Vsphere Esxi Vcenter Server 55 Networking Guide

vSphere Networking
vSphere 5.5 ESXi 5.5 vCenter Server 5.5
This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www.vmware.com/support/pubs.
EN-001074-02
vSphere Networking
You can find the most up-to-date technical documentation on the VMware Web site at: http://www.vmware.com/support/ The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: [email protected]
Copyright 20092013 VMware, Inc. All rights reserved. Copyright and trademark information.
VMware, Inc. 3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com
VMware, Inc.
Contents
About vSphere Networking
1 Updated Information 11 2 Introduction to Networking 13

Networking Concepts Overview 13 Network Services in ESXi 15 VLAN Configuration 15 VMware ESXi Dump Collector Support 15
3 Setting Up Networking with vSphere Standard Switches 17
vSphere Standard Switches 17 Port Group Configuration for Virtual Machines 18 Add a Virtual Machine Port Group with the vSphere Web Client 19 Edit a Standard Switch Port Group in the vSphere Web Client 20 Remove a Port Group from a vSphere Standard Switch in the vSphere Web Client 21 vSphere Standard Switch Properties 21 Change the Number of Ports for a vSphere Standard Switch in the vSphere Web Client 21 Change the Speed of a Physical Adapter in the vSphere Web Client 22 Add and Team Physical Adapters in a Standard Switch in the vSphere Web Client 22 View the Topology Diagram of a vSphere Standard Switch in the vSphere Web Client 23
4 Setting Up Networking with vSphere Distributed Switches 25
vSphere Distributed Switch Architecture 26 Create a vSphere Distributed Switch with the vSphere Web Client 27 Upgrade a vSphere Distributed Switch to a Later Version with the vSphere Web Client 28 Edit General and Advanced vSphere Distributed Switch Settings in the vSphere Web Client 29 Managing Networking on Multiple Hosts on a vSphere Distributed Switch 30 Tasks for Managing Host Networking on a vSphere Distributed Switch 31 Add Hosts to a vSphere Distributed Switch in the vSphere Web Client 32 Configure Physical Network Adapters on a vSphere Distributed Switch in the vSphere Web Client 33 Migrate VMkernel Adapters to a vSphere Distributed Switch in the vSphere Web Client 34 Create a VMkernel Adapter on a vSphere Distributed Switch in the vSphere Web Client 35 Migrate Virtual Machine Networking to the vSphere Distributed Switch in the vSphere Web Client 36 Update the Maximum Number of Distributed Ports on Hosts in the vSphere Web Client 37 Use a Host as a Template to Create a Uniform Networking Configuration on a vSphere Distributed Switch in the vSphere Web Client 37 Remove Hosts from a vSphere Distributed Switch in the vSphere Web Client 38
VMware, Inc.
vSphere Networking
Managing Networking on Host Proxy Switches
39
Migrate Network Adapters on a Host to a vSphere Distributed Switch in the vSphere Web Client 39 Migrate a VMkernel Adapter on a Host to a vSphere Standard Switch in the vSphere Web Client 40 Assign a Physical NIC of a Host to a vSphere Distributed Switch in the vSphere Web Client Remove a Physical NIC from a vSphere Distributed Switch in the vSphere Web Client 41 Set the Number of Ports on a Host Proxy Switch in the vSphere Web Client 41 Removing NICs from Active Virtual Machines 42
40
Distributed Port Groups 42 Add a Distributed Port Group in the vSphere Web Client 42 Edit General Distributed Port Group Settings with the vSphere Web Client 45 Edit Advanced Distributed Port Group Settings with the vSphere Web Client 46 Remove a Distributed Port Group in the vSphere Web Client 47 Export, Import, and Restore vSphere Distributed Port Group Configurations 47 Working with Distributed Ports 49 Monitor Distributed Port State with the vSphere Web Client 49 Configure Distributed Port Settings with the vSphere Web Client 49 Configuring Virtual Machine Networking on a vSphere Distributed Switch 50 Migrate Virtual Machines to or from a vSphere Distributed Switch with the vSphere Web Client 50 Connect an Individual Virtual Machine to a Distributed Port Group in the vSphere Web Client Topology Diagrams of a vSphere Distributed Switch in the vSphere Web Client 51 View the Topology of a vSphere Distributed Switch in the vSphere Web Client 51 View the Topology of a Host Proxy Switch in the vSphere Web Client 53 vSphere Distributed Switch Health Check 53 Enable or Disable vSphere Distributed Switch Health Check in the vSphere Web Client 53 View vSphere Distributed Switch Health Check Information 54 Export, Import, and Restore Distributed Switch Configurations 54 Export vSphere Distributed Switch Configurations with the vSphere Web Client 54 Import a vSphere Distributed Switch Configuration by Using the vSphere Web Client 55 Restore a vSphere Distributed Switch Configuration with the vSphere Web Client 56 Private VLANs 56 Create a Private VLAN in the vSphere Web Client 57 Remove a Primary Private VLAN with the vSphere Web Client 57 Remove a Secondary Private VLAN with the vSphere Web Client 58 LACP Support on a vSphere Distributed Switch 59 Convert to the Enhanced LACP Support on a vSphere Distributed Switch in the vSphere Web Client 61 LACP Teaming and Failover Configuration for Distributed Port Groups 62 Configure a LAG to Handle the Traffic for Distributed Port Groups in the vSphere Web Client Edit a LAG in the vSphere Web Client 66 Enable the LACP 5.1 Support on an Uplink Port Group in the vSphere Web Client 67 Limitations of the LACP Support on a vSphere Distributed Switch 67
50
62
5 Setting Up VMkernel Networking 69
The VMkernel Networking Layer 70 View Information About VMkernel Adapters on a Host in the vSphere Web Client 71 Create a VMkernel Adapter on a vSphere Standard Switch in the vSphere Web Client 71
VMware, Inc.
Contents
Create a VMkernel Adapter on a Host Associated with a vSphere Distributed Switch in the vSphere Web Client 73 Edit a VMkernel Adapter Configuration in the vSphere Web Client 74 View TCP/IP Stack Configuration on a Host in the vSphere Web Client 75 Change the Configuration of a TCP/IP Stack on a Host in the vSphere Web Client Create a Custom TCP/IP Stack 76 Remove a VMkernel Adapter in the vSphere Web Client 77
76
6 Networking Policies 79
Teaming and Failover Policy 80 Edit Teaming and Failover Policy for a vSphere Standard Switch in the vSphere Web Client 80 Edit the Teaming and Failover Policy on a Standard Port Group in the vSphere Web Client 82 Edit the Teaming and Failover Policy on a Distributed Port Group in the vSphere Web Client 84 Edit Distributed Port Teaming and Failover Policies with the vSphere Web Client 85 VLAN Policy 87 Edit the VLAN Policy on a Distributed Port Group in the vSphere Web Client 87 Edit the VLAN Policy on a Distributed Port with the vSphere Web Client 88 Edit the VLAN Policy on an Uplink Port Group in the vSphere Web Client 88 Edit the VLAN Policy on an Uplink Port with the vSphere Web Client 89 Security Policy 90 Edit Security Policy for a vSphere Standard Switch in the vSphere Web Client 90 Edit the Layer 2 Security Policy Exception for a Standard Port Group in the vSphere Web Client 91 Edit the Security Policy for a Distributed Port Group in the vSphere Web Client 91 Edit Distributed Port Security Policies with the vSphere Web Client 92 Traffic Shaping Policy 93 Edit the Traffic Shaping Policy for a vSphere Standard Switch in the vSphere Web Client 94 Edit the Traffic Shaping Policy for a Standard Port Group in the vSphere Web Client 94 Edit the Traffic Shaping Policy on a Distributed Port Group in the vSphere Web Client 95 Edit the Traffic Shaping Policy on a Distributed Port in the vSphere Web Client 96 Resource Allocation Policy 97 Edit the Resource Allocation Policy on a Distributed Port Group in the vSphere Web Client 97 Edit the Resource Allocation Policy on a Distributed Port in the vSphere Web Client 98 Monitoring Policy 98 Edit the Monitoring Policy on a Distributed Port Group in the vSphere Web Client 98 Edit the Monitoring Policy on a Distributed Port in the vSphere Web Client 99 Traffic Filtering and Marking Policy 99 Traffic Filtering and Marking on a Distributed Port Group or Uplink Port Group in the vSphere Web Client 100 Traffic Filtering and Marking on a Distributed Port or Uplink Port in the vSphere Web Client 106 Qualifying Traffic for Filtering and Marking 113 Port Blocking Policies 115 Edit the Port Blocking Policy for a Distributed Port Group in the vSphere Web Client 115 Edit Distributed Port or Uplink Port Blocking Policies with the vSphere Web Client 115 Manage Policies for Multiple Port Groups on a vSphere Distributed Switch in the vSphere Web Client 116
VMware, Inc.
vSphere Networking
7 Managing Network Resources 123
vSphere Network I/O Control 123 Enable Network I/O Control on a vSphere Distributed Switch with the vSphere Web Client 124 Create a Network Resource Pool with the vSphere Web Client 124 Add or Remove Distributed Port Groups from a Network Resource Pool with the vSphere Web Client 125 Edit Network Resource Pool Settings with the vSphere Web Client 126 Delete a User-Defined Network Resource Pool with the vSphere Web Client 126 TCP Segmentation Offload and Jumbo Frames 127 Enabling TSO 127 Enabling Jumbo Frames 128 NetQueue and Networking Performance 130 Enable NetQueue on a Host 130 Disable NetQueue on a Host 131 DirectPath I/O 131 Configure Passthrough Devices on a Host with the vSphere Web Client 132 Configure a PCI Device on a Virtual Machine with the vSphere Web Client 133 Enable DirectPath I/O with vMotion on a Virtual Machine with the vSphere Web Client 133 Single Root I/O Virtualization (SR-IOV) 134 SR-IOV Support 134 SR-IOV Component Architecture and Interaction 136 vSphere and Virtual Function Interaction 138 DirectPath I/O vs SR-IOV 139 Configure a Virtual Machine to Use SR-IOV in the vSphere Web Client 139 Networking Options for the Traffic Related to an SR-IOV Enabled Virtual Machine 141 Using an SR-IOV Physical Adapter to Handle Virtual Machine Traffic 141 Enabling SR-IOV by Using Host Profiles in the vSphere Web Client or Through an ESXCLI Command 142 A Virtual Machine That Uses an SR-IOV Virtual Function Is Powered off Because the Host Is Out of Interrupt Vectors 144
8 MAC Address Management 145
MAC Address Assignment from vCenter Server 145 VMware OUI Allocation 146 Prefix-Based MAC Address Allocation 146 Range-Based MAC Address Allocation 147 Assigning a MAC Address 147 MAC Address Generation on ESXi Hosts 149 Setting a Static MAC Address to a Virtual Machine 150 VMware OUI in Static MAC Addresses 150 Assign a Static MAC Address with the vSphere Web Client 151 Assign a Static MAC Address in the Virtual Machine Configuration File
151
9 Advanced Networking 153
Enable or Disable IPv6 Support on a Host by Using the vSphere Web Client Working With Port Mirroring 154 Port Mirroring Version Compatibility 154 Port Mirroring Interoperability 155
153
VMware, Inc.
Contents
Create a Port Mirroring Session with the vSphere Web Client
156
View Port Mirroring Session Details in the vSphere Web Client 159 Edit Port Mirroring Session Details, Sources, and Destinations with the vSphere Web Client 159 Configure NetFlow Settings with the vSphere Web Client 161 Switch Discovery Protocol 161 Enable Cisco Discovery Protocol on a vSphere Distributed Switch with the vSphere Web Client 161 Enable Link Layer Discovery Protocol on a vSphere Distributed Switch in the vSphere Web Client 162 View Switch Information with the vSphere Web Client 163 Mounting NFS Volumes 163 Networking Rollback and Recovery 163 vSphere Networking Rollback 163 Restore a Previous Networking Configuration with the vSphere Web Client 165 Resolve Errors in the Management Network Configuration on a vSphere Distributed Switch Configuring Protocol Profiles for Virtual Machine Networking 166 Add a Network Protocol Profile 167 Associate a Port Group with a Network Protocol Profile in the vSphere Web Client 169 Configure a Virtual Machine or vApp to Use a Network Protocol Profile in the vSphere Web Client 169 Stateless Network Deployment 170
166
10 Monitoring Network Packets 173
Capturing and Tracing Network Packets by Using The pktcap-uw Utility pktcap-uw Command Syntax 173 General Options for Capturing and Tracing Packets 176 Filter Options for Capturing and Tracing Packets 176 Capturing Packets by Using The pkcap-uw Tool 177 Trace Packets by Using the pktcap-uw Utility 184
173
11 Networking Best Practices 187

Index 189
VMware, Inc.
vSphere Networking
VMware, Inc.
About vSphere Networking
vSphere Networking provides information about configuring networking for VMware vSphere , including how to create vSphere distributed switches and vSphere standard switches. vSphere Networking also provides information on monitoring networks, managing network resources, and networking best practices.
Intended Audience
The information presented is written for experienced Windows or Linux system administrators who are familiar with network configuration and virtual machine technology.
VMware, Inc.
vSphere Networking
10
VMware, Inc.
Updated Information
This vSphere Networking documentation is updated with each release of the product or when necessary. This table provides the update history of the vSphere Networking documentation.
Revision EN-001074-02 Description
n
A new section Capturing and Tracing Network Packets by Using The pktcap-uw Utility, on page 173 provides instructions about capturing and tracing packets on a host by using the pktcap-uw tool. Information about the LACP port channel configuration on the physical switch added in LACP Support on a vSphere Distributed Switch, on page 59. The section Single Root I/O Virtualization (SR-IOV), on page 134 now contains more details about the number of virtual functions than you can use and more troubleshooting information. Migrate Virtual Machine Networking to the vSphere Distributed Switch in the vSphere Web Client, on page 36 contains the correct option to migrate virtual machine networking on multiple hosts that are connected to a vSphere Distributed Switch.
EN-001074-01
n n
EN-001074-00
Initial release.
VMware, Inc.
11
vSphere Networking
12
VMware, Inc.
Introduction to Networking
The basic concepts of ESXi networking and how to set up and configure a network in a vSphere environment are discussed. This chapter includes the following topics:
n n n n
Networking Concepts Overview, on page 13 Network Services in ESXi, on page 15 VLAN Configuration, on page 15 VMware ESXi Dump Collector Support, on page 15
Networking Concepts Overview

A few concepts are essential for a thorough understanding of virtual networking. If you are new to ESXi, it is helpful to review these concepts. Physical Network A network of physical machines that are connected so that they can send data to and receive data from each other. VMware ESXi runs on a physical machine. A network of virtual machines running on a physical machine that are connected logically to each other so that they can send data to and receive data from each other. Virtual machines can be connected to the virtual networks that you create when you add a network. It manages network traffic between machines on the physical network. A switch has multiple ports, each of which can be connected to a single machine or another switch on the network. Each port can be configured to behave in certain ways depending on the needs of the machine connected to it. The switch learns which hosts are connected to which of its ports and uses that information to forward traffic to the correct physical machines. Switches are the core of a physical network. Multiple switches can be connected together to form larger networks. It works much like a physical Ethernet switch. It detects which virtual machines are logically connected to each of its virtual ports and uses that information to forward traffic to the correct virtual machines. A vSphere standard switch can be connected to physical switches by using physical Ethernet adapters, also referred to as uplink adapters, to join virtual
Virtual Network
Physical Ethernet Switch
vSphere Standard Switch
VMware, Inc.
13
vSphere Networking
networks with physical networks. This type of connection is similar to connecting physical switches together to create a larger network. Even though a vSphere standard switch works much like a physical switch, it does not have some of the advanced functionality of a physical switch. Standard Port Group It specifies port configuration options such as bandwidth limitations and VLAN tagging policies for each member port. Network services connect to standard switches through port groups. Port groups define how a connection is made through the switch to the network. Typically, a single standard switch is associated with one or more port groups. It acts as a single switch across all associated hosts in a datacenter to provide centralized provisioning, administration, and monitoring of virtual networks. You configure a vSphere distributed switch on the vCenter Server system and the configuration is populated across all hosts that are associated with the switch. This lets virtual machines to maintain consistent network configuration as they migrate across multiple hosts. A hidden standard switch that resides on every host that is associated with a vSphere distributed switch. The host proxy switch replicates the networking configuration set on the vSphere distributed switch to the particular host. A port on a vSphere distributed switch that connects to a hosts VMkernel or to a virtual machines network adapter. A port group associated with a vSphere distributed switch and specifies port configuration options for each member port. Distributed port groups define how a connection is made through the vSphere distributed switch to the network. NIC teaming occurs when multiple uplink adapters are associated with a single switch to form a team. A team can either share the load of traffic between physical and virtual networks among some or all of its members, or provide passive failover in the event of a hardware failure or a network outage. VLAN enable a single physical LAN segment to be further segmented so that groups of ports are isolated from one another as if they were on physically different segments. The standard is 802.1Q. The VMkernel networking layer provides connectivity to hosts and handles the standard infrastructure traffic of vSphere vMotion, IP storage, Fault Tolerance, and Virtual SAN. Any form of storage that uses TCP/IP network communication as its foundation. iSCSI can be used as a virtual machine datastore, and NFS can be used as a virtual machine datastore and for direct mounting of .ISO files, which are presented as CD-ROMs to virtual machines. TCP Segmentation Offload, TSO, allows a TCP/IP stack to emit large frames (up to 64KB) even though the maximum transmission unit (MTU) of the interface is smaller. The network adapter then separates the large frame into MTU-sized frames and prepends an adjusted copy of the initial TCP/IP headers.
vSphere Distributed Switch
Host Proxy Switch
Distributed Port Distributed Port Group
NIC Teaming
VLAN
VMkernel TCP/IP Networking Layer IP Storage
TCP Segmentation Offload
14
VMware, Inc.
Chapter 2 Introduction to Networking
Network Services in ESXi

