Setting Up vSphere Networking with vSphere Standard Switches
You can set up your virtual network by performing these tasks.
1
Create or manipulate virtual switches using esxcli network vswitch or vicfg-vswitch. By default, each ESXi host has one virtual switch, vSwitch0. You can create additional virtual switches or manage existing switches. See Setting Up Virtual Switches and Associating a Switch with a Network Interface.
2
(Optional) Make changes to the uplink adapter using esxcli network vswitch standard uplink or vicfg-nics. See Managing Uplink Adapters.
3
(Optional) Use esxcli network vswitch standard portgroup or vicfg-vswitch to add port groups to the virtual switch. See Managing Port Groups with vicfg-vswitch.
4
(Optional) Use esxcli network vswitch standard portgroup set or vicfg-vswitch to establish VLANs by associating port groups with VLAN IDs. See Setting the Port Group VLAN ID with vicfg-vswitch.
5
Use esxcli network ip interface or vicfg-vmknic to configure the VMkernel network interfaces. See Adding and Modifying VMkernel Network Interfaces.
Setting Up Virtual Switches and Associating a Switch with a Network Interface
A virtual switch models a physical Ethernet switch. You can manage virtual switches and port groups by using the vSphere Client (see the vSphere Networking documentation) or by using vSphere CLI commands.
You can create a maximum of 127 virtual switches on a single ESXi host. By default, each ESXi host has a single virtual switch called vSwitch0. By default, a virtual switch has 56 logical ports. See the Configuration Maximums document on the vSphere documentation main page for details. Ports connect to the virtual machines and the ESXi physical network adapters.
When two or more virtual machines are connected to the same virtual switch, network traffic between them is routed locally. If an uplink adapter is attached to the virtual switch, each virtual machine can access the external network that the adapter is connected to.
This section discusses working in a standard switch environment. See Networking Using vSphere Distributed Switches for information about distributed switch environments.
When working with virtual switches and port groups, perform the following tasks:
1
2
3
a
b
c
d
Retrieving Information About Virtual Switches
You can retrieve information about virtual switches by using ESXCLI or vicfg-vswitch. Specify one of the options listed in Connection Options in place of <conn_options>.
Retrieving Information about Virtual Switches with ESXCLI
You can retrieve information about virtual switches by using esxcli network vswitch commands.
esxcli <conn_options> network vswitch standard list
The command prints information about the virtual switch, which might include its name, number of ports, MTU, port groups, and other information. The output includes information about CDP settings for the virtual switch. The precise information depends on the target system. The default port groups are Management Network and VM Network.
esxcli <conn_options> network vswitch standard policy failover get
esxcli <conn_options> network vswitch standard policy security get
esxcli <conn_options> network vswitch standard policy shaping get
Retrieving Information about Virtual Switches with vicfg-vswitch
You can retrieve information about virtual switches by using the vcifg-vswitch command. Specify one of the options listed in Connection Options in place of <conn_options>.
Check whether vSwitch1 exists.
vicfg-vswitch <conn_options> -c vSwitch1
vicfg-vswitch <conn_options> -l
The command prints information about the virtual switch, which might include its name, number of ports, MTU, port groups, and other information. The default port groups are Management Network and VM Network.
If CDP is enabled on a virtual switch, ESXi administrators can find out which Cisco switch port is connected to which virtual switch uplink. CDP is a link-level protocol that supports discovery of CDP-aware network hardware at either end of a direct connection. CDP is bit forwarded through switches. CDP is a simple advertisement protocol which beacons information about the switch or host and some port information.
vicfg-vswitch <conn_options> --get-cdp vSwitch1
Adding and Deleting Virtual Switches
You can add and delete virtual switches with ESXCLI and with vicfg-vswitch.
