Table of Contents Link to heading

• ESXi Networking Architecture
• Physical Layer: NICs and Uplinks
• Virtual Standard Switch (vSS)
  • Port Groups on vSS
  • NIC Teaming on vSS
• Virtual Distributed Switch (vDS)
  • vDS vs vSS Comparison
  • Distributed Port Groups
• VMkernel Adapters
• VLAN Configuration
• Network I/O Control (NIOC)
• Common Network Topologies

ESXi Networking Architecture Link to heading

ESXi virtualises not just compute and storage but also networking. Every ESXi host has a software-based network switch (a vSwitch) that connects the physical NICs (uplinks) to the virtual machines and the host’s own management plane.

The ESXi network model has three layers:

Physical NICs (vmnic0, vmnic1, ...)
          ↓
Virtual Switch (vSS or vDS)
          ↓
Port Groups
    ├── VM Port Groups → Virtual Machine vNICs
    └── VMkernel Ports → ESXi Host Services (mgmt, vMotion, iSCSI, NFS)

All traffic on the ESXi host — VM-to-VM, VM-to-external, and host management — flows through this model.

Physical Layer: NICs and Uplinks Link to heading

Physical network adapters on an ESXi host are named vmnic0, vmnic1, etc., in order of PCI bus address. They are connected to vSwitches as uplinks.

# List physical NICs and link state
esxcli network nic list

# Check NIC driver and firmware
esxcli network nic get -n vmnic0

Best practices for physical NIC allocation:

• Use at least two uplinks per vSwitch for redundancy
• Separate management traffic, VM traffic, vMotion, and storage traffic onto dedicated or isolated uplinks where possible
• Match NIC speed to the traffic type — 25GbE or higher for vMotion and iSCSI/NFS storage networks

Virtual Standard Switch (vSS) Link to heading

The vSS is created and managed locally on each ESXi host. Its configuration exists only on that host — it is not synchronised with other hosts, which means identical configuration must be applied manually (or via automation) to each host.

# List all vSwitches on the host
esxcli network vswitch standard list

# Create a new vSwitch
esxcli network vswitch standard add --vswitch-name vSwitch1

# Add a physical uplink to the vSwitch
esxcli network vswitch standard uplink add --vswitch-name vSwitch1 --uplink-name vmnic1

# Set the MTU (for jumbo frames: 9000)
esxcli network vswitch standard set --vswitch-name vSwitch1 --mtu 9000

Port Groups on vSS Link to heading

Port groups define the network policies for a set of ports on the vSwitch. VMs or VMkernel adapters connect to port groups, not directly to the vSwitch.

# List port groups
esxcli network vswitch standard portgroup list

# Create a VM port group
esxcli network vswitch standard portgroup add \
  --vswitch-name vSwitch1 \
  --portgroup-name "Production VMs"

# Set VLAN on a port group (VLAN 100)
esxcli network vswitch standard portgroup set \
  --portgroup-name "Production VMs" \
  --vlan-id 100

Three port group types:

• VM Port Group: Connects virtual machine vNICs to the network
• VMkernel Port: Connects ESXi host services to the network (management, vMotion, iSCSI, NFS)
• Uplink Port Group (internal): Connects physical NICs to the vSwitch (not user-configured directly)

NIC Teaming on vSS Link to heading

When multiple uplinks are assigned to a vSwitch, NIC teaming controls how traffic is distributed across them and what happens when a NIC fails.

Load balancing policies:

Failover detection:

Virtual Distributed Switch (vDS) Link to heading

The vDS is managed centrally from vCenter and spans multiple ESXi hosts. Its configuration is defined once in vCenter and synchronised to all hosts in the cluster. This eliminates the per-host configuration inconsistency risk of vSS.

vDS vs vSS Comparison Link to heading

Distributed Port Groups Link to heading

Distributed port groups (DPGs) are defined at the vDS level and applied consistently across all hosts. Each DPG has a defined set of policies: VLAN, security, traffic shaping, and teaming.

From vCenter UI: Networking → vDS → New Distributed Port Group

Key DPG settings:

• Port binding: Static (assigned when VM connects), Dynamic (deprecated), Ephemeral (assigned at power-on)
• VLAN type: None, VLAN (single tag), VLAN Trunking (pass through 802.1Q tags), Private VLAN
• Number of ports: Elastic (auto-expand) or fixed

VMkernel Adapters Link to heading

VMkernel ports (vmk interfaces) are the ESXi host’s own network connections. They carry host-generated traffic — not VM traffic.

# List VMkernel adapters
esxcli network ip interface list

# Show IP configuration of VMkernel adapters
esxcli network ip interface ipv4 get

# Create a VMkernel adapter (vMotion example)
esxcli network ip interface add \
  --interface-name vmk1 \
  --portgroup-name "vMotion"

esxcli network ip interface ipv4 set \
  --interface-name vmk1 \
  --type static \
  --ipv4 10.10.2.11 \
  --netmask 255.255.255.0

# Enable vMotion traffic type on vmk1
esxcli vmotion network interface add -i vmk1

# Check which services are enabled on each VMkernel adapter
esxcli network ip interface tag get -i vmk0

VLAN Configuration Link to heading

ESXi supports VLAN tagging in three modes:

For most VM traffic, use VST (Virtual Switch Tagging):

• Set the VLAN ID on the port group
• The physical switch port connecting the ESXi host must be a trunk port
• VMs require no VLAN awareness; the vSwitch tags and untags frames transparently

For VLAN 4095 (trunk mode): the VM’s OS must handle 802.1Q tagging. Used for network appliances (firewalls, routers) running as VMs that need to process multiple VLANs.

Network I/O Control (NIOC) Link to heading

NIOC (available on vDS) applies QoS to physical uplink bandwidth, preventing any single traffic type from monopolising the shared uplinks.

Traffic is classified into network resource pools:

During congestion, each resource pool is guaranteed at least its share proportion of the uplink bandwidth. VM traffic with 100 shares receives twice the bandwidth guarantee of vMotion with 50 shares.

NIOC also supports per-DPG bandwidth limits and reservations (NIOC v3 in vSphere 6.0+):

Distributed Port Group: Production VMs
  Reservation: 1 Gbps (guaranteed minimum)
  Limit: 5 Gbps (hard cap)
  Shares: 100

Common Network Topologies Link to heading

Two-uplink configuration (standard):

ESXi Host
├── vSwitch0 (Management)
│   ├── vmnic0 (active)
│   ├── vmnic1 (standby)
│   └── vmk0 (Management IP)
└── vDS (VM and VMkernel traffic)
    ├── vmnic2 (active)
    ├── vmnic3 (active)
    ├── vmk1 (vMotion)
    ├── vmk2 (vSAN)
    └── DPG: Production VMs

Four-uplink configuration (recommended for production):

ESXi Host
├── vSwitch0 (Management only)
│   ├── vmnic0 (active)  ← dedicated management uplinks
│   └── vmnic1 (active)
└── vDS (All other traffic)
    ├── vmnic2 (active)  ← dedicated data uplinks
    ├── vmnic3 (active)
    ├── vmk1 (vMotion) — teaming policy: vmnic2 active, vmnic3 active
    ├── vmk2 (vSAN)   — teaming policy: vmnic3 active, vmnic2 standby
    └── DPG: VMs       — teaming policy: load balance across vmnic2/3