Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hello I am planning to install 10 ESX hosts in dell blades each having 4 nic. The hosts will be having WEB server VM's which will be in DMZ network. For the purpose of managment, I am planning to connect all service console network in Management Vlan's and Vcenter also in same Vlan. The VM virtual switch will have remaining two nic's which will connect to the DMZ network.

So what ports will need to be opened for the communication of VM, VMkernal, Service console and Vcenter.

(Also would like to know can VMkernal and Vm portgroup be on same vswitch) in DMZ.


share|improve this question
up vote 2 down vote accepted

HERE is the best and most complete list of VMWare ports in use I've come across, hope this helps.

Edit - just spotted your second question - although your VMKernel and VM traffic can be on the same port-group, and makes sense for some configurations, I wouldn't do this for yours.

I would use;

  • two NICs for the 'internal' traffic, either one NIC to one internal switch and another to a second switch or two NICs to the same switch - both options cover you in case of NIC/cable/switch failure. Create a new dual-port vswitch and matching port-group for this carrying VMKernel traffic (SC/VMotion etc.)
  • the other two NICs for the 'DMZ' traffic, wired to either separate or the same external switch/es/load-balancers, again for protection and/or bandwidth improvements and again with a different dual-port VM-facing vswitch and port-group.

This is very common practice and I think will serve you well, come back to us if you have any further questions. Oh and ESX will open it's own FW ports as you switch on certain services (NTP etc) so don't worry about the servers, just any ACLs/FWs in the way ok.

share|improve this answer

You can have the VMKernel\Service Console ports and VM Port Groups on the same vSwitch but you should then segregate the traffic using VLAN tagging at the port\port group level.

In your case with 4 Nic's the simplest way to do this while retaining some level of redundancy and isolation is to use two Nic's as uplinks for each vSwitch as you are planning to do.

share|improve this answer

Here is my favorite reference for port #'s, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.