '12 at 0:50
It works now. If you can afford to dedicate one or more physical NICs to each customer, go for multiple vSwitches to be safe. – SpacemanSpiff Jan 15 '12 at 21:48

I'd use VLAN's because you can actually separate traffic even when it is crossing multiple switches. Plus VLAN's will be lighter than another virtual-switch. VLANs allow sharing a switch among more than one LAN by filtering and limiting broadcast traffic.

I think using VLAN's is the way go.

share|improve this answer
Additionally, every virtual switch usually needs a physical interface it will be bound to. The physical interface(s) bound to a switch are unavailable for bindings with the others. – the-wabbit Jan 14 '12 at 23:59
I was planning not to bind a physical interface to swiches for backend networks. – Henno Jan 15 '12 at 0:11
filtering traffic won't help when you have a high traffic vm shaing the same physical nic with the others. Vlans would aggravate rather than resolve the issue. – Jim B Jan 15 '12 at 3:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.