A virtual network provides several services to the host and virtual machines. You can enable two types of network services in ESXi:
n n
Connecting virtual machines to the physical network and to each other. Connecting VMkernel services (such as NFS, iSCSI, or vMotion) to the physical network.
VLAN Configuration
Virtual LANs (VLANs) enable a single physical LAN segment to be further isolated so that groups of ports are isolated from one another as if they were on physically different segments. Configuring ESXi with VLANs is recommended for the following reasons.
n n n
It integrates the host into a pre-existing environment. It isolates and secures network traffic. It reduces network traffic congestion.
You can configure VLANs in ESXi using three methods: External Switch Tagging (EST), Virtual Switch Tagging (VST), and Virtual Guest Tagging (VGT). With EST, all VLAN tagging of packets is performed on the physical switch. Host network adapters are connected to access ports on the physical switch. Port groups that are connected to the virtual switch must have their VLAN ID set to 0. With VST, all VLAN tagging of packets is performed by the virtual switch before leaving the host. Host network adapters must be connected to trunk ports on the physical switch. Port groups that are connected to the virtual switch must have a VLAN ID between 1 and 4094. With VGT, all VLAN tagging is done by the virtual machine. VLAN tags are preserved between the virtual machine networking stack and external switch when frames pass to and from virtual switches. Host network adapters must be connected to trunk ports on the physical switch. The VLAN ID of port groups with VGT must be set to 4095. NOTE When using VGT, you must have an 802.1Q VLAN trunking driver installed on the virtual machine.
VMware ESXi Dump Collector Support

The ESXi Dump Collector sends the state of the VMkernel memory, that is, a core dump to a network server when the system encounters a critical failure. The ESXi Dump Collector in ESXi 5.1 and later supports both vSphere Standard and Distributed Switches. The ESXi Dump Collector can also use any active uplink adapter from the team of the port group that handles the VMkernel adapter for the collector. Changes to the IP address for the ESXi Dump Collector interface are automatically updated if the IP addresses for the configured VMkernel adapter changes. The ESXi Dump Collector also adjusts its default gateway if the gateway configuration of the VMkernel adapter changes. If you try to delete the VMkernel network adapter used by the ESXi Dump Collector, the operation fails and a warning message appears. To delete the VMkernel network adapter, disable dump collection and delete the adapter.
VMware, Inc.
15
vSphere Networking
There is no authentication or encryption in the file transfer session from a crashed host to the ESXi Dump Collector. You should configure the ESXi Dump Collector on a separate VLAN when possible to isolate the ESXi core dump from regular network traffic. For information about installing and configuring the ESXi Dump Collector, see the vSphere Installation and Setup documentation.
16
VMware, Inc.
Setting Up Networking with vSphere Standard Switches
vSphere standard switches handle network traffic at the host level in a vSphere deployment. This chapter includes the following topics:
n n n
vSphere Standard Switches, on page 17 Port Group Configuration for Virtual Machines, on page 18 vSphere Standard Switch Properties, on page 21
vSphere Standard Switches

You can create abstracted network devices called vSphere standard switches. You use standard switches to provide network connectivity to hosts and virtual machines. A standard switch can bridge traffic internally between virtual machines in the same VLAN and link to external networks.
Standard Switch Overview

To provide network connectivity to hosts and virtual machines, you connect the physical NICs of the hosts to uplink ports on the standard switch. Virtual machines have network adapters (vNICs) that you connect to port groups on the standard switch. Every port group can use one or more physical NICs to handle their network traffic. If a port group does not have a physical NIC connected to it, virtual machines on the same port group can only communicate with each other but not with the external network.
VMware, Inc.
17
vSphere Networking
Figure 31. vSphere standard switch architecture

ESXi host 1
Management traffic vMotion traffic VM VM VM VM VM VM VM
ESXi host 2
VM vMotion traffic Management traffic
vNIC Network production Virtual port
vmknic
Management
vMotion
Test environment
Production
Port groups
Production
Test environment
vMotion
Management
Uplink port group
Uplink port group
uplink port 0
uplink port 1
uplink port 2
uplink port 0
uplink port 1
uplink port 2
Physical network adapters

vmnic0 vmnic1 vmnic3 vmnic0 vmnic1 vmnic3
Physical Switch
A vSphere standard switch is vary similar a physical Ethernet switch. The default number of logical ports for a standard switch is 120. Virtual machine network adapters and physical NICs on the host use the logical ports on the switch as each adapter uses one port. Each logical port on the standard switch is a member of a single port group. For information about maximum allowed ports and port groups, see the Configuration Maximums documentation.
Standard Port Groups

Each port group on a standard switch is identified by a network label, which must be unique to the current host. You can use network labels to make the networking configuration of virtual machines portable across hosts. You should give the same label to the port groups in a datacenter that use physical NICs connected to one broadcast domain on the physical network. Conversely, if two port groups are connected to physical NICs on different broadcast domains, the port groups should have distinct labels. For example, you can create Production and Test environment port groups as virtual machine networks on the hosts that share the same broadcast domain on the physical network. A VLAN ID, which restricts port group traffic to a logical Ethernet segment within the physical network, is optional. For port groups to receive the traffic that the same host sees, but from more than one VLAN , the VLAN ID must be set to VGT (VLAN 4095).
Port Group Configuration for Virtual Machines

You can add or modify a virtual machine port group to set up traffic management on a set of virtual machines. The Add Networking wizard in the vSphere Web Client guides you through the process to create a virtual network to which virtual machines can connect, including creating a vSphere standard switch and configuring settings for a network label.
18
VMware, Inc.
Chapter 3 Setting Up Networking with vSphere Standard Switches
When you set up virtual machine networks, consider whether you want to migrate the virtual machines in the network between hosts. If so, be sure that both hosts are in the same broadcast domainthat is, the same Layer 2 subnet. ESXi does not support virtual machine migration between hosts in different broadcast domains because the migrated virtual machine might require systems and resources that it would no longer have access to in the new network. Even if your network configuration is set up as a high-availability environment or includes intelligent switches that can resolve the virtual machines needs across different networks, you might experience lag times as the Address Resolution Protocol (ARP) table updates and resumes network traffic for the virtual machines. Virtual machines reach physical networks through uplink adapters. A vSphere standard switch can transfer data to external networks only when one or more network adapters are attached to it. When two or more adapters are attached to a single standard switch, they are transparently teamed.
Add a Virtual Machine Port Group with the vSphere Web Client
Create port groups in a vSphere standard switch to provide connectivity and common network configuration for a set of virtual machines. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the host. Right-click the host in the navigator and select All vCenter Actions > Add Networking. In Select connection type, select Virtual Machine Port Group for a Standard Switch and click Next. In Select target device, select an existing standard switch or create a new standard switch. If the new port group is for an existing standard switch, navigate to the switch. a b c 6 Click Browse. Select a standard switch from the list and click OK. Click Next and go to Step 7.
(Optional) In the Create a Standard Switch page, assign physical network adapters to the standard switch. You can create a standard switch with or without adapters. If you create a standard switch without physical network adapters, all traffic on that switch is confined to that switch. No other hosts on the physical network or virtual machines on other standard switches can send or receive traffic over this standard switch. You might create a standard switch without physical network adapters if you want a group of virtual machines to be able to communicate with each other, but not with other hosts or with virtual machines outside the group. a b c d e Click Add adapters. Select an adapter from the Network Adapters list. Use the Failover order group drop-down menu to assign the adapter to Active adapters, Standby adapters, or Unused adapters, and click OK. (Optional) Use the up and down arrows in the Assigned adapters list to change the position of the adapter if needed. Click Next.
VMware, Inc.
19
vSphere Networking
In the Connection settings page, identify traffic through the ports of the group. a b Type a Network Label for the port group, or accept the generated label. Set the VLAN ID to configure VLAN handling in the port group. The VLAN ID also reflects the VLAN tagging mode in the port group.
VLAN Tagging Mode External Switch Tagging (EST) Virtual Switch Tagging (VST) Virtual Guest Tagging (VGT) VLAN ID 0 From 1 to 4094 4095 Description The virtual switch does not pass traffic associated with a VLAN. The virtual switch tags traffic with the entered tag. Virtual machines handle VLANs. The virtual switch passes traffic from any VLAN.
c 8
Click Next.
Review the port group settings in the Ready to complete page, and click Finish. Click Back if you want to change any settings.
Edit a Standard Switch Port Group in the vSphere Web Client

By using the vSphere Web Client edit the name and VLAN ID of a standard switch port group, and override networking policies at the port group level. Procedure 1 2 3 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a standard switch from the list. The topology diagram of the switch appears. 4 5 6 7 In the topology diagram of the switch, click the name of the port group. Click Edit under the topology diagram title. In the Properties section, rename the port group in the Network Label text field. Configure VLAN tagging in the VLAN ID drop-down menu.
VLAN Tagging Mode External Switch Tagging (EST) Virtual Switch Tagging (VST) Virtual Guest Tagging (VGT) VLAN ID 0 From 1 to 4094 4095 Description The virtual switch does not pass traffic associated with a VLAN. The virtual switch tags traffic with the entered tag. Virtual machines handle VLANs. The virtual switch passes traffic from any VLAN.
8 9 10
In the Security section, override the switch settings for protection against MAC address impersonation and for running virtual machines in promiscuous mode. In the Traffic Shaping section, override at the port group level the size of average and peak bandwidth and of bursts. In the Teaming and Failover section, override the teaming and failover settings inherited from the standard switch. You can configure traffic distribution and rerouting between the physical adapters associated with the port group. You can also change the order in which host physical adapters are used upon failure.
11
Click OK.
20
VMware, Inc.
Remove a Port Group from a vSphere Standard Switch in the vSphere Web Client
You can remove port groups from vSphere standard switches in case you no longer need the associated labeled networks. Prerequisites Verify that there are no powered-on virtual machines connected to the port group that you want to remove. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select the standard switch. From the topology diagram of the switch, select the port group that you want to remove by clicking its label. From the toolbar in the switch topology, click the Remove selected port group action icon .
vSphere Standard Switch Properties

vSphere standard switch settings control switch-wide defaults for ports, which can be overridden by port group settings for each standard switch. You can edit standard switch properties, such as the uplink configuration and the number of available ports.
Change the Number of Ports for a vSphere Standard Switch in the vSphere Web Client
For hosts running ESXi 5.1 and earlier, you can configure the number of ports that are available on a standard switch as the requirements of your environment change. Each virtual switch on hosts running ESXi 5.1 and earlier provides a finite number of ports through which virtual machines and network services can reach one or more networks. You have to increase or decrease the number of ports manually according to your deployment requirements. NOTE Increasing the port number of a switch leads to reserving and consuming more resources on the host. If some ports are not occupied, host resources that might be necessary for other operations remain locked and unused. To ensure efficient use of host resources on hosts running ESXi 5.5, the ports of virtual switches are dynamically scaled up and down. A switch on such a host can expand up to the maximum number of ports supported on the host. The port limit is determined based on the maximum number of virtual machines that the host can handle. Procedure 1 2 3 4 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a standard switch from the table and click Edit settings. In the Properties section, set the Number of ports for the standard switch by using the drop-down menu.
VMware, Inc.
21
vSphere Networking
(Optional) Change the MTU (bytes) value for the standard switch. You can enable jumbo frames by setting MTU (bytes) to a number greater than 1500. You cannot set an MTU size greater than 9000 bytes.
Click OK.
Change the Speed of a Physical Adapter in the vSphere Web Client

A physical adapter can become a bottleneck for network traffic if the adapter speed does not match application requirements. You can change the connection speed and duplex of a physical adapter to transfer data in compliance with traffic rate. Procedure 1 2 Browse to a host in the vSphere Web Client navigator. Click the Manage tab, and select Physical adapters from Networking. The physical network adapters of the host appear in a table that contains details for each physical network adapter. 3 4 5 6 Select the physical network adapter from the list and click Edit. Select speed and duplex mode of the physical network adapter from the drop-down menu. (Optional) If the physical adapter supports SR-IOV, enable it and configure the number of virtual functions to use for virtual machine networking. Click OK.
Add and Team Physical Adapters in a Standard Switch in the vSphere Web Client
Assign a physical adapter to a standard switch to provide connectivity to virtual machines and VMkernel adapters on the host. You can form a team of NICs to distribute traffic load and to configure failover. NIC teaming combines multiple network connections to increase throughput and provide redundancy should a link fail. To create a team, you associate multiple physical adapters to a single vSphere standard switch. Procedure 1 2 3 4 5 6 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select the standard switch you want to add a physical adapter to. Click Manage the physical network adapters. Click Add adapters. Select one or more physical network adapters from the list and select the Failover order group to assign the adapters to, and click OK. The selected adapters appear in the selected failover group list under the Assigned Adapters list. 7 8 (Optional) Use the up and down arrows to change the position of an adapter in the failover groups. Click OK to apply the physical adapter configuration.
22
VMware, Inc.
View the Topology Diagram of a vSphere Standard Switch in the vSphere Web Client
You can examine the structure and components of a vSphere standard switch by using its topology diagram. The topology diagram of a standard switch provides a visual representation of the adapters and port groups connected to the switch. From the diagram you can edit the settings of a selected port group and of a selected adapter. Procedure 1 2 3 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select the standard switch from the list.
The diagram appears under the list of virtual switches on the host.
VMware, Inc.
23
vSphere Networking
24
VMware, Inc.
Setting Up Networking with vSphere Distributed Switches
With vSphere distributed switches you can set up and configure networking in a vSphere environment. This chapter includes the following topics:
n n n n
vSphere Distributed Switch Architecture, on page 26 Create a vSphere Distributed Switch with the vSphere Web Client, on page 27 Upgrade a vSphere Distributed Switch to a Later Version with the vSphere Web Client, on page 28 Edit General and Advanced vSphere Distributed Switch Settings in the vSphere Web Client, on page 29 Managing Networking on Multiple Hosts on a vSphere Distributed Switch, on page 30 Managing Networking on Host Proxy Switches, on page 39 Distributed Port Groups, on page 42 Working with Distributed Ports, on page 49 Configuring Virtual Machine Networking on a vSphere Distributed Switch, on page 50 Topology Diagrams of a vSphere Distributed Switch in the vSphere Web Client, on page 51 vSphere Distributed Switch Health Check, on page 53 Export, Import, and Restore Distributed Switch Configurations, on page 54 Private VLANs, on page 56 LACP Support on a vSphere Distributed Switch, on page 59
n n n n n n n n n n
VMware, Inc.
25
vSphere Networking
vSphere Distributed Switch Architecture

A vSphere Distributed Switch provides centralized management and monitoring of the networking configuration of all hosts that are associated with the switch. You set up a distributed switch on vCenter Server system, and its settings are propagated to all hosts that are associated with the switch. Figure 41. vSphere Distributed Switch Architecture
VM
VM
VM
VM
VM
vMotion
vNIC
Management
VMkernal adapter (vmknic)
Distributed port groups
Production
Test environment
vSphere Distributed Switch
vMotion
Management
Uplink port group vCenter Server

Uplink0 Uplink1 Uplink2
ESXi host 1 Production
ESXi host 2
Test environment
vMotion
Management
Production
Test environment
vMotion
Management
Uplink port group
Uplink port group
uplink port 0
uplink port 1
uplink port 2
uplink port 0
uplink port 1
uplink port 2
Physical NICs
vmnic0
vmnic1
vmnic3
vmnic0
vmnic1
vmnic3
Physical Switch
You associate a vSphere Distributed Switch with a datacenter on a vCenter Server system. The networking configuration and management for all hosts that are associated with the switch is centralized on the vCenter Server system. Every associated host has a host proxy switch that contains the networking settings for the host that are configured on distributed switch. For example, suppose you associate ESXi A and ESXi B hosts to a distributed switch and connect physical NIC vmnic1 of both hosts to uplink 1 on the switch. As a result, vmnic1 of hosts ESXi A and ESXi B is connected to uplink 1 on the distributed switch. On the host proxy switches of both hosts, physical NIC vmnic1 is connected to uplink port 1.
26
VMware, Inc.
Chapter 4 Setting Up Networking with vSphere Distributed Switches
A distributed switch has one or more distributed port groups. You use distributed port groups to provide networking connectivity to virtual machines and to accommodate VMkernel traffic. You identify each distributed port group by using a network label, which must be unique to the current datacenter. A copy of every distributed port group that you create is also available on the host proxy switches of all hosts that are associated with the distributed switch. The policies that you configure to a distributed port group are consistent for all hosts in the distributed switch. A VLAN ID, which restricts port group traffic to a logical Ethernet segment within the physical network, is optional. In addition to vSphere Distributed Switches, vSphere 5 also provides support for third-party virtual switches. For information about configuring the Cisco Nexus 1000v switch, see the Cisco Systems Web site.
Create a vSphere Distributed Switch with the vSphere Web Client

