Basic VMWare Networking

[DefenderAtkins]

Hi all,

I have a very basic VMWare networking question. For the sake of this question, lets say I have two ESX hosts and a switch.

One host is hosting two guest machines and the other host is empty just sitting there. They are both in vLan 10, I have created a vSwitch on a NIC and setup a network with vLan 10.

Now the hosts can ping each other, can ping the gateway, can ping everything else in vLan 10.

However, my guest machines can only ping themselves, not the gateway, not other thing in vLan 10.

I have checked in my vCenter and the hosts have the correct default gateway. And the guest machines have correct gateways configured too.

Any ideas?

[rcporto]

Where you're assign the VLAN10, on vSphere side or at physical switch? And do you have different vSwitch for management and virtual machines? If using the same virtual switch and assigning the VLAN on vSphere side, can you confirm if you assigned the VLAN10 to the virtual machine port group, see:

Please, if possible, post a print screen with your vSphere virtual switch and port group settings.

[DefenderAtkins]

My guest machines are called TEST and MIGRATIONTEST. They are seen above. They can ping eachother but they cannot ping the default gateway. However, the host that they are on, have no issue pining everything in VLAN 10 apart from pinging these guest machines.

The VLAN is asdigned both in vSpehre and physical switch side.

[rcporto]

Try removing the VLAN 10 from the "TESTNETWORK" port group.

[DefenderAtkins]

Hi Richardson,

Thanks for you help.

That worked but I don't understand why the issue occurred or why it worked by removing the vLan ID.

Could you please shed some light on it?

[rcporto]

The problem is that you cannot assign VLAN on both sides (physical switch and virtual switch port group), and you can find that on the following VMware KB article: VMware Knowledge Base

Caution: Native VLAN ID on ESXi/ESX VST Mode is not supported. Do not assign a VLAN to a port group that is same as the native VLAN ID of the physical switch. Native VLAN packets are not tagged with the VLAN ID on the outgoing traffic toward the ESXi/ESX host. Therefore, if the ESXi/ESX host is set to VST mode, it drops the packets that are lacking a VLAN tag.

[DefenderAtkins]

Thank you for the explanation.

My ultimate goal is to migrate VMs from the old hosts to these new hosts. So this is where I got confused.

At the moment for testing, I am using only one port on the hosts. All 4 ports will be populated eventually.

So from what you are saying, if I want to assign VLANs on vSphere level, the physical switchports my hosts is connecting to, they need to be configured as trunk ports instead of accessports?

Thanks.

[rcporto]

So from what you are saying, if I want to assign VLANs on vSphere level, the physical switchports my hosts is connecting to, they need to be configured as trunk ports instead of accessports?

You can configure the physical switch port as Trunk (and let the native/default VLAN different of 10) and assign VLAN 10 on TESTNETWORK port group and to Management Network as well.

[DefenderAtkins]

Thank you Richardson,

So from my understanding, this is how it should be?

[rcporto · Accepted solution]

Yes, just remember to change the native VLAN of the trunk ports to a VLAN different from the 10, 50, 99, 1007... you can for instance configure the native VLAN as VLAN 1.

[DefenderAtkins]

Thank you so much for your help!.

[DefenderAtkins]

Hi Richardson,

I changed the ports on the switch to trunk with native vlan 50. (vlan 50 is the management vlan of the hosts).

I have added vlan 50 back to the vSwitch (I used vlan 10 for testing previously. Now I am using 50).

As soon as I add vlan onto the vswitch network for the two test vms, they cannot ping anymore. When I remove the vlan 50, they can ping as they should be.

What am I missing here?

[rcporto]

You're still missing that you cannot set the VLAN on physical switch and at virtual switch level, since you defined the VLAN 50 as the native on physical switch, you need to remove that VLAN from virtual switch port group, see the explanation from the VMware KB article again:

[DefenderAtkins]

I have changed the switch port to a flat Trunk without any native vLans.

I am still having that problem when I ID the vLan in vSwitch to vLan 50, the machines can't communicate outside (cannot hit the gateway).

When I remove the vLan ID 50, it works again. I dont understand, I've already made the port to Trunk with no native vLan.

Any suggestions?

Thanks