Adding and Deleting Virtual Switches with ESXCLI
You can add and delete virtual switches using the esxcli network vswitch standard namespace. Specify one of the options listed in Connection Options in place of <conn_options>.
esxcli <conn_options> network vswitch standard add --vswitch-name=vSwitch42
You can specify the number of port groups while adding the virtual switch. If you do not specify a value, the default value is used. The system-wide port count cannot be greater than 4096.
esxcli <conn_options> network vswitch standard add --vswitch-name=vSwitch42 --ports=8
After you have added a virtual switch, you can set switch attributes (Setting Switch Attributes with esxcli network vswitch standard) and add one or more uplink adapters (Linking and Unlinking Uplink Adapters with ESXCLI).
esxcli <conn_options> network vswitch standard remove --vswitch-name=vSwitch42
You cannot delete a virtual switch if any ports on the switch are still in use by VMkernel networks or virtual machines. Run esxcli network vswitch standard list to determine whether a virtual switch is in use.
Adding and Deleting Virtual Switches with vicfg-vswitch
You can add and delete virtual switches using the --add|-a and --delete|-d options. Specify one of the options listed in Connection Options in place of <conn_options>.
vicfg-vswitch <conn_options> - -add vSwitch2
After you have added a virtual switch, you can set switch attributes (Setting Switch Attributes with vicfg-vswitch) and add one or more uplink adapters (Linking and Unlinking Uplink Adapters with vicfg-vswitch).
vicfg-vswitch <conn_options> --delete vSwitch1
You cannot delete a virtual switch if any ports on the switch are still in use by VMkernel networks, virtual machines, or vswifs. Run vicfg-vswitch --list to determine whether a virtual switch is in use.
Setting Switch Attributes with esxcli network vswitch standard
You can set the maximum transmission unit (MTU) and CDP status for a virtual switch. The CDP status shows which Cisco switch port is connected to which uplink. Specify one of the options listed in Connection Options in place of <conn_options>.
esxcli <conn_options> network vswitch standard set --mtu=9000 --vswitch-name=vSwitch1
The MTU is the size, in bytes, of the largest protocol data unit the switch can process. When you set this option, it affects all uplinks assigned to the virtual switch.
esxcli <conn_options> network vswitch standard set --cdp-status=listen --vswitch-name=vSwitch1
Setting Switch Attributes with vicfg-vswitch
You can set the maximum transmission unit (MTU) and CDP status for a virtual switch. The CDP status shows which Cisco switch port is connected to which uplink. Specify one of the options listed in Connection Options in place of <conn_options>.
vicfg-vswitch <conn_options> -m 9000 vSwitch1
The MTU is the size (in bytes) of the largest protocol data unit the switch can process. When you set this option, it affects all uplinks assigned to the virtual switch.
vicfg-vswitch <conn_options> --set-cdp ‘listen’
Checking, Adding, and Removing Port Groups
You can check, add, and remove port groups with ESXCLI and with vicfg-vswitch.
Managing Port Groups with ESXCLI
Network services connect to vSwitches through port groups. A port group allows you to group traffic and specify configuration options such as bandwidth limitations and VLAN tagging policies for each port in the port group. A virtual switch must have one port group assigned to it. You can assign additional port groups.
You can use esxcli network vswitch standard portgroup to check, add, and remove port groups. Specify one of the options listed in Connection Options in place of <conn_options>.
esxcli <conn_options> network vswitch standard portgroup list
Lists the port group name, associated virtual switch, active clients, and VLAN ID.
esxcli <conn_options> network vswitch standard portgroup add --portgroup-name=<name> --vswitch-name=vSwitch1
esxcli <conn_options> network vswitch standard portgroup remove --portgroup-name=<name> --vswitch-name=vSwitch1
Managing Port Groups with vicfg-vswitch
Network services connect to virtual switches through port groups. A port group allows you to group traffic and specify configuration options such as bandwidth limitations and VLAN tagging policies for each port in the port group. A virtual switch must have one port group assigned to it. You can assign additional port groups. Specify one of the options listed in Connection Options in place of <conn_options>.