Create a vSphere distributed switch on a datacenter to handle the networking configuration of multiple hosts at a time from a central place. Procedure 1 2 3 4 In the vSphere Web Client, navigate to a datacenter. In the navigator, right-click the datacenter and select New Distributed Switch. In Name and Location, type a name for the new distributed switch, or accept the generated name, and click Next. In Select version, select a distributed switch version and click Next.
Option Distributed Switch: 5.5.0 Distributed Switch: 5.1.0 Distributed Switch: 5.0.0 Description Compatible with ESXi 5.5 and later. Compatible with VMware ESXi 5.1 and later. Features released with later vSphere distributed switch versions are not supported. Compatible with VMware ESXi 5.0 and later. Features released with later vSphere distributed switch versions are not supported. Compatible with ESX/ESXi version 4.1 and later. Features released with later vSphere distributed switch versions are not supported. Compatible with ESX/ESXi version 4.0 and later. Features released with later vSphere distributed switch versions are not supported.
Distributed Switch: 4.1.0
Distributed Switch: 4.0.0
In Edit Settings configure the distributed switch settings. a Use the arrow buttons to select the Number of uplinks. Uplink ports connect the distributed switch to physical NICs on associated hosts. The number of uplink ports is the maximum number of allowed physical connections to the distributed switch per host. b Use the drop-down menu to enable or disable Network I/O Control. By using Network I/O Control you can prioritize the access to network resources for certain types of infrastructure and workload traffic according to the requirements of your deployment. Network I/ Control continuously monitors the I/O load over the network and dynamically allocates available resources. c Select the Create a default port group check box to create a new distributed port group with default settings for this switch.
VMware, Inc.
27
vSphere Networking
(Optional) To create a default distributed port group, type the port group name in the Port group name, or accept the generated name. If your system has custom port group requirements, create distributed port groups that meet those requirements after you add the distributed switch.
e 6
Click Next.
In Ready to complete, review the settings you selected and click Finish. Use the Back button to edit any settings.
A distributed switch is created on the datacenter. You can view the features supported on the distributed switch as well as other details by navigating to the new distributed switch and clicking the Summary tab. What to do next Add hosts to the distributed switch and configure their network adapters on the switch.
Upgrade a vSphere Distributed Switch to a Later Version with the vSphere Web Client
You can upgrade vSphere Distributed Switch version 4.0, 4.1, 5.0, or 5.1 to a later version. The upgrade lets the distributed switch take advantage of features that are available only in the later version. The upgrade of a distributed switch is a non-disruptive operation, that is, the hosts and virtual machines attached to the switch do not experience any downtime. NOTE To be able to restore the connectivity of the virtual machines and VMkernel adapters if the upgrade fails, back up the configuration of the distributed switch. You can export the switch configuration before you upgrade vCenter Server if you upgrade from vCenter Server 5.1. If you upgrade vCenter Server from a version earlier than 5.1, back up the switch configuration after you upgrade vCenter Server to version 5.5. If the upgrade is not successful, to recreate the switch with its port groups and connected hosts, you can import the switch configuration file with the Preserve original distributed switch and port group identifiers option selected in the Import Distributed Switch wizard. See Export vSphere Distributed Switch Configurations with the vSphere Web Client, on page 54 and Import a vSphere Distributed Switch Configuration by Using the vSphere Web Client, on page 55. Prerequisites
n n
Upgrade vCenter Server to the version 5.5. Upgrade all hosts connected to the distributed switch to ESXi 5.5.
Procedure 1 2 3 In the vSphere Web Client, navigate to the distributed switch. Right-click the distributed switch and select Upgrade Distributed Switch. Select the vSphere Distributed Switch version that you want to upgrade the switch to and click Next.
Option Version 5.5.0 Version 5.1.0 Description Compatible with ESXi version 5.5 and later. Compatible with ESXi version 5.1 and later. Features released with later vSphere Distributed Switch versions are not supported.
28
VMware, Inc.
Option Version 5.0.0 Version 4.1.0
Description Compatible with ESXi version 5.0 and later. Features released with later vSphere Distributed Switch versions are not supported. Compatible with ESX/ESXi version 4.1 and later. Features released with later vSphere Distributed Switch versions are not supported.
Review host compatibility and click Next. Some VMware ESX instances that are running on the distributed switch might be incompatible with the selected upgrade version. Upgrade or remove incompatible hosts, or select another upgrade version for the distributed switch.
Review your settings and click Finish.
After you upgrade the vSphere Distributed Switch, you cannot revert it to an earlier version. You cannot add VMware ESX hosts that are running an earlier incompatible version with the new switch version.
Edit General and Advanced vSphere Distributed Switch Settings in the vSphere Web Client
General settings for a vSphere Distributed Switch include the switch name and number of uplinks. Advanced settings for a distributed switch include Cisco Discovery Protocol and the maximum MTU for the switch. Procedure 1 2 3 4 In the vSphere Web Client, navigate to the distributed switch. Click Manage tab, click Settings, and select Properties. Click Edit. Click General to edit the vSphere Distributed Switch settings.
Option Name Number of uplinks Number of ports Network I/O Control Description Description Type the name for the distributed switch. Select the number of uplink ports for the distributed switch. Click Edit Uplink Names to change the names of the uplinks. The number of ports for this distributed switch. This cannot be edited. Use the drop-down menu to enable or disable Network I/O control. Add or modify a description of the distributed switch settings.
Click Advanced to edit the vSphere Distributed Switch settings.

Option MTU (Bytes) Discovery Protocol Description Maximum MTU size for the vSphere Distributed Switch. To enable jumbo frames, set a value greater than 1500 bytes. Select Cisco Discovery Protocol, Link Layer Discovery Protocol, or disabled from the Type drop-down menu. b Set Operation to Listen, Advertise, or Both. For information about Discovery Protocol, see Switch Discovery Protocol, on page 161. Type the name and other details of the administrator for the distributed switch. a
Administrator Contact
Click OK.
VMware, Inc.
29
vSphere Networking
Managing Networking on Multiple Hosts on a vSphere Distributed Switch

You create and manage virtual networks on a vSphere Distributed Switch by adding hosts to the switch and connecting their network adapters to the switch. To create uniform networking configuration throughout multiple hosts on the distributed switch, you can use a host as a template and apply its configuration to other hosts.
n
Tasks for Managing Host Networking on a vSphere Distributed Switch on page 31 You can add new hosts to a vSphere Distributed Switch, connect network adapters to the switch, and remove hosts from the switch. In a production environment, you might need to keep the network connectivity up for virtual machines and VMkernel services while you manage host networking on the distributed switch.
Add Hosts to a vSphere Distributed Switch in the vSphere Web Client on page 32 To manage the networking of your vSphere environment by using a vSphere Distributed Switch, you must associate hosts with the switch. You connect the physical NICs, VMkernel adapters, and virtual machine network adapters of the hosts to the distributed switch.
Configure Physical Network Adapters on a vSphere Distributed Switch in the vSphere Web Client on page 33 For hosts that are associated with a distributed switch, you can assign physical NICs to uplinks on the switch. You can configure physical NICs on the distributed switch for multiple hosts at a time.
Migrate VMkernel Adapters to a vSphere Distributed Switch in the vSphere Web Client on page 34 Migrate VMkernel adapters to a distributed switch if you want to handle the traffic for VMkernel services by using only this switch and you no longer need the adapters on other standard or distributed switches.
Create a VMkernel Adapter on a vSphere Distributed Switch in the vSphere Web Client on page 35 Create a VMkernel adapter on hosts associated with a distributed switch to provide network connectivity to the hosts and to handle the traffic for vSphere vMotion, IP storage, Fault Tolerance logging, and Virtual SAN. You can create VMkernel adapters on multiple hosts simultaneously by using the Add and Manage Hosts wizard.
Migrate Virtual Machine Networking to the vSphere Distributed Switch in the vSphere Web Client on page 36 To manage virtual machine networking by using a distributed switch, migrate virtual machine network adapters to labeled networks on the switch.
Update the Maximum Number of Distributed Ports on Hosts in the vSphere Web Client on page 37 If a host is running ESXi 5.1 or earlier, you can change the maximum number of distributed ports on the proxy switch on the host.
Use a Host as a Template to Create a Uniform Networking Configuration on a vSphere Distributed Switch in the vSphere Web Client on page 37 If you plan to have hosts with a uniform networking configuration, you can select a host as a template and apply its configuration for physical NICs and VMkernel adapters to other hosts on the distributed switch.
Remove Hosts from a vSphere Distributed Switch in the vSphere Web Client on page 38 Remove hosts from a vSphere distributed switch if you have configured a different switch for the hosts.
30
VMware, Inc.
Tasks for Managing Host Networking on a vSphere Distributed Switch

You can add new hosts to a vSphere Distributed Switch, connect network adapters to the switch, and remove hosts from the switch. In a production environment, you might need to keep the network connectivity up for virtual machines and VMkernel services while you manage host networking on the distributed switch.
Adding Hosts to a vSphere Distributed Switch

Consider preparing your environment before you add new hosts to a distributed switch.
n n
Create distributed port groups for virtual machine networking. Create distributed port groups for VMkernel services. For example, create distributed port groups for management network, vMotion, and Fault Tolerance. Configure enough uplinks on the distributed switch for all physical NICs that you want to connect to the switch. For example, if the hosts that you want to connect to the distributed switch have eight physical NICs each, configure eight uplinks on the distributed switch. Make sure that the configuration of the distributed switch is prepared for services with specific networking requirements. For example, iSCSI has specific requirements for the teaming and failover configuration of the distributed port group where you connect the iSCSI VMkernel adapter.
You can use the Add and Manage Hosts wizard in the vSphere Web Client to add multiple hosts at a time.
Managing Network Adapters on a vSphere Distributed Switch

After you add hosts to a distributed switch, you can connect physical NICs to uplinks on the switch, configure virtual machine network adapters, and manage VMkernel networking. If some hosts on a distributed switch are associated to other switches in your datacenter, you can migrate network adapters to or from the distributed switch. If you migrate virtual machine network adapters or VMkernel adapters, make sure that the destination distributed port groups have at least one active uplink, and the uplink is connected to a physical NIC on the hosts. Another approach is to migrate physical NICs, virtual network adapters, and VMkernel adapters simultaneously. If you migrate physical NICs, leave at least one active NIC that handles the traffic of port groups. For example, if vmnic0 and vmnic1 handle the traffic of the VM Network port group, migrate vmnic0 and leave vmnic1 connected to the group.
Removing Hosts from a vSphere Distributed Switch

Before you remove hosts from a distributed switch, you must migrate the network adapters that are in use to a different switch.
n
To add hosts to a different distributed switch, you can use the Add and Manage Hosts wizard to migrate the network adapters on the hosts to the new switch all together. You can then remove the hosts safely from their current distributed switch. To migrate host networking to standard switches, you must migrate the network adapters on stages. For example, remove physical NICs on the hosts from the distributed switch by leaving one physical NIC on every host connected to the switch to keep the network connectivity up. Next, attach the physical NICs to the standard switches and migrate VMkernel adapters and virtual machine network adapters to the switches. Lastly, migrate the physical NIC that you left connected to the distributed switch to the standard switches.
VMware, Inc.
31
vSphere Networking
Add Hosts to a vSphere Distributed Switch in the vSphere Web Client

To manage the networking of your vSphere environment by using a vSphere Distributed Switch, you must associate hosts with the switch. You connect the physical NICs, VMkernel adapters, and virtual machine network adapters of the hosts to the distributed switch. Prerequisites
n
Verify that enough uplinks are available on the distributed switch to assign to the physical NICs that you want to connect to the switch. Verify that there is at least one distributed port group on the distributed switch. Verify that the distributed port group have active uplinks configured in its teaming and failover policy.
n n
If you migrate or create VMkernel adapters for iSCSI, verify that the teaming and failover policy of the target distributed port group meets the requirements for iSCSI:
n n
Verify that only one uplink is active, the standby list is empty, and the rest of the uplinks are unused. Verify that only one physical NIC per host is assigned to the active uplink.
Procedure 1 2 3 4 5 6 In the vSphere Web Client, navigate to the distributed switch. From the Actions menu, select Add and Manage Hosts. Select Add hosts and click Next. Click New hosts, select from the hosts in your datacenter, and click OK. Select the tasks for configuring network adapters to the distributed switch and click Next. Configure physical NICs on the distributed switch. a From the On other switches/unclaimed list, select a physical NIC. If you select physical NICs that are already connected to other switches, they are migrated to the current distributed switch. b c Click Assign uplink. Select an uplink and click OK.
For consistent network configuration, you can connect one and the same physical NIC on every host to the same uplink on the distributed switch. For example, if you are adding two hosts connect vmnic1 on of each host to Uplink1 on the distributed switch. 7 8 Click Next. Configure VMkernel adapters. a b Select a VMkernel adapter and click Assign port group. Select a distributed port group and click OK.
32
VMware, Inc.
Review the impacted services as well as the level of impact.

Option No impact Important impact Critical impact Description The service will continue its normal function after the new networking configuration is applied. The normal function of the service might be disrupted if the new networking configuration is applied. The normal function of the service will be interrupted if the new networking configuration is applied.
a b 10 11
If impact on a service is important or critical, click the service and review the reasons that are displayed in the Analysis details pane. After you troubleshoot the impact on all dependent services, proceed with your networking configuration.
Click Next. Configure virtual machine networking. a b c To connect all network adapters of a virtual machine to a distributed port group, select the virtual machine, or select an individual network adapter to connect only that adapter. Click Assign port group. Select a distributed port group from the list and click OK.
12
Click Next and click Finish.
What to do next Having hosts associated with the distributed switch, you can manage physical NICs, VMkernel adapters, and virtual machine network adapters.
Configure Physical Network Adapters on a vSphere Distributed Switch in the vSphere Web Client
For hosts that are associated with a distributed switch, you can assign physical NICs to uplinks on the switch. You can configure physical NICs on the distributed switch for multiple hosts at a time. For consistent networking configuration throughout all hosts, you can assign the same physical NIC on every host to the same uplink on the distributed switch. For example, you can assign vmnic1 from hosts ESXi A and ESXi B to Uplink 1. Procedure 1 2 3 4 5 6 7 In the vSphere Web Client, navigate to the distributed switch. From the Actions menu, select Add and Manage Hosts. Select Manage host networking and click Next. Click Attached hosts and select from the hosts that are associated with the distributed switch. Click Next. Select Manage physical adapters and click Next. From the On other switches/unclaimed list select a physical NIC . If you select physical NICs that are already assigned to other switches, they are migrated to the current distributed switch. 8 Click Assign uplink.
VMware, Inc.
33
vSphere Networking
9 10 11
Select an uplink or select Auto-assign. Click Next. Review the impacted services as well as the level of impact.
a b 12
Migrate VMkernel Adapters to a vSphere Distributed Switch in the vSphere Web Client
Migrate VMkernel adapters to a distributed switch if you want to handle the traffic for VMkernel services by using only this switch and you no longer need the adapters on other standard or distributed switches. Procedure 1 2 3 4 5 6 7 8 9 10 In the vSphere Web Client, navigate to the distributed switch. From the Actions menu, select Add and Manage Hosts. Select Manage host networking and click Next. Click Attached hosts and select from the hosts that are associated with the distributed switch. Click Next. Select Manage VMkernel adapters and click Next. Select the adapter and click Assign port group. Select a distributed port group and click OK. Click Next. Review the impacted services as well as the level of impact.
a b
34
VMware, Inc.
11
Create a VMkernel Adapter on a vSphere Distributed Switch in the vSphere Web Client
Create a VMkernel adapter on hosts associated with a distributed switch to provide network connectivity to the hosts and to handle the traffic for vSphere vMotion, IP storage, Fault Tolerance logging, and Virtual SAN. You can create VMkernel adapters on multiple hosts simultaneously by using the Add and Manage Hosts wizard. You should dedicate one distributed port group for each VMkernel adapter. One VMkernel adapter should handle only one traffic type. Procedure 1 2 3 4 5 6 7 In the vSphere Web Client, navigate to the distributed switch. From the Actions menu, select Add and Manage Hosts. Select Manage host networking and click Next. Click Attached hosts and select from the hosts that are associated with the distributed switch. Click Next. Select Manage VMkernel adapters and click Next. Click New adapter. The Add Networking wizard opens. 8 9 On the Select target device page of the Add Networking wizard, select a distributed port group. On the Port properties page, configure the settings for the VMkernel adapter.
Option Network label IP settings Description The network label is inherited from the label of the distributed port group. Select IPv4, IPv6, or both. NOTE The IPv6 option does not appear on hosts that do not have IPv6 enabled. If custom stacks are available, select one from the list. You can enable services for the default TCP/IP stack on the host. Select from the available services: n vMotion traffic. Enables the VMkernel adapter to advertise itself to another host as the network connection where vMotion traffic is sent. You can enable this property for only one vMotion and IP storage VMkernel adapter per host. If this property is not enabled for any VMkernel adapter, migration with vMotion to the selected host is not possible. n Fault Tolerance traffic. Enables Fault Tolerance logging on the host. n Management traffic. Enables the management traffic for the host and vCenter Server. Typically, hosts have such a VMkernel adapter created when the ESXi software is installed. You can create another VMkernel adapter for management traffic on the host to provide redundancy. n Virtual SAN. Enables the Virtual SAN traffic on the host. Every host that is part of a Virtual SAN cluster must have such a VMkernel adapter.
TCP/IP stack Enable services
VMware, Inc.
35
vSphere Networking
10
(Optional) On the IPv4 settings page, select an option for obtaining IP addresses.
Option Obtain IP settings automatically Use static IP settings Description Use DHCP to obtain IP settings. Type the IPv4 IP address and subnet mask for the VMkernel adapter. The VMkernel Default Gateway and DNS server addresses for IPv4 are obtained from the selected TCP/IP stack.
11
(Optional) On the IPv6 settings page, select an option for obtaining IPv6 addresses.
Option Obtain IPv6 addresses automatically through DHCP Obtain IPv6 addresses automatically through Router Advertisement Static IPv6 addresses Description Use DHCP to obtain IPv6 addresses. Use router advertisement to obtain IPv6 addresses.
a b c
Click Add to add a new IPv6 address. Type the IPv6 address and subnet prefix length, and click OK. To change the VMkernel default gateway, click Edit.
12 13
Review your setting selections in the Ready to complete page and click Finish. Follow the prompts to complete the wizard.
Migrate Virtual Machine Networking to the vSphere Distributed Switch in the vSphere Web Client
To manage virtual machine networking by using a distributed switch, migrate virtual machine network adapters to labeled networks on the switch. Prerequisites Verify that at least one distributed port group intended for virtual machine networking exists on the distributed switch. Procedure 1 2 3 4 5 6 7 In the vSphere Web Client, navigate to the distributed switch. From the Actions menu, select Add and Manage Hosts. Select Manage host networking and click Next. Click Attached hosts and select from the hosts that are associated with the distributed switch. Click Next. Select Migrate virtual machine networking and click Next. Configure virtual machine network adapters to the distributed switch. a b c 8 To connect all network adapters of a virtual machine to a distributed port group, select the virtual machine, or select an individual network adapter to connect only that adapter. Click Assign port group. Select a distributed port group from the list and click OK.
36
VMware, Inc.
Update the Maximum Number of Distributed Ports on Hosts in the vSphere Web Client
If a host is running ESXi 5.1 or earlier, you can change the maximum number of distributed ports on the proxy switch on the host. Each proxy switch on ESXi hosts 5.1 and earlier provides a finite number of ports through which virtual machines and network services can reach one or more networks. You have to increase or decrease manually the number of ports according to your deployment requirements. NOTE Increasing the number distributed ports of the proxy switches on hosts reserves and consumes more resources on the hosts. If some ports are not occupied, host resources that might be necessary for other operations remain locked and unused. To ensure efficient use of host resources, on ESXi 5.5 hosts the number of distributed ports of proxy switches are dynamically scaled up and down. A proxy switch on such a host can expand up to the maximum number of ports supported on the host. The port limit is determined based on the maximum number of virtual machines that the host can handle. Procedure 1 2 3 4 5 6 7 8 In the vSphere Web Client, navigate to the distributed switch. From the Actions menu, select Add and Manage Hosts. Select Manage host networking and click Next. Click Attached hosts and select from the hosts that are associated with the distributed switch. Click Next. Select a host and click Edit settings. Change the maximum number of distributed ports on the host and click OK. Click Next and click Finish.
Use a Host as a Template to Create a Uniform Networking Configuration on a vSphere Distributed Switch in the vSphere Web Client
If you plan to have hosts with a uniform networking configuration, you can select a host as a template and apply its configuration for physical NICs and VMkernel adapters to other hosts on the distributed switch. Procedure 1 2 3 4 5 6 7 8 9 In the vSphere Web Client, navigate to the distributed switch. From the Actions menu, select Add and Manage Hosts. Select a task for managing host networking and click Next. Select the hosts to add or manage on the distributed switch. At the bottom of the dialog box, select Configure identical networking settings on multiple hosts and click Next. Select a host to use as a template and click Next. Select the network adapter tasks and click Next. On the Manage physical network adapters and Manage VMkernel network adapters pages, make the configuration changes that you need on the template host, and click Apply to all for all other hosts. On the Ready to complete page, click Finish.
VMware, Inc.
37
vSphere Networking
Example: Configure Physical NICs by Using a Template Host

