Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's the scenario...

We've got a VSphere ESXi 5 box running on a 9.x subnet, our office runs from the 1.x subnet. We can access the VM's running on the box without issue (which also have 9.x IP's) however we can ping the management network interface for the VM box but can't either browse to the box http/https nor use VSphere client to connect to it. The connection just times out. We have a VPN connection between the two subnets and have checked both firewalls and nothing is being blocked (which is also supported by the fact that all traffic can pass to/from the VM's).

Is there a setting within VMWare that restricts management traffic by default, to its local subnet? It would make sense for that to be the case...but I can't find any options within VSphere client. The default gateway is definitely correct for the management network, again supported by the fact that we can ping and get a response from its IP from our 1.x network.

If anyone has any suggestions, they would be kindly appreciated!

Thank you!

share|improve this question
Perhaps if you articulate exactly what IP addresses and netmasks both the server and the system you are attempting to connect from have, along with their default routes, we might be able to better assist in troubleshooting. – Jed Daniels Mar 12 '12 at 15:01

This isn't anything whatsoever to do with vSphere, it's a simple Layer 3 routing issue, get some working routing in place, that's it.

share|improve this answer
All traffic between the two subnets including L3 is routing fine, apart from traffic to/from the VMWare management network. Surely if it was a L3 routing issue at the firewalls nothing (L3) would be able to traverse the connection? – mbuk2k Feb 24 '12 at 9:41
Does no one have any other thoughts on this? I don't think it's a layer 3 routing issue as all traffic is routed between the two's literally just managing this VMWare box that is causing us problems. – mbuk2k Feb 27 '12 at 10:21
It's not a terribly clearly-written question to be honest - have you tried connecting from inside the same vlan? that'll tell you if it's a server or network issue right? – Chopper3 Feb 27 '12 at 11:09
My apologies...everything within the same VLAN works fine (incl VMWare Mgmt). Everything between VLAN's works fine...APART from connecting to the VMWare management network. We can connect fine to other hosts on that VLAN/subnet without issue. The only thing we can't access on that particular VLAN is the VMWare Management Network...servers on that VLAN can be accessed fine. Not sure if that makes it any clearer? If we were having other L3 issues when accessing this subnet I would agree that it points towards routing, but it's literally just VMWare – mbuk2k Feb 27 '12 at 11:50
Right, so it all works inside the same vlan, have you checked the netmask & gateway on your esxi server? maybe it's not right and it's not got a valid way out of that vlan? other than that I guess it's just a basic L2/L3 routing/firewall/client config issue - there's no option in esxi to just allow connections from its own vlan, unless the netmask/gateway is wrong. – Chopper3 Feb 27 '12 at 12:13

I know this is an old thread, but I've seen this problem before and wanted to help any other vsphere admins who run into the same issue. When you can manage the esxi environment from the local subnet but not from a remote, the trouble is going to be a layer 3 or higher issue. Since other traffic can traverse from one subnet to another you know the problem isn't in the router or firewalls in between. So the problem must be on the esxi device. The situation you have described can easily occur if a VKERNAL adapter is set up to belong do a different IP range than is correct. You can verify this easily by navigating to Host -> Manage -> Networking -> TCP/IP configuration _> IPv4 routing table. If you see that the host is trying to locally route (gateway to a subnet that it is not a part of then you have found your culprit. Track down the vkernal adapter that is misconfigured and get it configured correctly!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.