You can use vicfg-vswitch to check, add, and remove port groups.
vicfg-vswitch <conn_options> - -check-pg <port_group> vSwitch1
The command returns 0 if the specified port group is associated with the virtual switch, and returns 1 otherwise. Use vicfg-vswitch --list to list all port groups.
vicfg-vswitch <conn_options> --add-pg <port_group_name> vSwitch1
vicfg-vswitch <conn_options> --del-pg <port_group_name> vSwitch1
Managing Uplinks and Port Groups
You can manage uplinks and port groups with ESXCLI and with vicfg-vswitch.
Connecting and Disconnecting Uplink Adapters and Port Groups with ESXCLI
If your setup includes one or more port groups, you can associate each port group with one or more uplink adapters (and remove the association). This functionality allows you to filter traffic from a port group to a specific uplink, even if the virtual switch is connected with multiple uplinks. Specify one of the options listed in Connection Options in place of <conn_options>.
esxcli <conn_options> network vswitch standard portgroup policy failover set --active-uplinks=vmnic1,vmnic6,vmnic7
This command fails silently if the uplink adapter does not exist.
esxcli <conn_options> network vswitch standard portgroup policy failover set --standby-uplinks=vmnic1,vmnic6,vmnic7
Connecting and Disconnecting Uplinks and Port Groups with vicfg-vswitch
If your setup includes one or more port groups, you can associate each port group with one or more uplink adapters (and remove the association). This functionality allows you to filter traffic from a port group to a specific uplink, even if the virtual switch is connected with multiple uplinks. Specify one of the options listed in Connection Options in place of <conn_options>.
vicfg-vswitch <conn_options> - -add-pg-uplink <adapter_name> - -pg <port_group> <vswitch_name>
This command fails silently if the uplink adapter does not exist.
vicfg-vswitch <conn_options> - -del-pg-uplink <adapter_name> - -pg <port_group> <vswitch_name>
Setting the Port Group VLAN ID
You can set the port group VLAN ID with ESXCLI and with vicfg-vswitch.
Setting the Port Group VLAN ID with ESXCLI
VLANs allow you to further segment a single physical LAN segment so that groups of ports are isolated as if they were on physically different segments. The standard is IEEE 802.1Q.
A VLAN ID restricts port group traffic to a logical Ethernet segment within the physical network.
If you use VLAN IDs, you must change the port group labels and VLAN IDs together so that the labels properly represent connectivity. VLAN IDs are optional.
You can use the following commands for VLAN management:
esxcli <conn_options> network vswitch standard portgroup set -p <pg_name> --vlan-id 4095
Call the command multiple times to allow all ports to reach port groups located on other VLANs.
esxcli <conn_options> network vswitch standard portgroup set --vlan-id 0 -p <pg_name>
Setting the Port Group VLAN ID with vicfg-vswitch
VLANs allow you to further segment a single physical LAN segment so that groups of ports are isolated as if they were on physically different segments. The standard is IEEE 802.1Q.
A VLAN ID restricts port group traffic to a logical Ethernet segment within the physical network.
If you use VLAN IDs, you must change the port group labels and VLAN IDs together so that the labels properly represent connectivity. VLAN IDs are optional.
You can use the following commands for VLAN management:
vicfg-vswitch <conn_options> --vlan 4095 --pg “ALL” vSwitch2
vicfg-vswitch <conn_options> --vlan 0 --pg g42 vSwitch2
Run vicfg-vswitch -l to retrieve information about VLAN IDs currently associated with the virtual switches in the network.
Run esxcli network vswitch standard portgroup list to list all port groups and associated VLAN IDs.
Managing Uplink Adapters
You can manage uplink adapters, which represent the physical NICs that connect the ESXi host to the network by using the esxcli network nics or the vicfg-nics command. You can also use esxcli network vswitch and esxcfg-vswitch to link and unlink the uplink.
You can use vicfg-nics to list information and to specify speed and duplex setting for the uplink.
You can use esxcli network nic to list all uplinks, to list information, to set attributes, and to bring a specified uplink down or up.