Connect physical NICs on two hosts simultaneously to a vSphere distributed switch by using the template host mode in the Add and Manage Hosts wizard. On the Manage physical network adapters page of the wizard, assign two physical NICs to uplinks on the template host, and then click Apply to all to create the same configuration on the other host. Figure 42. Applying Physical NICs Configuration on a vSphere Distributed Switch by Using a Template Host
Remove Hosts from a vSphere Distributed Switch in the vSphere Web Client
Remove hosts from a vSphere distributed switch if you have configured a different switch for the hosts. Prerequisites
n n n
Verify that physical NICs on the target hosts are migrated to a different switch. Verify that VMkernel adapters on the hosts are migrated to a different switch. Verify that virtual machine network adapters are migrated to a different switch.
For details about migrating network adapters to different switches, see Tasks for Managing Host Networking on a vSphere Distributed Switch, on page 31 Procedure 1 2 In the vSphere Web Client, navigate to the distributed switch. From the Actions menu, select Add and Manage Hosts.
38
VMware, Inc.
3 4 5
Select Remove hosts and click Next. Select the hosts you want to remove and click Next. Click Finish.
Managing Networking on Host Proxy Switches

You can change the configuration of the proxy switch on every host that is associated with a vSphere distributed switch. You can manage physical NICs, VMkernel adapters, and virtual machine network adapters. For details about setting up VMkernel networking on host proxy switches, see Create a VMkernel Adapter on a vSphere Distributed Switch in the vSphere Web Client, on page 35.
Migrate Network Adapters on a Host to a vSphere Distributed Switch in the vSphere Web Client
For hosts associated with a distributed switch, you can migrate network adapters from a standard switch to the distributed switch. You can migrate physical NICs, VMkernel adapters, and virtual machine network adapters at the same time. If you want to migrate virtual machine network adapters or VMkernel adapters, make sure that the destination distributed port groups have at least one active uplink, and the uplink is connected to a physical NIC on this host. Alternatively, migrate physical NICs, virtual network adapters, and VMkernel adapters at once. If you want to migrate physical NICs, make sure that the source port groups on the standard switch have at least one physical NIC to handle their traffic. For example, if you migrate a physical NIC that is assigned to a port group for virtual machine networking, make sure that the port group is connected to at least one physical NIC. Otherwise the virtual machines on same VLAN on the standard switch will have connectivity between each other but not to the external network. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select the destination distributed switch and click Migrate physical or virtual network adapters. Select the tasks for migrating network adapters and click Next. Configure physical NICs. a b c 6 From the On other switches/unclaimed list, select a physical NIC and click Assign uplink. Select an uplink and click OK. Click Next.
Configure VMkernel adapters. a b Select an adapter and click Assign port group. Select a distributed port group and click OK. You should connect one VMkernel adapter to one distributed port group at a time. c Click Next.
VMware, Inc.
39
vSphere Networking
Review the services that are affected from the new networking configuration. a If there is an important or serious impact reported on a service, click the service and review the analysis details. For example, an important impact on iSCSI might be reported as a result from an incorrect teaming and failover configuration on the distributed port group where you migrate the iSCSI VMkernel adapter. You must leave one active uplink on the teaming and failover order of the distributed port group, leave the standby list empty, and move the rest of the uplinks to unused. b After troubleshooting any impact on the affected services, click Next.
Configure virtual machine network adapters. a Select a virtual machine or a virtual machine network adapter and click Assign port group. If you select a virtual machine, you migrate all network adapters on the virtual machine. If you select a network adapter, you migrate only this network adapter. b c Select a distributed port group from the list anc click OK. Click Next.
On the Ready to complete page review the new networking configuration and click Finish.
Migrate a VMkernel Adapter on a Host to a vSphere Standard Switch in the vSphere Web Client
If a host is associated with a distributed switch, you can migrate VMkernel adapters from the distributed to a standard switch. For details about creating VMkernel adapters on a vSphere distributed switch, see Create a VMkernel Adapter on a vSphere Distributed Switch in the vSphere Web Client, on page 35. Procedure 1 2 3 4 5 6 7 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select the destination standard switch from the list. Click Migrate a VMkernel adapter. On the Select VMkernel network adapter page, select the virtual network adapter to migrate to the standard switch from the list. On the Configure settings page, edit the Network Label and VLAN ID for the network adapter. Review the migration details on the Ready to complete page and click Finish. Click Back to edit settings.
Assign a Physical NIC of a Host to a vSphere Distributed Switch in the vSphere Web Client
You can assign physical NICs of a host that is associated with a distributed switch to uplink port on the host proxy switch. Procedure 1 2 3 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a distributed switch from the list.
40
VMware, Inc.
4 5 6
Click Manage the physical network adapters. Select a free uplink from the list and click Add adapter. Select a physical NIC and click OK.
Remove a Physical NIC from a vSphere Distributed Switch in the vSphere Web Client
You can remove a physical NIC of a host from an uplink on a vSphere distributed switch. Procedure 1 2 3 4 5 6 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select the distributed switch. Click Manage the physical network adapters. Select an uplink an click Remove selected adapters. Click OK.
What to do next When you remove physical NICs from active virtual machines, you might see the NICs you removed reported in the vSphere Web Client. See Removing NICs from Active Virtual Machines, on page 42.
Set the Number of Ports on a Host Proxy Switch in the vSphere Web Client
You can increase or decrease the maximum number of distributed ports available on the proxy switch on ESXi 5.1 hosts and earlier that are connected to a vSphere distributed switch. Each proxy switch on hosts that are running ESXi 5.1 and earlier provides a finite number of ports through which virtual machines and network services can reach one or more networks. You have to increase or decrease the number of ports manually according to your deployment requirements. NOTE Increasing the number distributed ports of the proxy switches on hosts reserves and consumes more resources on the hosts. If some ports are not occupied, host resources that might be necessary for other operations remain locked and unused. To ensure efficient use of host resources, the number of distributed ports of proxy switches are dynamically scaled up and down on ESXi 5.5 hosts. A proxy switch on such a host can expand up to the maximum number of ports supported on the host. The port limit is determined based on the maximum number of virtual machines that the host can handle. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a distributed switch from the list. Click Update the maximum number of distributed ports on this host. Use the up and down arrows to set the maximum number of ports for the host and click OK.
What to do next If you are changing the maximum number of ports for a host after the host is added to the distributed switch, you must restart the host before the new maximum takes effect.
VMware, Inc.
41
vSphere Networking
Removing NICs from Active Virtual Machines

When you remove NICs from active virtual machines, you might still see the NICs you have removed in the vSphere Web Client.
Removing NICs from an Active Virtual Machine Without a Guest Operating System Installed
You cannot remove NICs from an active virtual machine on which no operating system is installed. The vSphere Web Client might report that the NIC has been removed, but you continue to see it attached to the virtual machine.
Removing NICs from an Active Virtual Machine with a Guest Operating System Installed
You can remove a NIC from an active virtual machine, but it might not be reported to the vSphere Web Client for some time. If you click Edit Settings for the virtual machine, you might see the removed NIC listed even after the task is complete. The Edit Settings dialog box for the virtual machine does not immediately display the removed NIC. You might also still see the NIC attached to the virtual machine if the guest operating system of the virtual machine does not support hot removal of NICs.
Distributed Port Groups

A distributed port group specifies port configuration options for each member port on a vSphere distributed switch. Distributed port groups define how a connection is made to a network.
Add a Distributed Port Group in the vSphere Web Client

Add a distributed port group to a vSphere distributed switch to create a distributed switch network for your virtual machines and to associate VMkernel adapters. Procedure 1 2 3 Browse to a distributed switch in the vSphere Web Client. Right-click the distributed switch in the navigator and select New distributed port group. In the Select name and location section, type the name of the new distributed port group, or accept the generated name, and click Next.
42
VMware, Inc.
In the Configure settings section, set the general properties for the new distributed port group and click Next.
Setting Port binding Description Choose when ports are assigned to virtual machines connected to this distributed port group. n Static binding: Assign a port to a virtual machine when the virtual machine connects to the distributed port group. n Dynamic binding: Assign a port to a virtual machine the first time the virtual machine powers on after it is connected to the distributed port group. Dynamic binding has been deprecated since ESXi 5.0. n Ephemeral: No port binding. You can assign a virtual machine to a distributed port group with ephemeral port binding also when connected to the host.
n n
Port allocation
Elastic: The default number of ports is eight. When all ports are assigned, a new set of eight ports is created. This is the default. Fixed: The default number of ports is set to eight. No additional ports are created when all ports are assigned.
Number of ports Network resource pool
Enter the number of ports on the distributed port group. Use the drop-down menu to assign the new distributed port group to a user-defined network resource pool. If you have not created a network resource pool, this menu is empty. Use the Type drop-down menu to select VLAN options: n None: Do not use VLAN. n VLAN: In the VLAN ID field, enter a number between 1 and 4094. n VLAN Trunking: Enter a VLAN trunk range. n Private VLAN: Select a private VLAN entry. If you did not create any private VLANs, this menu is empty. Select this check box to customize the policy configurations for the new distributed port group.
VLAN
Advanced
(Optional) In the Security section, edit the security exceptions and click Next.
Setting Promiscuous mode Description
n
Reject. Placing an adapter in promiscuous mode from the guest operating system does not result in receiving frames for other virtual machines. Accept. If an adapter is placed in promiscuous mode from the guest operating system, the switch allows the guest adapter to receive all frames passed on the switch in compliance with the active VLAN policy for the port where the adapter is connected. Firewalls, port scanners, intrusion detection systems and so on, need to run in promiscuous mode.
MAC address changes
Reject. If you set this option to Reject and the guest operating system changes the MAC address of the adapter to a value different from the address in the .vmx configuration file, the switch drops all inbound frames to the virtual machine adapter. . If the guest operating system changes the MAC address back, the virtual machine receives frames again. Accept. If the guest operating system changes the MAC address of a network adapter, the adapter receives frames to its new address. Reject. The switch drops any outbound frame with a source MAC address that is different from the one in the .vmx configuration file. Accept. The switch does not perform filtering and permits all outbound frames.
Forged transmits
n n
VMware, Inc.
43
vSphere Networking
(Optional) In the Traffic shaping section, enable or disable Ingress or Egress traffic shaping and click Next.
Setting Status Description If you enable either Ingress Traffic Shaping or Egress Traffic Shaping, you are setting limits on the amount of networking bandwidth allocated for each virtual adapter associated with this particular port group. If you disable the policy, services have a free, clear connection to the physical network by default. Establishes the number of bits per second to allow across a port, averaged over time. This is the allowed average load. The maximum number of bits per second to allow across a port when it is sending and receiving a burst of traffic. This tops the bandwidth used by a port whenever it is using its burst bonus. The maximum number of bytes to allow in a burst. If this parameter is set, a port might gain a burst bonus when it does not use all its allocated bandwidth. Whenever the port needs more bandwidth than specified by Average Bandwidth, it might temporarily transmit data at a higher speed if a burst bonus is available. This parameter tops the number of bytes that might be accumulated in the burst bonus and thus transferred at a higher speed.
Average Bandwidth Peak Bandwidth
Burst Size
(Optional) In the Teaming and failover section, edit the settings and click Next.
Setting Load balancing Description Specify how to choose an uplink. n Route based on the originating virtual port. Choose an uplink based on the virtual port where the traffic entered the distributed switch. n Route based on IP hash. Choose an uplink based on a hash of the source and destination IP addresses of each packet. For non-IP packets, whatever is at those offsets is used to compute the hash. n Route based on source MAC hash. Choose an uplink based on a hash of the source Ethernet. n Route based on physical NIC load. Choose an uplink based on the current loads of physical NICs. n Use explicit failover order. Always use the highest order uplink from the list of Active adapters which passes failover detection criteria. NOTE IP-based teaming requires that the physical switch be configured with etherchannel. For all other options, disable etherchannel. Specify the method to use for failover detection. n Link Status only. Relies solely on the link status that the network adapter provides. This option detects failures, such as cable pulls and physical switch power failures, but not configuration errors, such as a physical switch port being blocked by spanning tree or that is misconfigured to the wrong VLAN or cable pulls on the other side of a physical switch. n Beacon Probing. Sends out and listens for beacon probes on all NICs in the team and uses this information, in addition to link status, to determine link failure. This detects many of the failures previously mentioned that are not detected by link status alone. NOTE Do not use beacon probing with IP-hash load balancing.
Network failover detection
44
VMware, Inc.
Setting Notify switches
Description Select Yes or No to notify switches in the case of failover. If you select Yes, whenever a virtual NIC is connected to the distributed switch or whenever that virtual NICs traffic would be routed over a different physical NIC in the team because of a failover event, a notification is sent out over the network to update the lookup tables on physical switches. In almost all cases, this process is desirable for the lowest latency of failover occurrences and migrations with vMotion. NOTE Do not use this option when the virtual machines using the port group are using Microsoft Network Load Balancing in unicast mode. No such issue exists with NLB running in multicast mode. Select Yes or No to disable or enable failback. This option determines how a physical adapter is returned to active duty after recovering from a failure. If failback is set to Yes (default), the adapter is returned to active duty immediately upon recovery, displacing the standby adapter that took over its slot, if any. If failback is set to No, a failed adapter is left inactive even after recovery until another currently active adapter fails, requiring its replacement. Specify how to distribute the work load for uplinks. To use some uplinks but reserve others for emergencies if the uplinks in use fail, set this condition by moving them into different groups: n Active Uplinks. Continue to use the uplink when the network adapter connectivity is up and active. n Standby Uplinks . Use this uplink if one of the active adapters connectivity is down. n Unused Uplinks . Do not use this uplink. NOTE When using IP-hash load balancing, do not configure standby uplinks.
Failback
Failover order
(Optional) In the Monitoring section, enable or disable NetFlow and click Next.
Setting Disabled Enabled Description NetFlow is disabled on the distributed port group. NetFlow is enabled on the distributed port group. NetFlow settings can be configured at the vSphere distributed switch level.
(Optional) In the Miscellaneous section, select Yes or No and click Next. Selecting Yes shuts down all ports in the port group. This action might disrupt the normal network operations of the hosts or virtual machines using the ports.
10 11
(Optional) In the Edit additional settings section, add a description of the port group and set any policy overrides per port and click Next. Review your settings in the Ready to complete section and click Finish. Click the Back button to change any settings.
Edit General Distributed Port Group Settings with the vSphere Web Client
You can edit general distributed port group settings such as the distributed port group name, port settings and network resource pool. Procedure 1 Locate a distributed port group in the vSphere Web Client. a b Select a distributed switch and click the Related Objects tab. Click Distributed Port Groups.
VMware, Inc.
45
vSphere Networking
2 3
Right-click the distributed port group and select Edit settings. Select General to edit the following distributed port group settings.
Option Name Port binding Description The name of distributed port group. You can edit the name in the text field. Choose when ports are assigned to virtual machines connected to this distributed port group. n Static binding: Assign a port to a virtual machine when the virtual machine connects to the distributed port group. n Dynamic binding: Assign a port to a virtual machine the first time the virtual machine powers on after it is connected to the distributed port group. Dynamic binding has been deprecated since ESXi 5.0. n Ephemeral: No port binding. You can also assign a virtual machine to a distributed port group with ephemeral port binding when connected to the host.
n n
Port allocation
Elastic: The default number of ports is set to eight. When all ports are assigned, a new set of eight ports is created. This is the default. Fixed: The default number of ports is set to eight. No additional ports are created when all ports are assigned.
Number of ports Network resource pool
Enter the number of ports on the distributed port group. Use the drop-down menu to assign the new distributed port group to a user-defined network resource pool. If you have not created a network resource pool, this menu is empty. Enter any information about the distributed port group in the description field.
Description
Click OK.
Edit Advanced Distributed Port Group Settings with the vSphere Web Client
You can edit advanced distributed port group settings, such as override settings and reset at disconnect. Procedure 1 Locate a distributed port group in the vSphere Web Client. a b 2 3 4 To locate a distributed port group, select a distributed switch and click the Related Objects tab. Click Distributed Port Groups and select a distributed port group from the list.
Click the Manage tab and click Settings. Click Edit. Select theAdvanced page to edit the distributed port group settings.
Option Configure reset at disconnect Description From the drop-down menu, enable or disable reset at disconnect. When a distributed port is disconnected from a virtual machine, the configuration of the distributed port is reset to the distributed port group setting. Any per-port overrides are discarded. Select the distributed port group policies to be overridden on a per-port level.
Override port policies
5 6
(Optional) Use the policy pages to set overrides for each port policy. Click OK.
46
VMware, Inc.
Remove a Distributed Port Group in the vSphere Web Client

Remove a distributed port group when you no longer need the corresponding labeled network to provide connectivity for virtual machines or VMkernel networking. Prerequisites
n
Verify that all virtual machines connected to the corresponding labeled network are migrated to a different labeled network. Verify that all VMkernel adapters connected to the distributed port group are migrated to a different port group, or are deleted.
Procedure 1 2 In the vSphere Web Client, navigate to the distributed port group. From the Actions menu, select All vCenter Actions > Remove from Inventory.
Export, Import, and Restore vSphere Distributed Port Group Configurations

