Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to configure two separate vlans in ESXi. Right now I have two vlan's set up on a single vswitch in separate port groups (one for vlan 100, one for vlan 110). None of the ports connected to the port group for vlan 100 can go anywhere, including the gateway. Everything connected to the port group for vlan 110 works just fine. I've verified that both VLANs are configured on the router and on the local physical switch. The physical switch ports are set up in trunking mode currently per the KB articles I could find for vlan setup.

The only other thing that may be a bit strange is that the management IP for esx/vsphere is located on vlan 110, though I'm not sure if that would make any difference.

Based on some of the EB's, will I need to set up a separate vswitch for each vlan instead of using two port groups on a single vswitch?

Edit: here is a screenshot enter image description here

Here is the switchport config (this same config applied to each port connected):

interface GigabitEthernet2/3
 description basqa1vm01 Sig
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,110
 switchport mode trunk
 switchport nonegotiate
 no ip address
 wrr-queue cos-map 1 1 0 1
 wrr-queue cos-map 1 3 2
 wrr-queue cos-map 2 1 3
 wrr-queue cos-map 2 2 4 6 7
 no cdp enable
share|improve this question
The physical switch config looks good (though I would turn on CDP so you get port information at the ESXi server). What model switch is this? – SpacemanSpiff May 24 '12 at 17:03
What I'm getting at, is that if the router you mentioned is doing the routing between VLANs, then you need to make sure that you put both VLANS on the trunk configuration between your switch and your router. To test connectivity from the VM's to the switch, set up an access port on VLAN110 and plug a laptop into it and see if you can reach one of your virtual machines. – SpacemanSpiff May 24 '12 at 17:05
After talking to the network team, the boxes are connected directly to two different routers via HSRP, there are no switches (other than switch cards in the router). Both routers are aware of both VLANs, and we have tested our physical boxes in the deployment to verify. – Matthew May 24 '12 at 17:24
Follow my suggestion above. If you can get a VM on your server to talk to a device on an access port on the physical switch, then there is nothing wrong with your VMware server. – SpacemanSpiff May 24 '12 at 17:38
up vote 4 down vote accepted

Separate vSwitches are only required when you need a hard separation of which physical up-links can be used.

The vSwitch itself will have a NIC teaming configuration which determines the default behavior for both port groups and kernel ports. Typically I set all NICs as active here for the default behavior.

Then at each port group or kernel port, you can override which NICs are active and which are standby for that object, unless you run into performance tuning issues, you can be lazy and not do this and just leave all the NICs as active.

In a performance scenario, you might set the vSwitch default to use all uplinks, and then set management to use the first NIC standby to the rest. vMotion to use the 2nd NIC, standby to the rest, and so forth.

So in this case... if both physical uplinks have been added to the vSwitch, and you've set the VLAN-ID on each port group, and one works, and one does not I am going to guess that either:

1) you have the native VLAN set on the other side as the one that is working


2) you haven't sent all the vlans down the trunk

How about a screenshot of this vSwitch?

What type of physical switch are you uplinking to?

share|improve this answer
To be honest I'm not sure about the physical switch above the host, its from cisco, most likely a 2600 series but I could be wrong (that's what we have at most places). I also added the switchport config. – Matthew May 24 '12 at 16:58

no, multiple vlans can be in the same vswitch and have worked without any problem. but your management interface though should in a separate vswitch, or actually if you could afford it, with a separate group of nics.

share|improve this answer
Management does NOT need its own vSwitch – SpacemanSpiff May 24 '12 at 16:46
i did not say need, only should it is the best practice per vmware, if you have enough nics. i myself have worked in places where all we had is a single nic for everything. – johnshen64 May 24 '12 at 16:47
In this case we have everything running over 1 nic, so that would be the case (it is a dev environment). If that's the case then, setting the vlan ID for the port group should be the only necessary setting, correct? Then when I define the nic in the VM select that port group and continue on my merry way? If that's the case it's most likely an issue on the switch or router. – Matthew May 24 '12 at 16:54
that is correct. – johnshen64 May 24 '12 at 17:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.