Managing Uplink Adapters with esxcli network nic
The following example workflow lists all uplink adapters, lists properties for one uplink adapter, changes the uplink’s speed and duplex settings, and brings the uplink down and back up. Specify one of the options listed in Connection Options in place of <conn_options>.
To manipulate uplink adapter setup
1
esxcli <conn_options> network nic list
You can narrow down the information displayed by using esxcli network nic get --nic-name=<nic>.
2
esxcli <conn_options> network nic down --nic-name=vmnic0
3
esxcli <conn_options> network nic set <option>
Specify one of the following options.
aui – Select aui as the device port
bnc – Select bnc as the device port
fibre – Select mii as the device port
mii – Select mii as the device port
tp – Select tp as the device port
external – Set the transceiver type to external
internal – Set the transceiver type to internal
Set Wake-on-LAN options. Not all devices support this option. The option value is a string of characters specifying which options to enable.
p – Wake on phy activity
u – Wake on unicast messages
m – Wake on multicast messages
b – Wake on broadcast messages
a – Wake on ARP
g – Wake on MagicPacket
s – Enable SecureOn password for MagicPacket
4
esxcli <conn_options> network nic up --nic-name=vmnic0
Specifying Multiple Uplinks with ESXCLI
At any time, one port group NIC array and a corresponding set of active uplinks exist. When you change the active uplinks, you also change the standby uplinks and the number of active uplinks.
The following example illustrates how active and standby uplinks are set.
1
The portgroup nic array is [vmnic1, vmnic0, vmnic3, vmnic5, vmnic6, vmnic7] and active-uplinks is set to three uplinks (vmnic1, vmnic0, vmnic3). The other uplinks are standby uplinks.
2
3
The new uplinks override the old set. The NIC array changes to [vmnic3, vmnic5, vmnic6, vmnic7]. vmnic0 and vmnic1 are removed from the NIC array and max-active becomes 2.
If you want to keep vmnic0 and vmnic1 in the array, you can make those NICs standby uplinks in the command that changes the active uplinks.
esxcli network vswitch standard portgroup policy failover set -p testPortgroup --active-uplinks vmnic3,vmnic5 --standby-uplinks vmnic1,vmnic0,vmnic6,vmnic7
Managing Uplink Adapters with vicfg-nics
The following example workflow lists an uplink adapter’s properties, changes the duplex and speed, and sets the uplink to autonegotiate its speed and duplex settings. Specify one of the options listed in Connection Options in place of <conn_options>.
To manipulate uplink adapter setup
1
vicfg-nics <conn_options> -l
Lists the uplinks in the system, their current and configured speed, and their duplex setting.
2
Set the settings for vmnic0 to full and the speed to 100.
vicfg-nics <conn_options> -d full -s 100 vmnic0
3
Set vmnic2 to autonegotiate its speed and duplex settings.
vicfg-nics <conn_options> -a vmnic2
Linking and Unlinking Uplink Adapters with ESXCLI
When you create a virtual switch using esxcli network vswitch standard add, all traffic on that virtual switch is initially confined to that virtual switch. All virtual machines connected to the virtual switch can talk to each other, but the virtual machines cannot connect to the network or to virtual machines on other hosts. A virtual machine also cannot connect to virtual machines connected to a different virtual switch on the same host.
Having a virtual switch that is not connected to the network might make sense if you want a group of virtual machines to be able to communicate with each other, but not with other hosts or with virtual machines on other hosts. In most cases, you set up the virtual switch to transfer data to external networks by attaching one or more uplink adapters to the virtual switch.
You can use the following commands to list, add, and remove uplink adapters:
esxcli <conn_options> network vswitch standard list
The uplink adapters are returned in the Uplink item.
esxcli <conn_options> network vswitch standard uplink add --uplink-name=vmnic15 vswitch-name=vSwitch0
esxcli <conn_options> network vswitch standard uplink remove --uplink-name=vmnic15 vswitch-name=vSwitch0
Linking and Unlinking Uplink Adapters with vicfg-vswitch
When you create a virtual switch using vicfg-vswitch --add, all traffic on that virtual switch is initially confined to that virtual switch. All virtual machines connected to the virtual switch can talk to each other, but the virtual machines cannot connect to the network or to virtual machines on other hosts. A virtual machine also cannot connect to virtual machines connected to a different virtual switch on the same host.