You can export vSphere distributed port group configurations to a file. The configuration file allows you to preserve valid port group configurations, enabling distribution of these configurations to other deployments. You can export port group information at the same time you export distributed switch configurations. See Export, Import, and Restore Distributed Switch Configurations, on page 54.
Export vSphere Distributed Port Group Configurations with the vSphere Web Client
You can export vSphere distributed port group configurations to a file. The configuration preserves valid network configurations, enabling distribution of these configurations to other deployments. This functionality is available only with the vSphere Web Client 5.1 or later. However, you can export settings from any version of a distributed port if you use the vSphere Web Client 5.1 or later. Procedure 1 Locate a distributed port group in the vSphere Web Client. a b 2 3 4 To locate a distributed port group, select a distributed switch and click the Related Objects tab. Click Distributed Port Groups and select a distributed port group from the list.
Right-click the distributed port group in the navigator and select All vCenter Actions > Export Configuration. (Optional) Type notes about this configuration in the Descriptions field. Click OK. Click Yes to save the configuration file to your local system.
You now have a configuration file that contains all the settings for the selected distributed port group. You can use this file to create multiple copies of this configuration on an existing deployment, or overwrite settings of existing distributed port groups to conform to the selected settings. What to do next You can use the exported configuration file to do the following tasks:
n
To create a copy of the exported distributed port group, see Import a vSphere Distributed Port Group Configuration with the vSphere Web Client, on page 48.
VMware, Inc.
47
vSphere Networking
To overwrite settings on an existing distributed port group, see Restore a vSphere Distributed Port Group Configuration with the vSphere Web Client, on page 48.
Import a vSphere Distributed Port Group Configuration with the vSphere Web Client
Use import to create a distributed port group from a configuration file. Any existing distributed port groups are converted to conform to the settings in the configuration file. This functionality is available only with the vSphere Web Client 5.1 or later. However, you can export settings from any version of distributed port if you use the vSphere Web Client 5.1 or later. Procedure 1 2 3 Browse to a distributed switch in the vSphere Web Client. Right-click the distributed switch in the navigator and select All vCenter Actions > Import Distributed Port Group. Browse to the location of your saved configuration file and click Next. You can use a distributed port group configuration file, or a distributed switch configuration file. However, you can use a file containing both distributed switch and distribute port group configurations only if the file contains settings for a single port group. If multiple port group settings are saved in the distributed switch configuration file, you must use a different file. 4 5 Review the import settings before completing the import. Click Finish.
Restore a vSphere Distributed Port Group Configuration with the vSphere Web Client
Use the restore option to reset the configuration of an existing distributed port group to the settings in a configuration file. This functionality is available only with the vSphere Web Client 5.1 or later. However, you can restore settings from any version of distributed switch if you use the vSphere Web Client 5.1 or later. Procedure 1 Locate a distributed port group in the vSphere Web Client. a b 2 3 To locate a distributed port group, select a distributed switch and click Related Objects. Click Distributed Port Group and select a distributed port group from the list.
Right-click the distributed port group in the navigator and select All vCenter Actions > Restore Configuration. Select one of the following and click Next:
u
Restore to a previous configuration to roll your port group configuration back one step. You cannot restore the port group configuration completely if you have performed more than one step. Restore configuration from a file lets you restore the port group configuration from an exported backup file. You can also use a distributed switch backup file as long as it contains configuration information for the port group.
Review the summary information for the restore. The restore operation overwrites the current settings of the distributed port group with the settings from the backup. If you are restoring the port group configuration from a switch backup file, the restore operation does not delete existing port groups that are not a part of the file.
48
VMware, Inc.
Click Finish.
Working with Distributed Ports

A distributed port is a port on a vSphere distributed switch that connects to the VMkernel or to a virtual machine's network adapter. Default distributed port configuration is determined by the distributed port group settings, but some settings for individual distributed ports can be overridden.
Monitor Distributed Port State with the vSphere Web Client

vSphere can monitor distributed ports and provide information about the current state and runtime statistics of each port. Procedure 1 Locate a distributed port group in the vSphere Web Client. a b 2 3 To locate a distributed port group, select a distributed switch and click the Related Objects tab. Click Distributed Port Groups and select a distributed port group from the list.
Click the Manage tab, and click Ports. Click Start Monitoring Port State. The ports table for the distributed port group displays runtime statistics for each distributed port. The State column displays the current state for each distributed port.
Option Link Up Link Down Blocked -Description The link for this distributed port is up. The link for this distributed port is down. This distributed port is blocked. The state of this distributed port is currently unavailable.
Configure Distributed Port Settings with the vSphere Web Client

You can change general distributed port settings such as the port name and description. Procedure 1 Locate a distributed port group in the vSphere Web Client. a b 2 3 To locate a distributed port group, select a distributed switch and click the Related Objects tab. Click Distributed Port Groups and select a distributed port group from the list.
Click the Manage tab, and click Ports. Select a distributed port from the table. Information about the distributed port appears at the bottom of the screen.
4 5
Click Edit distributed port settings. On the Properties page and policy pages, edit information about the distributed port and click OK. If overrides are not allowed, the policy options are dimmed. You can allow overrides at the port level by changing the Advanced settings of the distributed port group. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46.
VMware, Inc.
49
vSphere Networking
Configuring Virtual Machine Networking on a vSphere Distributed Switch

Connect virtual machines to a vSphere distributed switch either by configuring an individual virtual machine NIC or migrating groups of virtual machines from the vSphere distributed switch itself. Connect virtual machines to vSphere distributed switches by connecting their associated virtual network adapters to distributed port groups. You can do this either for an individual virtual machine by modifying the virtual machines network adapter configuration, or for a group of virtual machines by migrating virtual machines from an existing virtual network to a vSphere distributed switch.
Migrate Virtual Machines to or from a vSphere Distributed Switch with the vSphere Web Client
In addition to connecting virtual machines to a distributed switch at the individual virtual machine level, you can migrate a group of virtual machines between a vSphere distributed switch network and a vSphere standard switch network. Procedure 1 2 3 Browse to a datacenter in the vSphere Web Client navigator. Right-click the datacenter in the navigator and select Migrate VM to Another Network. Select a source network.
n n
Select Specific network and use the Browse button to select a specific source network. Select No network to migrate all virtual machine network adapters that are not connected to any other network.
4 5 6
Select a destination network. Use Browse to select a specific destination network and click Next. Select virtual machines from the list to migrate from the source network to the destination network and click Next. Review your selections and click Finish. Click Back to edit any selections.
Connect an Individual Virtual Machine to a Distributed Port Group in the vSphere Web Client
Connect an individual virtual machine to a vSphere distributed switch by modifying the NIC configuration of the virtual machine. Procedure 1 Locate the virtual machine in the vSphere Web Client. a b 2 3 4 5 Select a datacenter, folder, cluster, resource pool, or host and click the Related Objects tab. Click Virtual Machines and select the virtual machine from the list.
On the Manage tab of the virtual machine, select Settings > VM Hardware. Click Edit. Expand the Network adapter section and select a distributed port group from the drop-down menu. Click OK.
50
VMware, Inc.
Topology Diagrams of a vSphere Distributed Switch in the vSphere Web Client

The topology diagrams of a vSphere Distributed Switch in the vSphere Web Client show the structure of virtual machine adapters, VMkernel adapters, and physical adapters in the switch. You can examine the components, arranged in port groups, whose traffic is handled by the switch, and the connections between them. The diagram displays information about the physical adapter that connects the virtual adapters to the external network. You can view the components that are running on the entire virtual distributed switch and on each host participating in it.
Central Topology Diagram

You can use the central topology diagram of the switch to locate and edit the settings for distributed port groups and uplink groups associated with multiple hosts. You can initiate migration of virtual machine adapters from a port group to a destination on the same or different switch. You can also reorganize the hosts and their networking on the switch by using the Add and Manage Hosts wizard.
Topology Diagram of a Host Proxy Switch

The topology diagram of a host proxy switch shows the adapters attached to the switch ports on the host. You can edit the settings of the VMkernel and physical adapters.
Diagram Filters
You can use diagram filters to limit the information displayed in topology diagrams. The default filter limits the topology diagram to display 32 port groups, 32 hosts, and 1024 virtual machines. You can change the scope of the diagram by using no filters or by applying custom filters. By using a custom filter, you can view information only about a set of virtual machines, a set of port groups on certain hosts, or a port. You can create filters from the central topology diagram of the distributed switch.
View the Topology of a vSphere Distributed Switch in the vSphere Web Client
Examine the organization of components that are connected to the distributed switch across the hosts in a vCenter Server. Procedure 1 2 Navigate to the vSphere distributed switch in the vSphere Web Client. On the Manage tab, click Settings and select Topology.
By default the diagram shows up to 32 distributed port groups, 32 hosts, and 1024 virtual machines.
Example: Diagram of a Distributed Switch That Connects the VMkernel and Virtual Machines to the Network
In your virtual environment, a vSphere Distributed Switch handles VMkernel adapters for vSphere vMotion and for the management network, and virtual machines grouped. You can use the central topology diagram to examine whether a virtual machine or VMkernel adapter is connected to the external network and to identify the physical adapter that carries the data.
VMware, Inc.
51
vSphere Networking
Figure 43. Topology Diagram of a Distributed Switch That Handles VMkernel and Virtual Machine Networking
What to do next You can perform the following common tasks in the topology of the distributed switch:
n
Use filters to view the networking components only for selected port groups on certain hosts, for selected virtual machines, or for a port. Locate, configure and migrate virtual machine networking components across host and port groups by using the Migrate Virtual Machine Networking wizard. Detect the virtual machine adapters that have no network assigned and move them to the selected port group by using the Migrate Virtual Machine Networking wizard. Handle networking components on multiple hosts by using the Add and Manage Hosts wizard. View the physical NIC or NIC team that carries the traffic related to a selected virtual machine adapter or VMkernel adapter. In this way you can also view the host on which a selected VMkernel adapter resides. Select the adapter, trace the route to the associated physical NIC, and view the IP address or domain name next to the NIC.
n n
Determine the VLAN mode and ID for a port group. For information about VLAN modes, see VLAN Configuration, on page 15.
52
VMware, Inc.
View the Topology of a Host Proxy Switch in the vSphere Web Client
Examine and reorganize the networking of the VMkernel and virtual machines that the vSphere Distributed Switch handles on a host. Procedure 1 2 3 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select the distributed switch from the list.
The topology of the host proxy switch appears under the list.
vSphere Distributed Switch Health Check

vSphere 5.1 distributed switch health check helps identify and troubleshoot configuration errors in vSphere distributed switches. The following errors are common configuration errors that health check helps identify.
n n
Mismatched VLAN trunks between a vSphere distributed switch and physical switch. Mismatched MTU settings between physical network adapters, distributed switches, and physical switch ports. Mismatched virtual switch teaming policies for the physical switch port-channel settings.
Health check monitors the following:

n
VLAN. Checks whether vSphere distributed switch VLAN settings match trunk port configuration on the adjacent physical switch ports. MTU. Checks whether the physical access switch port MTU jumbo frame setting based on per VLAN matches the vSphere distributed switch MTU setting. Teaming policies. Checks whether the physical access switch ports EtherChannel setting matches the distributed switch distributed port group IPHash teaming policy settings.
Health check is limited to only the access switch port to which the distributed switch uplink connects. NOTE For VLAN and MTU checks, you must have at least two link-up physical uplink NICs for the distributed switch. For a teaming policy check, you must have at least two link-up physical uplink NICs and two hosts when applying the policy.
Enable or Disable vSphere Distributed Switch Health Check in the vSphere Web Client
Health check monitors for changes in vSphere distributed switch configurations. You must enable vSphere distributed switch health check to perform checks on distributed switch configurations. Health check is available only on ESXi 5.1 distributed switches. You can view health check information only through the vSphere Web Client 5.1 or later. Procedure 1 2 3 Browse to a vSphere distributed switch in the vSphere Web Client. Click the Manage tab. Select Settings, and select Health check.
VMware, Inc.
53
vSphere Networking
4 5
To enable or disable health check, click Edit. Use the drop-down menus to enable or disable health check options.
Option VLAN and MTU Teaming and Failover Description Reports the status of distributed uplink ports and VLAN ranges. Checks for any configuration mismatch between ESXi and the physical switch used in the teaming policy.
Click OK.
What to do next When you change the configuration of a vSphere distributed switch, you can view information about the change in the Monitor tab in the vSphere Web Client. See View vSphere Distributed Switch Health Check Information, on page 54.
View vSphere Distributed Switch Health Check Information

Once you have enabled health check, you can view vSphere distributed switch health check information in the vSphere Web Client. Prerequisites Enable health check on each vSphere distributed switch. See Enable or Disable vSphere Distributed Switch Health Check in the vSphere Web Client, on page 53. Procedure 1 2 3 Browse to a vSphere distributed switch in the vSphere Web Client. Click the Monitor tab and click Health. In the Health Status Details section, click a tab to view the health status of the selected check. The three tabs include: VLAN, MTU, and Teaming and Failover.
Export, Import, and Restore Distributed Switch Configurations

You can export the configuration of a vSphere distributed switch from the vSphere Web Client, including distributed port group configurations. The exported configuration preserves valid networking settings, enabling their distribution to other deployments. You can import or export a configuration of a distributed switch including its port groups. For information about exporting, importing, and restoring a port group configuration, see Export, Import, and Restore vSphere Distributed Port Group Configurations, on page 47. NOTE You can use a saved configuration file to restore policies and hosts associations on the distributed switch. You cannot restore the connection of physical NICs to uplink ports or ports of link aggregation groups.
Export vSphere Distributed Switch Configurations with the vSphere Web Client
You can export vSphere distributed switch and distributed port group configurations to a file. The file preserves valid network configurations, enabling distribution of these configurations to other deployments This functionality is available only with the vSphere Web Client 5.1 or later. However, you can export settings from any version of a distributed switch if you use the vSphere Web Client or later.
54
VMware, Inc.
Procedure 1 2 3 4 5 6 Browse to a distributed switch in the vSphere Web Client navigator. Right-click the distributed switch in the navigator and select All vCenter Actions > Export Configuration. Choose to export the distributed switch configuration, or export the distributed switch configuration and all port groups. (Optional) Enter notes about this configuration in the Descriptions field. Click OK. Click Yes to save the configuration file to your local system.
You now have a configuration file that contains all the settings for the selected distributed switch and distributes port group. You can use this file to create multiple copies of this configuration on an existing deployment, or overwrite settings of existing distributed switches and port groups to conform to the selected settings. What to do next Use the exported configuration file to do the following tasks:
n
To create a copy of the exported distributed switch, see Import a vSphere Distributed Switch Configuration by Using the vSphere Web Client, on page 55. To overwrite settings on an existing distributed switch, see Restore a vSphere Distributed Switch Configuration with the vSphere Web Client, on page 56.
You can also export, import, and restore only port group configurations. See Export, Import, and Restore vSphere Distributed Port Group Configurations, on page 47.
Import a vSphere Distributed Switch Configuration by Using the vSphere Web Client
Import a stored configuration file to create a new vSphere Distributed Switch or to restore a switch that has been deleted earlier. In vSphere 5.1 or later, you can import a distributed switch by using vSphere Web Client. The configuration file contains the networking settings of the switch. By using it you can also replicate the switch in other virtual environments. NOTE You can use a saved configuration file to replicate the switch instance, its host associations, and policies. You cannot replicate the connection of physical NICs to uplink ports or ports on link aggregation groups. Procedure 1 2 3 4 In the vSphere Web Client, navigate to a datacenter. Right-click the datacenter and select All vCenter Actions > Import Distributed Switch. Browse to the location of the configuration file. To assign the keys from the configuration file to the switch and its port groups, select the Preserve original distributed switch and port group identifiers check box and click Next. If you select the Preserve original distributed switch and port group identifiers when you create a switch by using the configuration file of a deleted switch, all hosts that have been connected to the deleted switch are added again.
VMware, Inc.
55
vSphere Networking
Review the settings for the switch and click Finish.
A new distributed switch is created with settings from the configuration file. If you have included distributed port group information in the configuration file, the port groups are also created.
Restore a vSphere Distributed Switch Configuration with the vSphere Web Client
Use the restore option to reset the configuration of an existing distributed switch to the settings in the configuration file. Restoring a distributed switch changes the settings on the selected switch back to the settings saved in the configuration file. You can restore the configuration of a distributed switch only in vCenter Server and vSphere Web Client version 5.1 or later. NOTE You can use a saved configuration file to restore policies and hosts associations on the distributed switch. You cannot restore the connection of physical NICs to uplink ports or ports of link aggregation groups. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the distributed switch. Right-click the distributed switch in the navigator and select All vCenter Actions > Restore Configuration. Browse for the configuration backup file to use. Select Restore distributed switch and all port groups or Restore distributed switch only and click Next Review the summary information for the restore. Restoring a distributed switch will overwrite the current settings of the distributed switch and its port groups. It will not delete existing port groups that are not part of the configuration file. 6 Click Finish. The distributed switch configuration has been restored to the settings in the configuration file.
Private VLANs
Private VLANs are used to solve VLAN ID limitations and waste of IP addresses for certain network setups. A private VLAN is identified by its primary VLAN ID. A primary VLAN ID can have multiple secondary VLAN IDs associated with it. Primary VLANs are Promiscuous, so that ports on a private VLAN can communicate with ports configured as the primary VLAN. Ports on a secondary VLAN can be either Isolated, communicating only with promiscuous ports, or Community, communicating with both promiscuous ports and other ports on the same secondary VLAN. To use private VLANs between a host and the rest of the physical network, the physical switch connected to the host needs to be private VLAN-capable and configured with the VLAN IDs being used by ESXi for the private VLAN functionality. For physical switches using dynamic MAC+VLAN ID based learning, all corresponding private VLAN IDs must be first entered into the switch's VLAN database. To configure distributed ports to use Private VLAN functionality, you must create the necessary Private VLANs on the vSphere distributed switch to which the distributed ports are connected.
56
VMware, Inc.
Create a Private VLAN in the vSphere Web Client

You can create a private VLAN for use on a vSphere distributed switch and its associated distributed ports. Procedure 1 2 3 4 5 6 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and click Settings. Select Private VLAN and click Edit. Click Add to add a Primary VLAN ID to the list. Click up and down arrows to select a primary private VLAN ID. Click the plus sign (+) next to the Primary VLAN ID to add it to the list. The primary private VLAN also appears under Secondary Private VLAN ID. 7 8 9 10 To add a secondary VLAN, click Add under the Secondary VLAN list, and click the up and down arrows to enter the number for the secondary VLAN. Click the plus sign (+) next to the Secondary VLAN ID to add it to the list. In the Secondary VLAN type column, click into the column to activate a drop-down menu. Select either Isolated or Community for the VLAN type. Click OK.
What to do next Configure a distributed port group or port to associate traffic with the private VLAN. See Edit the VLAN Policy on a Distributed Port Group in the vSphere Web Client, on page 87 and Edit the VLAN Policy on a Distributed Port with the vSphere Web Client, on page 88.
Remove a Primary Private VLAN with the vSphere Web Client

Remove unused primary private VLANs from the distributed settings view of the vSphere Web Client. Prerequisites Before you remove a private VLAN, be sure that no port groups are configured to use it. Procedure 1 2 3 4 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and click Settings. Select Private VLAN and click Edit. Select a primary private VLAN to remove. When you remove a primary private VLAN, you also remove all associated secondary private VLANs. 5 6 7 Click Remove under the Primary VLAN ID list. Click OK to verify that you want to remove the primary VLAN. Click OK.
VMware, Inc.
57
vSphere Networking
Remove a Secondary Private VLAN with the vSphere Web Client

Remove unused secondary private VLANs from the distributed settings view of the vSphere Web Client. Prerequisites Before you remove a private VLAN, be sure that no port groups are configured to use it. Procedure 1 2 3 4 5 6 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and select Settings. Select Private VLAN and click Edit. Select a primary private VLAN to display its associated secondary private VLANs. Select a secondary private VLAN to remove. Click Remove under the Secondary VLAN ID list, and click OK.
58
VMware, Inc.
LACP Support on a vSphere Distributed Switch

The LACP support on a vSphere Distributed Switch 5.5 lets you connect ESXi hosts to physical switches by using dynamic link aggregation. You can create multiple link aggregation groups (LAGs) on a distributed switch to aggregate the bandwidth of physical NICs on ESXi hosts that are connected to LACP port channels. Figure 44. Enhanced LACP Support on a vSphere Distributed Switch
vCenter Server
vSphere Distributed Switch Production
Test environment Uplink port group
LAG1 LAG1-0 LAG1-1 Uplink0 Uplink1
Test environment Uplink port group
Test environment
Uplink port group

LAG1
LAG1
LAG1-0
LAG1-1
uplink port 0
uplink port 1
uplink port 0
uplink port 1
LAG1-0
LAG1-1
vmnic0
vmnic1
vmnic2
vmnic3
vmnic0
vmnic1
vmnic2
vmnic3
LACP port channel Physical Switch
LACP port channel
LACP Configuration on the Distributed Switch

You configure a LAG with two or more ports and connect physical NICs to the ports. LAG ports are teamed within the LAG and the network traffic is load balanced between them through an LACP hashing algorithm. You can use a LAG to handle the traffic of distributed port groups to provide increased network bandwidth, redundancy, and load balancing to the port groups. A representation of a LAG is available on the distributed switch and on the proxy switch on every host that is connected to the distributed switch. For example, if you create LAG1 with two ports, LAG1 with the same number of ports is created on every host that is connected to the distributed switch.
VMware, Inc.
59
vSphere Networking
On the host side, you can connect one physical NIC to only one LAG port. On the distributed switch, one LAG port can have multiple physical NICs from different hosts connected to it. The physical NICs on a host that you connect to the LAG ports must be connected to links that participate in an LACP port channel on the physical switch. You can create up to 64 LAGs on a distributed switch. A host can support up to 32 LAGs. However, the number of LAGs that you can actually use depends on the capabilities of the underlying physical environment and the topology of the virtual network. For example, if the physical switch supports up to four ports in an LACP port channel, you can connect up to four physical NICs per host to a LAG.
Port Channel Configuration on the Physical Switch

For every host where you want to use LACP, you must create a separate LACP port channel on the physical switch. You must consider the following requirements when configuring LACP on the physical switch:
n
The number of ports in the LACP port channel must be equal to the number of physical NICs that you want to bundle together on the host. For example, if you want to aggregate the bandwidth of two physical NICs on a host, you must create an LACP port channel with two ports on the physical switch. The LAG on the distributed switch must be configured with at least two ports. The hashing algorithm of the LACP port channel on the physical switch must be the same as the hashing algorithm set to the LAG on the distributed switch. The physical NICs that you want to connect to the LACP port channel must be configured with the same speed and duplex.
Comparison Between LACP Support in vSphere Distributed Switch 5.5 and 5.1
The LACP support on vSphere Distributed Switch 5.5 provides enhanced capabilities for managing link aggregation compared to vSphere Distributed Switch 5.1. Table 41. Differences Between the LACP Support in vSphere Distributed Switch 5.5 and 5.1
vSphere Distributed Switch 5.1 No vSphere Distributed Switch 5.5 Yes
Functionality Support for multiple LAGs
Description In distributed switches 5.1, the LACP support is enabled on an entire uplink port group and that port group acts as a single LAG for the switch. vSphere Distributed Switch 5.5 supports multiple LAGs. On distributed switches 5.1, you can configure one LAG to handle the traffic for all distributed port groups on the distributed switch. vSphere Distributed Switch 5.5 lets you use a LAG to handle the traffic for particular distributed port groups. You can set LAGs as the active uplinks in the teaming and failover order of port groups. The LACP support in distributed switches 5.1 supports only IP Hash load balancing. In distributed switches 5.5, all load balancing algorithms of LACP are supported.
Configure distributed port groups to use LAGs as active uplinks
No
Yes
Multiple LACP load balancing algorithms
No
Yes
60
VMware, Inc.
Convert to the Enhanced LACP Support on a vSphere Distributed Switch in the vSphere Web Client
After upgrading a vSphere Distributed Switch to version 5.5, you can convert to the enhanced LACP support to create multiple LAGs on the distributed switch. If an LACP configuration exists on the distributed switch, enhancing the LACP support creates a new LAG and migrates all physical NICs from the standalone uplinks to the LAG ports. To create a different LACP configuration, you should disable the LACP support on the uplink port group before you start the conversion. If the conversion to the enhanced LACP support fails, see vSphere Troubleshooting for details about how to complete it manually. Prerequisites
n n
Verify that the vSphere Distributed Switch is version 5.5. Verify that none of the distributed port groups permit overriding their uplink teaming policy on individual ports. If you convert from an existing LACP configuration, verify that only one uplink port group exists on the distributed switch. Verify that hosts that participate in the distributed switch are connected and responding. Verify that you have the dvPort group.Modify privilege on the distributed port groups on the switch. Verify that you have the Host.Configuration.Modify privilege on the hosts on the distributed switch.
n n n
Procedure 1 2 3 4 In the vSphere Web Client, navigate to the distributed switch. Select Summary. In the Features section, click Enhance next to Link Aggregation Control Protocol. (Optional) Select Export configuration to back up the configuration of the distributed switch and click Next. The backup only stores the distributed switch configuration on the vCenter Server side. If the conversion to the enhanced LACP support fails, you can either use the backup to create a new distributed switch with the same configuration, or complete the conversion manually. 5 Review the validation prerequisites.
Prerequisite Port group accessibility LACP configuration Uplink teaming policy override Host accessibility Host connectivity Description You have enough privileges to access and modify the uplink and distributed port groups on the switch. You have only one uplink port group on the distributed switch. Distributed port groups do not permit the override of their uplink teaming policy on individual ports. You have enough privileges to modify the networking configuration of the hosts connected to the distributed switch. Hosts that participate in the distributed switch are connected and responding.
6 7
Click Next. If you convert from an existing LACP configuration, type the name of the new LAG in the Name text field.
VMware, Inc.
61
vSphere Networking
Click Next to review the details about the conversion and click Finish.
You converted to the Enhanced LACP support on the vSphere Distributed Switch. What to do next Create LAGs on the distributed switch to aggregate the bandwidth of multiple physical NICs on the associated hosts.
LACP Teaming and Failover Configuration for Distributed Port Groups

To handle the network traffic of distributed port groups by using a LAG, you assign physical NICs to the LAG ports and set the LAG as active in the teaming and failover order of distributed port groups. Table 42. LACP Teaming and failover configuration of distributed port groups
Failover Order Active Uplinks A single LAG Description You can only use one active LAG or multiple standalone uplinks to handle the traffic of distributed port groups . You cannot configure multiple active LAGs or mix active LAGs and standalone uplinks. Having an active LAG and standby uplinks and the reverse is not supported. Having a LAG and another standby LAG is not supported. Because only one LAG must be active and the Standby list must be empty, you must set all standalone uplinks and other LAGs to unused.
Standby
Empty
Unused
All standalone uplinks and other LAGs if any
Configure a LAG to Handle the Traffic for Distributed Port Groups in the vSphere Web Client
To aggregate the bandwidth of multiple physical NICs on hosts, you can create a LAG on the distributed switch and use it to handle the traffic of distributed port groups. Newly created LAGs do not have physical NICs assigned to their ports and are unused in the teaming and failover order of distributed port groups. To handle the network traffic of distributed port groups by using a LAG, you must migrate the traffic from standalone uplinks to the LAG. Prerequisites
n
Verify that for every host where you want to use LACP, a separate LACP port channel exists on the physical switch. See LACP Support on a vSphere Distributed Switch, on page 59. Verify that the distributed switch where you configure the LAG is version 5.5. Verify that enhanced LACP is supported on the distributed switch.
n n
Procedure 1 2 Create a LAG in the vSphere Web Client on page 63 To migrate the network traffic of distributed port groups to a LAG, you create a new LAG. Set a LAG as Standby in the Teaming and Failover Order of Distributed Port Groups in the vSphere Web Client on page 64 The new LAG by default is unused in the teaming and failover order of distributed port groups. Because only one LAG or only standalone uplinks can be active for distributed port groups, you must create an intermediate teaming and failover configuration, where the LAG is standby. This configuration lets you migrate physical NICs to the LAG ports by keeping the network connectivity up.
62
VMware, Inc.
Assign Physical NICs to LAG Ports in the vSphere Web Client on page 64 You have set the new LAG as standby in the teaming and failover order of distributed port groups. Having the LAG as standby lets you safely migrate the physical NICs from standalone uplinks to the LAG ports without losing network connectivity.
Set the LAG as Active in the Teaming and Failover Order of the Distributed Port Group in the vSphere Web Client on page 65 You migrated physical NICs to the LAG ports. Set the LAG as active and move all standalone uplinks as unused in the teaming and failover order of the distributed port groups.
Create a LAG in the vSphere Web Client

To migrate the network traffic of distributed port groups to a LAG, you create a new LAG. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the distributed switch. Select Manage, and select Settings. Under LACP, click New Link Aggregation Group. Name the new LAG. Set the number of ports to the LAG. Set the same number of ports to the LAG as the number of ports in the LACP port channel on the physical switch. A LAG port has the same function as an uplink on the distributed switch. All LAG ports form a NIC team in the context of the LAG. 6 Select the LACP negotiating mode of the LAG.
Option Active Description All LAG ports are in an Active negotiating mode. The LAG ports initiate negotiations with the LACP port channel on the physical switch by sending LACP packets. The LAG ports are in Passive negotiating mode. They respond to LACP packets they receive but do not initiate LACP negotiation.
Passive
If the LACP-enabled ports on the physical switch are in Active negotiating mode, you can set the LAG ports in Passive mode and the reverse. 7 Select a load balancing mode from the hashing algorithms that LACP defines. NOTE The hashing algorithm must be the same as the hashing algorithm set to the LACP port channel on the physical switch. 8 Set the VLAN and the NetFlow policies for the LAG. This option is active when overriding the VLAN and NetFlow policies per individual uplink ports is enabled on the uplink port group. If you set the VLAN and NetFlow policies to the LAG, they override the policies set on the uplink port group level. 9 Click OK.
The new LAG is unused in the teaming and failover order of distributed port groups. No physical NICs are assigned to the LAG ports. As with standalone uplinks, the LAG has a representation on every host that is associated with the distributed switch. For example, if you create LAG1 with two ports on the distributed switch, a LAG1 with the same number of ports is created on every host in the distributed switch.
VMware, Inc.
63
vSphere Networking
What to do next Set the LAG as standby in the teaming and failover configuration of distributed port groups. In this way, you create an intermediate configuration that lets you migrate the network traffic to the LAG without losing network connectivity.
Set a LAG as Standby in the Teaming and Failover Order of Distributed Port Groups in the vSphere Web Client
The new LAG by default is unused in the teaming and failover order of distributed port groups. Because only one LAG or only standalone uplinks can be active for distributed port groups, you must create an intermediate teaming and failover configuration, where the LAG is standby. This configuration lets you migrate physical NICs to the LAG ports by keeping the network connectivity up. Procedure 1 2 3 4 5 6 7 Navigate to the distributed switch. From the Actions menu, select Manage Distributed Port Groups. Select Teaming and failover and click Next. Select the port groups where you want to use the LAG. In Failover order, select the LAG and use the up arrow to move it to the Standby uplinks list. Click Next, review the message that informs you about the usage of the intermediate teaming and failover configuration, and click OK. On the Ready to complete page, click Finish.
What to do next Migrate physical NICs from standalone uplinks to the LAG ports.
Assign Physical NICs to LAG Ports in the vSphere Web Client

You have set the new LAG as standby in the teaming and failover order of distributed port groups. Having the LAG as standby lets you safely migrate the physical NICs from standalone uplinks to the LAG ports without losing network connectivity. Prerequisites
n
Verify that either all LAG ports or the corresponding LACP-enabled ports on the physical switch are in active LACP negotiating mode. Verify that the physical NICs that you want to assign to the LAG ports have the same speed and are configured at full duplex.
Procedure 1 2 3 4 5 6 7 8 In the vSphere Web Client, navigate to the distributed switch where the LAG resides. From the Actions menu, select Add and Manage Hosts. Select Manage host networking. Select the host whose physical NICs you want to assign to the LAG ports and click Next. On the Select network adapter tasks page, select Manage physical adapters and click Next. On the Manage physical network adapters page, select a NIC and click Assign an uplink. Select a LAG port and click OK. Repeat Step 6 and Step 7 for all physical NICs that you want to assign to the LAG ports.
64
VMware, Inc.
Complete the wizard.
Example: Configure Two Physical NICs to a LAG in the Add and Manage Hosts Wizard For example, if you have a LAG with two ports, you configure a physical NIC to each LAG port in the Add and Manage Hosts wizard. Figure 45. Connecting Two Physical NICs to LAG Ports
What to do next Set the LAG as active and all standalone uplinks to unused in the teaming and failover order of distributed port groups.
Set the LAG as Active in the Teaming and Failover Order of the Distributed Port Group in the vSphere Web Client
You migrated physical NICs to the LAG ports. Set the LAG as active and move all standalone uplinks as unused in the teaming and failover order of the distributed port groups. Procedure 1 2 3 4 5 6 Navigate to the distributed switch. From the Actions menu, select Manage Distributed Port Groups. Select Teaming and failover and click Next. Select the port groups where you set the LAG as standby and click Next. In Failover order, use the up and down arrows to move the LAG in the Active list, all standalone uplinks in the Unused list, and leave the Standby list empty. Click Next and click Finish.
You safely migrated network traffic from standalone uplinks to a LAG for distributed port groups and created a valid LACP teaming and failover configuration for the groups. Example: Topology of a Distributed Switch that Uses a LAG If you configure a LAG with two ports to handle the traffic of a distributed port group, you can check the topology of the distributed switch to view how it changed as a result of the new configuration.
VMware, Inc.
65
vSphere Networking
Figure 46. Distributed Switch Topology with a LAG
Edit a LAG in the vSphere Web Client

Edit the settings of a LAG if you need to add more ports to the group or change the LACP negotiating mode, the load balancing algorithm, or the VLAN and NetFlow policies. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the vSphere Distributed Switch. Select Manage and select Settings. Select LACP. In the Name text box, type a new name for the LAG. Change the number of ports for the LAG if you want to add more physical NICs to it. The new NICs must be connected to ports that are part of an LACP port channel on the physical switch. 6 Change the LACP negotiating mode of the LAG. If all ports on the physical LACP port channel are in Active LACP mode, you can change the LACP mode of the LAG to Passive and the reverse. 7 Change the load balancing mode of the LAG. You can select from the load balancing algorithms that LACP defines. 8 Change the VLAN and the NetFlow policies. This option is active when the option for overriding the VLAN and NetFlow policies for individual ports is enabled on the uplink port group. If you change the VLAN and NetFlow policies for the LAG, they override the policies set at the uplink port group level. 9 Click OK.
66
VMware, Inc.
Enable the LACP 5.1 Support on an Uplink Port Group in the vSphere Web Client
You can enable the LACP support on an uplink port group for vSphere Distributed Switches 5.1, and for switches upgraded to 5.5 that do not have the enhanced LACP support. Prerequisites
n
Verify that for every host where you want to use LACP, a separate LACP port channel exists on the physical switch. Verify that distributed port groups have their load balancing policy set to IP hash. Verify that the LACP port channel on the physical switch is configured with IP hash load balancing. Verify that distributed port groups have network failure detection policy set to link status only. Verify that distributed port groups have all uplinks set to active in their teaming and failover order. Verify that all physical NICs that are connected to the uplinks have the same speed and are configured at full duplex.
n n n n n
Procedure 1 In the vSphere Web Client, navigate to an uplink port group. a b 2 3 4 5 Select a distributed switch and click Related Objects. Click Uplink Port Groups and select the uplink port group.
Click Manage, and click Settings. Click Edit. In the LACP section, use the drop-down list to enable LACP. Set the LACP negotiating mode for the uplink port group.
Option Active Description All uplink ports in the group are in an Active negotiating mode. The uplink ports initiate negotiations with the LACP-enabled ports on the physical switch by sending LACP packets. All uplink ports are in a Passive negotiating mode. They respond to LACP packets that they receive but do not initiate LACP negotiation.
Passive
If the LACP-enabled ports on the physical switch are in Active negotiating mode, you can set the uplink ports in Passive mode and the reverse. 6 Click OK.
Limitations of the LACP Support on a vSphere Distributed Switch