Having a virtual switch that is not connected to the network might make sense if you want a group of virtual machines to be able to communicate with each other, but not with other hosts or with virtual machines on other hosts. In most cases, you set up the virtual switch to transfer data to external networks by attaching one or more uplink adapters to the virtual switch.
You can use the following commands to add and remove uplink adapters:
vicfg-vswitch <conn_options> --link vmnic15 vSwitch0
vicfg-vswitch <conn_options> --unlink vmnic15 vSwitch0
Adding and Modifying VMkernel Network Interfaces
VMkernel network interfaces are used primarily for management traffic, which can include vMotion, IP Storage, and other management traffic on the ESXi system. You can also bind a newly created VMkernel network interface for use by software and dependent hardware iSCSI by using the esxcli iscsi commands.
The VMkernel network interface is separate from the virtual machine network. The guest operating system and application programs communicate with a VMkernel network interface through a commonly available device driver or a VMware device driver optimized for the virtual environment. In either case, communication in the guest operating system occurs as it would with a physical device. Virtual machines can also communicate with a VMkernel network interface if both use the same virtual switch.
Each VMkernel network interface has its own MAC address and one or more IP addresses, and responds to the standard Ethernet protocol as would a physical NIC. The VMkernel network interface is created with TCP Segmentation Offload (TSO) enabled.
You can manage VMkernel NICs with ESXCLI (see Managing VMkernel Network Interfaces with ESXCLI) and with vicfg-vmknic (see Managing VMkernel Network Interfaces with vicfg-vmknic).
Managing VMkernel Network Interfaces with ESXCLI
You can configure the VMkernel network interface for IPv4 (see To add and configure an IPv4 VMkernel Network Interface for IPv4) or for IPv6 (see To add and configure a VMkernel Network Interface for IPv6) with ESXCLI. In contrast to vicfg-vmknic, ESXCLI does not support enabling vMotion.
You can add and configure an IPv4 VMkernel NIC with ESXCLI. Specify one of the options listed in Connection Options in place of <conn_options>.
To add and configure an IPv4 VMkernel Network Interface for IPv4
1
esxcli <conn_options> network ip interface add --interface-name=vmk<x> --portgroup-name=<my_portgroup>
You can specify the MTU setting after you have added the network interface by using esxcli network ip interface set --mtu.
2
Configure the interface as an IPv4 interface. You must specify the IP address using - -ip, the netmask, and the name. For the following examples, assume that VMSF-VMK-363 is a port group to which you want to add a VMkernel network interface.
esxcli <conn_options> network ip interface ipv4 set - -ip=<ip_address> --netmask=255.255.255.0 --interface-name=vmk<X>
You can set the address as follows.
The VMkernel supports DHCP only for ESXi 4.0 and later.
When the command finishes successfully, the newly added VMkernel network interface is enabled.
3
esxcli <conn_options> network ip interface list
The command displays the network information, port group, MTU, and current state for each virtual network adapter in the system.
You can add and configure an IPv6 VMkernel NIC with ESXCLI.
To add and configure a VMkernel Network Interface for IPv6
1
Run esxcli network ip interface add to add a new VMkernel network interface.
esxcli <conn_options> network ip interface add --interface-name=vmk<x> --portgroup-name=<my_portgroup>
You can specify the MTU setting after you have added the network interface by using esxcli network ip interface set --mtu.
When the command finishes successfully, the newly added VMkernel network interface is enabled.
2
Run esxcli network ip interface ipv6 address add to configure the interface as an IPv6 interface. You must specify the IP address using - -ip and the name. For the following examples, assume that VMSF-VMK-363 is a port group to which you want to add a VMkernel network interface.
esxcli <conn_options> network ip interface ipv6 address add - -ip=<X:X:X::/X> --interface-name=vmk<X>
You can set the address as follows.