The LACP support on a vSphere Distributed Switch lets network devices to negotiate automatic bundling of links by sending LACP packets to a peer. However, the LACP support on a vSphere Distributed Switch has limitations.
n n n n
The LACP support is not compatible with software iSCSI multipathing. The LACP support settings are not available in host profiles. The LACP support is not possible between nested ESXi hosts. The LACP support does not work with the ESXi dump collector.
VMware, Inc.
67
vSphere Networking
n n
The LACP support does not work with port mirroring. The teaming and failover health check does not work for LAG ports. LACP checks the connectivity of the LAG ports. The enhanced LACP support works correctly when only one LAG handles the traffic per distributed port or port group. The LACP 5.1 support only works with IP Hash load balancing and Link Status Network failover detection. The LACP 5.1 support only provides one LAG per distributed switch and per host.
68
VMware, Inc.
Setting Up VMkernel Networking
You set up VMkernel adapters to provide network connectivity to hosts and to accommodate the traffic of vMotion, IP storage, Fault Tolerance logging, and Virtual SAN.
n
The VMkernel Networking Layer on page 70 The VMkernel networking layer provides connectivity to hosts and handles the standard infrastructure traffic of vSphere vMotion, IP storage, Fault Tolerance, and Virtual SAN. You can set up VMkernel adapters for the standard infrastructure traffic on vSphere standard switches and on vSphere distributed switches.
View Information About VMkernel Adapters on a Host in the vSphere Web Client on page 71 For each VMkernel adapter, you can view its assigned services, associated switch, port settings, IP settings, TCP/IP stack, VLAN ID, and policies.
Create a VMkernel Adapter on a vSphere Standard Switch in the vSphere Web Client on page 71 Create a VMkernel network adapter on a vSphere standard switch to provide network connectivity for hosts and to handle the traffic for vSphere vMotion, IP storage, Fault Tolerance logging, or Virtual SAN. You should dedicate a VMkernel adapter to only one traffic type.
Create a VMkernel Adapter on a Host Associated with a vSphere Distributed Switch in the vSphere Web Client on page 73 Create a VMkernel adapter on a host that is associated with a distributed switch to provide network connectivity to the host and to handle the traffic for vSphere vMotion, IP storage, Fault Tolerance logging, and Virtual SAN. You should dedicate a single distributed port group per VMkernel adapter. One VMkernel adapter should handle one traffic type.
Edit a VMkernel Adapter Configuration in the vSphere Web Client on page 74 You might need to change the supported traffic type for a VMkernel adapter, or the way IPv4 or IPv6 addresses are obtained.
View TCP/IP Stack Configuration on a Host in the vSphere Web Client on page 75 You can view the DNS and routing configuration of a TCP/IP stack on a host, the IPv4 and IPv6 routing tables, the congestion control algorithm, and the maximum number of allowed connections.
Change the Configuration of a TCP/IP Stack on a Host in the vSphere Web Client on page 76 You can change the DNS and default gateway configuration of a TCP/IP stack on a host, the congestion control algorithm, the maximum number of connections, and the name of custom TCP/IP stacks.
Create a Custom TCP/IP Stack on page 76 You can create a custom TCP/IP stack on a host to forward VMkernel traffic through a custom application.
VMware, Inc.
69
vSphere Networking
Remove a VMkernel Adapter in the vSphere Web Client on page 77 Remove a VMkernel adapter from a vSphere distributed or a standard switch when you no longer need the adapter. Make sure that you leave at least one VMkernel adapter for management traffic on the host to keep the network connectivity up.
The VMkernel Networking Layer

The VMkernel networking layer provides connectivity to hosts and handles the standard infrastructure traffic of vSphere vMotion, IP storage, Fault Tolerance, and Virtual SAN. You can set up VMkernel adapters for the standard infrastructure traffic on vSphere standard switches and on vSphere distributed switches.
TCP/IP Stacks at the VMkernel Level

The default TCP/IP stack at the VMkernel level provides networking support for the standard infrastructure types of traffic. You can add custom TCP/IP stacks at the VMkernel level and forward networking traffic through custom applications.
Infrastructure Traffic Types on the Default TCP/IP Stack

You should dedicate a separate VMkernel adapter for every traffic type. For distributed switches, dedicate a separate distributed port group for each VMkernel adapter. Management traffic It carries the configuration and management communication for ESXi hosts and vCenter Server as well as the host-to-host High Availability traffic. By default, when you install the ESXi software, a vSphere standard switch is created on the host together with a VMkernel adapter for management traffic. To provide redundancy, you can create additional VMkernel adapters for management traffic. To accommodate the vMotion traffic, a VMkernel adapter for vMotion is required both on the source and the target hosts. The VMkernel adapters for vMotion should handle only the vMotion traffic. For better performance, you can assign multiple physical NICs to the port group of the VMkernel adapter. In this way, multiple physical NICs are used for vMotion, which results in greater bandwidth. NOTE vMotion network traffic is not encrypted. You should provision secure private networks for use by vMotion only. IP storage traffic Storage types that use standard TCP/IP networks and depend on the VMkernel networking layer require VMkernel adapters. Such storage types are software iSCSI, depended hardware iSCSI, and NFS. If you have two or more physical NICs for iSCSI, you can configure iSCSI multipathing. NFS does not require a separate VMkernel adapter. It uses the management traffic on the host for I/O. ESXi hosts support only NFS version 3 over TCP/IP. The traffic that the primary fault tolerant virtual machine sends to the secondary fault tolerant virtual machine over the VMkernel networking layer. A separate VMkernel adapter for Fault Tolerance logging is required on every host that is part of a vSphere HA cluster. Every host that participates in a Virtual SAN cluster must have a VMkernel adapter to handle the Virtual SAN traffic.
vMotion traffic
Fault Tolerance traffic
Virtual SAN traffic
70
VMware, Inc.
Chapter 5 Setting Up VMkernel Networking
View Information About VMkernel Adapters on a Host in the vSphere Web Client
For each VMkernel adapter, you can view its assigned services, associated switch, port settings, IP settings, TCP/IP stack, VLAN ID, and policies. Procedure 1 2 3 In the vSphere Web Client, navigate to the host. Click Manage and click Networking. To view information about all VMkernel adapters on the host, select VMkernel adapters. For ESX hosts 4.x, the VMkernel adapters option displays the ESX service console.
Option Device Network Label Switch IP Address TCP/IP Stack vMotion Traffic FT Logging Management Traffic Virtual SAN Traffic Description Name of the VMkernel adapter. Name of the network to which the VMkernel adapter is connected. vSphere standard or distributed switch with which the VMkernel adapter is associated. The IP address of the VMkernel adapter. The TCP/IP stack that handles the traffic for the VMkernel adapter. If there is a custom TCP/IP stack, set for the VMkernel adapter, it is displayed. Status of vMotion on the VMkernel adapter. Status of FT Logging on the VMkernel adapter. Status of Management Traffic on the VMkernel adapter. Status of the Virtual SAN traffic on the VMkernel adapter.
Select an adapter from the VMkernel adapters list to view its settings.
Tab All Properties Description Displays all configuration information about the VMkernel adapter. This includes port and NIC settings, IPv4 and IPv6 settings, traffic shaping, teaming and failover, and security policies. Displays the port properties and NIC settings of the VMkernel adapter. The port properties include the port group (network label) to which the adapter is associated, the VLAN ID and the enabled services. The NIC settings include Displays all IPv4 and IPv6 settings for the VMkernel adapter. IPv6 information is not displayed if IPv6 has not been enabled on the host. Displays the configured traffic shaping, teaming and failover, and security policies that apply for the port group where the VMkernel adapter is connected.
IP Settings Policies
Create a VMkernel Adapter on a vSphere Standard Switch in the vSphere Web Client
Create a VMkernel network adapter on a vSphere standard switch to provide network connectivity for hosts and to handle the traffic for vSphere vMotion, IP storage, Fault Tolerance logging, or Virtual SAN. You should dedicate a VMkernel adapter to only one traffic type. Procedure 1 2 In the vSphere Web Client, navigate to the host. Under Manage, select Networking and then select VMkernel adapters.
VMware, Inc.
71
vSphere Networking
3 4 5 6
Click Add host networking. On the Select connection type page, select VMkernel Network Adapter and click Next. On the Select target device page, select either an existing standard switch or a New vSphere standard switch. (Optional) On the Create a Standard Switch page, assign physical NICs to the switch. You can create the standard switch without physical NICs and configure them later. During that time the host does not have network connectivity to the other hosts on the physical network. The virtual machines on the host are able to communicate with each other. a b Click Add and select as many physical NICs as you need. Use the up and down arrows to configure the active and standby NICs.
On the Port properties page, configure the settings for the VMkernel adapter.
Option Network label VLAN ID IP settings Description Type a value for this label to indicate the traffic type for the VMkernel adapter, for example Management traffic or vMotion. Set a VLAN ID to identify the VLAN that the network traffic of the VMkernel adapter will use. Select IPv4, IPv6, or both. NOTE The IPv6 option does not appear on hosts that do not have IPv6 enabled. Select a stack from the list. You can enable services for the default TCP/IP stack on the host. Select from the available services: n vMotion traffic. Enables the VMkernel adapter to advertise itself to another host as the network connection where vMotion traffic is sent. You can enable this property for only one vMotion and IP storage VMkernel adapter per host. If this property is not enabled for any VMkernel adapter, migration with vMotion to the selected host is not possible. n Fault Tolerance traffic. Enables Fault Tolerance logging on the host. n Management traffic. Enables the management traffic for the host and vCenter Server. Typically, hosts have such a VMkernel adapter created when the ESXi software was installed. You can create another VMkernel adapter for management traffic on the host to provide redundancy. n Virtual SAN. Enables the Virtual SAN traffic on the host. Every host that is part from a Virtual SAN cluster must have such a VMkernel adapter.
72
VMware, Inc.
a b c
10
Review your setting selections in the Ready to complete page and click Finish.
Create a VMkernel Adapter on a Host Associated with a vSphere Distributed Switch in the vSphere Web Client
Create a VMkernel adapter on a host that is associated with a distributed switch to provide network connectivity to the host and to handle the traffic for vSphere vMotion, IP storage, Fault Tolerance logging, and Virtual SAN. You should dedicate a single distributed port group per VMkernel adapter. One VMkernel adapter should handle one traffic type. Procedure 1 2 3 4 5 6 In the vSphere Web Client, navigate to the host. Under Manage, select Networking and then select VMkernel adapters. Click Add host networking. On the Select connection type page, select VMkernel Network Adapter and click Next. Select a distributed port group and click Next. On the Port properties page, configure the settings for the VMkernel adapter.
Option Network label IP settings Description The network label is inherited from the label of the distributed port group. Select IPv4, IPv6, or both. NOTE The IPv6 option does not appear on hosts that do not have IPv6 enabled. If custom stacks are available, select one from the list. You can enable services for the default TCP/IP stack on the host. Select from the available services: n vMotion traffic. Enables the VMkernel adapter to advertise itself to another host as the network connection where vMotion traffic is sent. You can enable this property for only one vMotion and IP storage VMkernel adapter per host. If this property is not enabled for any VMkernel adapter, migration with vMotion to the selected host is not possible. n Fault Tolerance traffic. Enables Fault Tolerance logging on the host. n Management traffic. Enables the management traffic for the host and vCenter Server. Typically, hosts have such a VMkernel adapter created when the ESXi software is installed. You can create another VMkernel adapter for management traffic on the host to provide redundancy. n Virtual SAN. Enables the Virtual SAN traffic on the host. Every host that is part of a Virtual SAN cluster must have such a VMkernel adapter.
VMware, Inc.
73
vSphere Networking
a b c
Review your setting selections in the Ready to complete page and click Finish.
Edit a VMkernel Adapter Configuration in the vSphere Web Client

You might need to change the supported traffic type for a VMkernel adapter, or the way IPv4 or IPv6 addresses are obtained. Procedure 1 2 3 4 In the vSphere Web Client, navigate to the host. Under Manage, select Networking and then select VMkernel adapters. Select the VMkernel adapter that resides on the target distributed or standard switch and click Edit. On the Port properties page, select the services that you want to enable.
Check box vMotion traffic Description Enables the VMkernel adapter to advertise itself to another host as the network connection where vMotion traffic is sent. You can enable this property for only one vMotion and IP storage VMkernel adapter per host. If this property is not enabled for any VMkernel adapter, migration with vMotion to the selected host is not possible. Enables Fault Tolerance logging on the host. Enables the management traffic for the host and vCenter Server. Typically, hosts have such a VMkernel adapter created when the ESXi software was installed. You can have an additional VMkernel adapter for management traffic on the host to provide redundancy. Enables Virtual SAN traffic on the host. Every host that is part from a Virtual SAN cluster must have such a VMkernel adapter.
Fault Tolerance traffic Management traffic
Virtual SAN
On the NIC Settings page, set the MTU for the network adapter.
74
VMware, Inc.
With IPv4 enabled, in the IPv4 settings section select the method by which IP addresses are obtained.
With IPv6 enabled, in the IPv6 settings select an option for obtaining IPv6 addresses. NOTE The IPv6 option does not appear on hosts that do not have IPv6 enabled.
a b c
In the Advanced Settings section of IP Settings, you can remove IPv6 addresses. If router advertisement is enabled, removed addresses from this origin might reappear. Removal of DHCP addresses on the VMkernel adapter is not supported. These addresses are removed only when the DHCP option is turned off. 8 9 On the Validate changes page, verify that the changes made to the VMKernel adapter will not disrupt other operations. Click OK.
View TCP/IP Stack Configuration on a Host in the vSphere Web Client

You can view the DNS and routing configuration of a TCP/IP stack on a host, the IPv4 and IPv6 routing tables, the congestion control algorithm, and the maximum number of allowed connections. Procedure 1 2 3 In the vSphere Web Client, navigate to the host. Click Manage, click Networking, and select TCP/IP configuration. Select a stack from the TCP/IP Stacks table. If there are no custom TCP/IP stacks configured on the host, you view only the default TCP/IP stack on the host. DNS and routing details about the selected TCP/IP stack appear below the TCP/IP Stacks table. You can view the IPv4 and IPv6 routing tables, and the DNS and routing configuration for the stack. NOTE The IPv6 routing table is only visible if IPv6 is enabled on the host. The Advanced tab contains information about the configured congestion control algorithm and the maximum number of allowed connections to the stack.
VMware, Inc.
75
vSphere Networking
Change the Configuration of a TCP/IP Stack on a Host in the vSphere Web Client
You can change the DNS and default gateway configuration of a TCP/IP stack on a host, the congestion control algorithm, the maximum number of connections, and the name of custom TCP/IP stacks. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the host. Click Manage, click Networking, and select TCP/IP configuration. Select a stack from the table and click Edit. On the Name page, you can change the name of a custom TCP/IP stack. On the DNS configuration page, select a method of obtaining DNS server information.
Option Obtain settings automatically from virtual network adapter Enter settings manually Description From the VMKernel network adapter drop-down menu, select a network adapter. a b c d e Edit the Host name. Edit the Domain name. Type a preferred DNS server IP address. Type an alternate DNS server IP address. (Optional) Use the Search domains text box to look for hosts with specific names.
On the Routing page, edit the VMkernel gateway information. NOTE Removing the default gateway might cause the client to lose connectivity with the host.
7 8
On the Advanced page, edit the congestion control algorithm of the stack and the maximum number of connections. Click OK.
Create a Custom TCP/IP Stack

You can create a custom TCP/IP stack on a host to forward VMkernel traffic through a custom application. Procedure 1 2 3 Open an SSH connection to the host. Log in as the root user. Run the following vSphere CLI command:
esxcli network ip netstack add -N="stack_name"
The custom TCP/IP stack is created on the host. You can assign VMkernel adapters to the stack.
76
VMware, Inc.
Remove a VMkernel Adapter in the vSphere Web Client

Remove a VMkernel adapter from a vSphere distributed or a standard switch when you no longer need the adapter. Make sure that you leave at least one VMkernel adapter for management traffic on the host to keep the network connectivity up. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the host. Under Manage, select Networking and then select VMkernel adapters. Select a VMkernel adapter from the list, and click Remove. On the confirmation dialog, click Analyze impact. Review the impacted services and the level of impact.
a b 6
If impact on a service is important or critical, click the service and review the reasons that are displayed in the Analysis details pane. If there are no impacted services, close the Analyze Impact dialog, otherwise cancel the removal of the VMkernel adapter until you fix the seasons for any critical or important impact on a service.
Click OK.
VMware, Inc.
77
vSphere Networking
78
VMware, Inc.
Networking Policies
Policies set at the standard switch or distributed port group level apply to all of the port groups on the standard switch or to ports in the distributed port group. The exceptions are the configuration options that are overridden at the standard port group or distributed port level.
n
Teaming and Failover Policy on page 80 Teaming and failover policy lets you to determine how network traffic is distributed between physical adapters and how to reroute traffic in the event of adapter failure.
VLAN Policy on page 87 VLAN policies determine how VLANs function across your network environment. Security Policy on page 90 Networking security policy provides protection of traffic against MAC address impersonation and unwanted port scanning
Traffic Shaping Policy on page 93 A traffic shaping policy is defined by average bandwidth, peak bandwidth, and burst size. You can establish a traffic shaping policy for each port group and each distributed port or distributed port group.
Resource Allocation Policy on page 97 The Resource Allocation policy allows you to associate a distributed port or port group with a usercreated network resource pool. This policy provides you with greater control over the bandwidth given to the port or port group.
Monitoring Policy on page 98 The monitoring policy enables or disables NetFlow monitoring on a distributed port or port group. Traffic Filtering and Marking Policy on page 99 In a vSphere distributed switch 5.5 and later, by using the traffic filtering and marking policy, you can protect the virtual network from unwanted traffic and security attacks or apply a QoS tag to a certain type of traffic.
Port Blocking Policies on page 115 Port blocking policies allow you to selectively block ports from sending or receiving data. Manage Policies for Multiple Port Groups on a vSphere Distributed Switch in the vSphere Web Client on page 116 You can modify networking policies for multiple port groups on a vSphere Distributed Switch.
VMware, Inc.
79
vSphere Networking
Teaming and Failover Policy