--enable-dhcpv6: Enables DHCPv6 on this interface and attempts to acquire an IPv6 address from the network.
--enable-router-adv: Use the IPv6 address advertised by the router. The address is added when the router sends the next router advert.
The VMkernel supports DHCP only for ESXi 4.0 and later.
When the command completes successfully, the newly added VMkernel network interface is enabled.
3
esxcli <conn_options> network ip interface list
The list contains the network information, port group, MTU, and current state for each VMkernel Network Interface on the system.
4
esxcli <conn_options> network ip interface ipv6 address remove --interface-name=<VMK_NIC> --ipv6=<ipv6_addr>
esxcli <conn_options> network ip set --ipv6-enabled=false
Managing VMkernel Network Interfaces with vicfg-vmknic
You can configure the VMkernel network interface for IPv4 (see To add and configure an IPv4 VMkernel Network Interface with vicfg-vmknic) or for IPv6 (see To add and configure an IPv6 VMkernel Network Interface with vicfg-vmknic). Specify one of the options listed in Connection Options in place of <conn_options>.
To add and configure an IPv4 VMkernel Network Interface with vicfg-vmknic
1
Run vicfg-vmknic --add to add a VMkernel network interface.
You must specify the IP address by using - -ip, the netmask, and the name. For the following examples, assume that VMSF-VMK-363 is a port group to which you want to add a VMkernel network interface.
vicfg-vmknic <conn_options> --add - -ip <ip_address> -n 255.255.255.0 VMSF-VMK-363
You can specify the MTU setting when adding a VMkernel network interface. You cannot change that setting at a later time.
When the command completes successfully, the newly added VMkernel network interface is enabled.
2
vicfg-vmknic <conn_options> --ip <address> VMSF-VMK-363
For IPv4, choose one of the following formats:
The VMkernel supports DHCP only for ESXi 4.0 and later.
3
By default, vMotion is disabled.
vicfg-vmknic <conn_options> --enable-vmotion VMSF-VMK-363
You can later use --disable-vmotion to disable vMotion for this VMkernel network interface.
4
vicfg-vmknic <conn_options> --list
The command displays the network information, port group, MTU, and current state for each virtual network adapter in the system.
To add and configure an IPv6 VMkernel Network Interface with vicfg-vmknic
1
Run vicfg-vmknic --add to add a VMkernel network interface.
You must specify the IP address by using - -ip, the netmask, and the port group name. For the following examples, assume that VMSF-VMK-363 is a port group to which you want to add a VMkernel network interface.
You can specify the MTU setting when you add a VMkernel network interface. You cannot change that setting at a later time.
When the command completes successfully, the newly added VMkernel network interface is enabled.
2
vicfg-vmknic <conn_options> --enable-ipv6 true VMSF-VMK-363
3
vicfg-vmknic <conn_options> - -ip <ip_address> VMSF-VMK-363
For IPv6, the IP address can have one of the following formats:
DHCPV6 – Use DHCP IPv6 address. The VMkernel supports DHCP only for ESX/ESXi 4.0 and later.
AUTOCONF – Use the IPv6 address advertised by the router. If you create a VMkernel network interface with AUTOCONF, an address is assigned immediately. If you add AUTOCONF to an existing vmknic, the address is added when the router sends the next router advert.
4
By default, vMotion is disabled.
vicfg-vmknic <conn_options> --enable-vmotion VMSF-VMK-363
You can later use --disable-vmotion to disable vMotion again.
5
vicfg-vmknic <conn_options> --list
The list contains the network information, port group, MTU, and current state for each virtual network adapter in the system.
6
vicfg-vmknic <conn_options> - -unset-ip <X:X:X::/X> VMSF-VMK-363
vicfg-vmknic <conn_options> --enable-ipv6 false VMSF-VMK-363