Teaming and failover policy lets you to determine how network traffic is distributed between physical adapters and how to reroute traffic in the event of adapter failure. You can edit your load balancing and failover policy by configuring the following parameters:
n
Load Balancing determines how outgoing traffic is distributed among the network adapters associated with a switch or port group. NOTE Incoming traffic is controlled by the load balancing policy on the physical switch.
Failover Detection controls the link status and beacon probing. Beaconing is not supported with guest VLAN tagging. Failover Order can be active or standby.
You might lose connectivity when a failover event occurs. This loss causes the MAC addresses used by virtual machines that are associated with standard or distributed switch to appear on a different physical switch port than the one they had been on previously. To avoid this problem, put your physical switch in Port Fast or Port Fast trunk mode.
Edit Teaming and Failover Policy for a vSphere Standard Switch in the vSphere Web Client
Use the teaming and failover policy to determine how network traffic of the virtual machines and VMkernel adapters that are connected to the switch is distributed between physical adapters and how to reroute traffic in the event of an adapter failure. Procedure 1 2 3 4 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a standard switch from the list, click Edit settings and select Teaming and Failover. From the Load Balancing drop-down menu, specify how the standard or distributed switch selects an uplink to handle traffic from a virtual machine or VMkernel adapter.
Option Route based on the originating virtual port Route based on IP hash Description Select an uplink based on the virtual port where the traffic entered the virtual switch. Select an uplink based on a hash of the source and destination IP addresses of each packet. For non-IP packets, the switch simply uses the data at those fields to compute the hash. IP-based teaming requires that the physical switch be configured with EtherChannel. Select an uplink based on a hash of the source Ethernet. From the list of active adapters, always use the highest order uplink that passes failover detection criteria.
Route based on source MAC hash Use explicit failover order
80
VMware, Inc.
Chapter 6 Networking Policies
From the Network Failover Detection drop-down menu, specify the method that the standard or distributed switch uses for failover detection.
Option Link Status only Description Relies only on the link status that the network adapter provides. This option detects failures, such as removed cables and physical switch power failures. However, it does not detect configuration errors, such as the following: n Physical switch port that is blocked by spanning tree or is misconfigured to the wrong VLAN. n Pulled cable that connects a physical switch to another networking devices, for example, an upstream switch. Sends out and listens for beacon probes on all NICs in the team and uses this information, in addition to link status, to determine link failure. ESX/ESXi sends beacon packets every 10 seconds. Beaconing is most useful with three or more NICs in a team because ESX/ESXi can detect failures of a single adapter. If only two NICs are assigned and one of them loses connectivity, the switch cannot determine which NIC needs to be taken out of service because both do not receive beacons and as a result all packets sent to both uplinks. Using at least three NICs in such a team allows for n-2 failures where n is the number of NICs in the team before reaching an ambiguous situation. The NICs must be in an active/active or active/standby configuration because the NICs in an unused state do not participate in beacon probing.
Beacon Probing
From the Notify Switches drop-down menu, select whether the standard or distributed switch notifies the physical switch in case of a failover. If you select Yes, whenever a virtual NIC is connected to the virtual switch or whenever that virtual NICs traffic is routed over a different physical NIC in the team because of a failover event, a notification is sent over the network to update the lookup tables on physical switches. Notifying the physical switch offers lowest latency when a failover or a migration with vSphere vMotion occurs. NOTE Set this option to No if a connected virtual machines is using Microsoft Network Load Balancing in unicast mode. No issues exist with Network Load Balancing running in multicast mode.
From the Failback drop-down menu, determine whether a physical adapter is returned to active status after recovering from a failure. If failback is set to Yes (default), the adapter is returned to active duty immediately upon recovery, displacing the standby adapter that took over its slot, if any. If failback is set to No to a standard port, a failed adapter is left inactive after recovery until another currently active adapter fails and must be replaced.
Specify how the uplinks in a team are used when a failover occurs by configuring the Failover Order list. If you want to use some uplinks but reserve others for emergencies in case the uplinks in use fail, use the up and down arrow keys to move them into different groups.
Option Active adapters Standby adapters Unused adapters Description Continue to use the uplink if the network adapter connectivity is up and active. Use this uplink if one of the active physical adapter is down. Do not use this uplink.
Click OK.
VMware, Inc.
81
vSphere Networking
Edit the Teaming and Failover Policy on a Standard Port Group in the vSphere Web Client
Configure the teaming and failover policy on a standard port group to determine how network traffic related to a group of virtual machines or a VMkernel adapter is distributed between physical adapters and how to reroute traffic in the event of a physical adapter failure. Procedure 1 2 3 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a standard switch from the list. The topology diagram of the switch appears. 4 5 6 In the topology diagram, select the port group and click Edit settings. On the Teaming and Failover page, to override the teaming and failover properties inherited from the standard switch, select the check boxes next to the properties that you want to override. From the Load Balancing drop-down menu, specify how the standard or distributed switch selects an uplink to handle traffic from a virtual machine or VMkernel adapter.
82
VMware, Inc.
Beacon Probing
From the Failback drop-down menu, determine whether a physical adapter is returned to active status after recovering from a failure. If failback is set to Yes (default), the adapter is returned to active duty immediately upon recovery, displacing the standby adapter that took over its slot, if any. If failback is set to No to a standard port, a failed adapter is left inactive after recovery until another currently active adapter fails and must be replaced.
10
11
Click OK.
VMware, Inc.
83
vSphere Networking
Edit the Teaming and Failover Policy on a Distributed Port Group in the vSphere Web Client
The teaming and failover policy on a distributed port group lets you determine how network traffic of a group of virtual machines or VMkernel adapters is distributed between the uplink adapters in a vSphere Distributed Switch and how to reroute traffic in the event of an adapter failure. Procedure 1 2 3 4 5 In the vSphere Web Client, navigate to the distributed switch. Right-click the distributed switch, and select Manage Distributed Port Groups. Select the Teaming and failover check box and click Next. Select the port group that you want to configure and click Next. From the Load Balancing drop-down menu, specify how the standard or distributed switch selects an uplink to handle traffic from a virtual machine or VMkernel adapter.
Beacon Probing
84
VMware, Inc.
From the Failback drop-down menu, determine whether a physical adapter is returned to active status after recovering from a failure. If failback is set to Yes (default), the adapter is returned to active duty immediately upon recovery, displacing the standby adapter that took over its slot, if any. If failback is set to No to a distributed port, a failed adapter is left inactive after recovery only if the associated virtual machine is running. If the Failback option is No and a virtual machine is powered off when all active physical adapters fail and then one of them recovers, after the virtual machine is powered on, the virtual NIC is connected to the recovered adapter instead of to a standby one. Powering a virtual machine off and then on leads to reconnecting the virtual NIC to a distributed port. The distributed switch considers the port as newly added, and assigns it the default uplink port, that is, the active uplink adapter.
10
Edit Distributed Port Teaming and Failover Policies with the vSphere Web Client
The teaming and failover policy lets you determine how network traffic is distributed between physical adapters and how traffic is rerouted in the event of an adapter failure. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 2 3 4 In the vSphere Web Client, navigate to the distributed switch. On the Manage tab, and select Ports. Select a distributed port from the list and click Edit distributed port settings. Click Teaming and failover and select the check box next to the properties that you want to override.
VMware, Inc.
85
vSphere Networking
From the Load Balancing drop-down menu, specify how the standard or distributed switch selects an uplink to handle traffic from a virtual machine or VMkernel adapter.
Beacon Probing
From the Failback drop-down menu, determine whether a physical adapter is returned to active status after recovering from a failure. If failback is set to Yes (default), the adapter is returned to active duty immediately upon recovery, displacing the standby adapter that took over its slot, if any.
86
VMware, Inc.
If failback is set to No to a distributed port, a failed adapter is left inactive after recovery only if the associated virtual machine is running. If the Failback option is No and a virtual machine is powered off when all active physical adapters fail and then one of them recovers, after the virtual machine is powered on, the virtual NIC is connected to the recovered adapter instead of to a standby one. Powering a virtual machine off and then on leads to reconnecting the virtual NIC to a distributed port. The distributed switch considers the port as newly added, and assigns it the default uplink port, that is, the active uplink adapter. 9 Specify how the uplinks in a team are used when a failover occurs by configuring the Failover Order list. If you want to use some uplinks but reserve others for emergencies in case the uplinks in use fail, use the up and down arrow keys to move them into different groups.
10
Click OK.
VLAN Policy
VLAN policies determine how VLANs function across your network environment. A virtual local area network (VLAN) is a group of hosts with a common set of requirements, which communicate as if they were attached to the same broadcast domain, regardless of their physical location. A VLAN has the same attributes as a physical local area network (LAN), but it allows for end stations to be grouped together even if not on the same network switch. The scope of VLAN policies can be distributed port groups and ports, and uplink port groups and ports.
Edit the VLAN Policy on a Distributed Port Group in the vSphere Web Client
Set the VLAN policy on a distributed port group to apply VLAN tagging globally on all distributed ports . Procedure 1 2 3 4 5 Browse to a distributed switch in the vSphere Web Client navigator. Right-click the distributed switch in the navigator and select Manage Distributed Port Groups. Select the VLAN check box and click Next. Select the port group that you want to edit and click Next. Select the type of VLAN traffic filtering and marking from the Type drop-down menu and click Next.
Option None VLAN Description Do not use VLAN. Use this option in case of External Switch Tagging (EST). Tag traffic with the ID from the VLAN ID field. Type a number between 1 and 4094 for Virtual Switch Tagging (VST). Type 4095 for Virtual Guest Tagging (VGT).
VMware, Inc.
87
vSphere Networking
Option VLAN Trunking
Description Pass VLAN traffic with ID within the VLAN trunk range. You can set multiple ranges and individual VLANs by using a comma-separated list. Use this option in VGT. Associate the traffic with a private VLAN created on the distributed switch.
Private VLAN
Edit the VLAN Policy on a Distributed Port with the vSphere Web Client
Use the VLAN policy on a distributed port to integrate the virtual traffic through the port with physical VLANs in a different way from the parent distributed port group. Prerequisites To override the VLAN policy at the port level, enable the port-level overrides. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46 Procedure 1 2 3 4 5 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab and select Ports. Select a port from the list. Click Edit distributed port settings. Click VLAN and select Override. Configure VLAN traffic through the distributed port from the VLAN Type drop-down meny.
Option None VLAN Description Do not use VLAN. Use this option in case of External Switch Tagging (EST). Tag traffic with the ID from the VLAN ID field. Type a number between 1 and 4094 for Virtual Switch Tagging (VST). Type 4095 for Virtual Guest Tagging (VGT). Pass VLAN traffic with ID within the VLAN trunk range. You can set multiple ranges and individual VLANs by using a comma-separated list. Use this option in VGT. Associate the traffic with a private VLAN created on the distributed switch.
VLAN Trunking
Private VLAN
Click OK.
Edit the VLAN Policy on an Uplink Port Group in the vSphere Web Client
Set the VLAN policy on an uplink port group to configure VLAN traffic processing generally for all member uplinks. Use the VLAN policy at the uplink port level to propagate a trunk range of VLAN IDs to the physical network adapters for traffic filtering. The physical network adapters drop the packets from the other VLANs if the adapters support filtering by VLAN. Setting a trunk range improves networking performance because physical network adapters filter traffic instead of the uplink ports in the group. If you have a physical network adapter which does not support VLAN filtering, the VLANs might still not be blocked. In this case, configure VLAN filtering on a distributed port group or on a distributed port.
88
VMware, Inc.
See the technical documentation from the adapter vendors for information about VLAN filtering support. Procedure 1 Locate an uplink port group in the vSphere Web Client. a b 2 3 To locate an uplink port group, select a distributed switch and click the Related Objects tab. Select the Uplink Port Groups tab and locate the uplink group in the list.
Right-click the uplink port group in the list and select Edit Settings. Click VLAN and type a VLAN trunk range to propagate to the physical network adapters. For trunking of several ranges and individual VLANs, separate the entries with commas.
Click OK.
Edit the VLAN Policy on an Uplink Port with the vSphere Web Client
Set the VLAN policy on an uplink port to handle VLAN traffic through the port in a different way than for the parent uplink port group. Use the VLAN policy at the uplink port to propagate a trunk range of VLAN IDs to the physical network adapter for traffic filtering. The physical network adapter drops packets from the other VLANs if the adapter supports filtering by VLAN. Setting a trunk range improves networking performance because the physical network adapter filters traffic instead of the uplink port. If you have a physical network adapter which does not support VLAN filtering, the VLANs might still not be blocked. In this case, configure VLAN filtering on a distributed port group or on a distributed port. See the technical documentation from the adapter vendor for information about VLAN filtering support. Prerequisites To override the VLAN policy at the port level, enable the port-level overrides. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 Locate an uplink port group in the vSphere Web Client. a b To locate an uplink port group, select a distributed switch and click the Related Objects tab. Select the Uplink Port Groups tab and double-click an uplink port group from the list. The uplink port group appears at the top level of the navigator on the left. 2 3 4 5 Click the Manage tab and select Ports. Select an uplink port from the list and click Edit distributed port settings. Click VLAN and select the Override check box. Type a VLAN trunk range to propagate to the physical network adapter. For trunking of several ranges and individual VLANs, separate the entries with commas. 6 Click OK.
VMware, Inc.
89
vSphere Networking
Security Policy
Networking security policy provides protection of traffic against MAC address impersonation and unwanted port scanning The security policy of a standard or distributed switch is implemented in Layer 2 (Data Link Layer) of the network protocol stack. The three elements of the security policy are promiscuous mode, MAC address changes, and forged transmits. See the vSphere Security documentation for information about potential networking threats.
Edit Security Policy for a vSphere Standard Switch in the vSphere Web Client
For a vSphere standard switch you can configure security policy to reject MAC address and promiscuous mode changes in the guest operating system of a virtual machine. You can configure security policy for an individual standard port group as well. Procedure 1 2 3 4 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a standard switch from the list and click Edit settings. Select Security, and reject or accept promiscuous mode activation or MAC address changes in the guest operating system of the virtual machines attached to the standard switch. By default, enabling promiscuous mode and MAC address changes for both inbound and outbound traffic is not accepted.
Option Promiscuous mode Description
n
Reject: Placing an adapter in promiscuous mode from the guest operating system does not result in receiving frames for other virtual machines. Accept: If an adapter is placed in promiscuous mode from the guest operating system, the switch allows the guest adapter to receive all frames passed on the switch in compliance with the active VLAN policy for the port to which the adapter is connected. Firewalls, port scanners, intrusion detection systems and so on, need to run in promiscuous mode.
MAC address changes
Reject: If you set the MAC Address Changes to Reject and the guest operating system changes the MAC address of the adapter to a value different from the address in the virtual machine configuration file (.vmx), the switch drops all inbound frames to the virtual machine adapter. If the guest operating system changes the MAC address back, the virtual machine receives frames again. Accept: If the guest operating system changes the MAC address of a network adapter, the switch allows frames to the new address of the adapter to pass. Reject: The switch drops any outbound frame from a virtual machine adapter with a source MAC address that is different from the one in the .vmx configuration file. Accept: The switch does not perform filtering and permits all outbound frames.
Forged transmits
Click OK.
90
VMware, Inc.
Edit the Layer 2 Security Policy Exception for a Standard Port Group in the vSphere Web Client
By using the security policy on a port group you can accept or reject promiscuous mode and MAC address changes in the guest operating system of a virtual machine connected to the group. Procedure 1 2 3 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a standard switch from the list. The topology diagram of the standard switch appears. 4 5 6 In the topology diagram of the standard switch, click the name of the standard port group to configure. Click Edit settings. In the Security section, select the check boxes next to the security policies to override and use the dropdown menus to configure security over the virtual machine traffic through the ports of the group. By default, enabling promiscuous mode and MAC address changes for both inbound and outbound traffic is not accepted.
n
MAC address changes
Forged transmits
Click OK.
Edit the Security Policy for a Distributed Port Group in the vSphere Web Client
You can set a security policy on a distributed port group to allow or reject enabling promiscuous mode and MAC address changes from the guest operating system of a virtual machine associated with the port group. You can configure security policy for an individual distributed port as well.
VMware, Inc.
91
vSphere Networking
Procedure 1 2 3 4 5 Navigate to a distributed switch in the vSphere Web Client . Right-click the distributed switch and select Manage Distributed Port Groups. Click the Security check box and click Next. Select the distributed port group to configure and click Next. Use the drop-down menus to edit the security settings on the traffic through the ports of the group, and click Next. By default, enabling promiscuous mode and MAC address changes for both inbound and outbound traffic is not accepted.
n
MAC address changes
Forged transmits
Edit Distributed Port Security Policies with the vSphere Web Client
On a distributed port you can override the policy inherited from the distributed port group to accept or reject enabling promiscuous mode and MAC address changes in the guest operating system of the virtual machine connected to the port. Prerequisites Enable port-level overrides. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46 Procedure 1 2 3 Navigate to a distributed switch in the vSphere Web Client. Click the Manage tab, and select Ports. Select a port from the list.
92
VMware, Inc.
4 5
Click Edit distributed port settings. Click Security and select the check box for the settings you want to override for the traffic through the port. By default, enabling promiscuous mode and MAC address changes for both inbound and outbound traffic is not accepted.
n
MAC address changes
Forged transmits
Click OK.
Traffic Shaping Policy

A traffic shaping policy is defined by average bandwidth, peak bandwidth, and burst size. You can establish a traffic shaping policy for each port group and each distributed port or distributed port group. ESXi shapes outbound network traffic on standard switches and inbound and outbound traffic on distributed switches. Traffic shaping restricts the network bandwidth available on a port, but can also be configured to allow bursts of traffic to flow through at higher speeds. Average Bandwidth Peak Bandwidth Establishes the number of bits per second to allow across a port, averaged over time. This number is the allowed average load. Maximum number of bits per second to allow across a port when it is sending or receiving a burst of traffic. This number limits the bandwidth that a port uses when it is using its burst bonus. Maximum number of bytes to allow in a burst. If this parameter is set, a port might gain a burst bonus if it does not use all its allocated bandwidth. When the port needs more bandwidth than specified by the average bandwidth, it might be allowed to temporarily transmit data at a higher speed if a burst bonus is available. This parameter limits the number of bytes that have accumulated in the burst bonus and transfers traffic at a higher speed.
Burst Size
VMware, Inc.
93
vSphere Networking
Edit the Traffic Shaping Policy for a vSphere Standard Switch in the vSphere Web Client
ESXi lets you to shape outbound traffic on standard switches. The traffic shaper restricts the network bandwidth available to any port, but you can also configure it to temporarily allow bursts of traffic to flow through a port at higher speeds. A traffic shaping policy is defined by three characteristics: average bandwidth, peak bandwidth, and burst size. Average Bandwidth Peak Bandwidth Establishes the number of bits per second to allow across a port, averaged over time (the allowed average load). The maximum number of bits per second to allow across a port when it is sending a burst of traffic. This tops the bandwidth used by a port whenever it is using its burst bonus. This parameter can never be smaller than the average bandwidth. The maximum number of bytes to allow in a burst. If this parameter is set, a port might gain a burst bonus when it does not use all its allocated bandwidth. Whenever the port needs more bandwidth than specified by Average Bandwidth, it might be allowed to temporarily transmit data at a higher speed if a burst bonus is available. This parameter tops the number of bytes that can be accumulated in the burst bonus and transferred at a higher speed.
Burst Size
Procedure 1 2 3 4 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a standard switch from the list and click Edit settings. Click Traffic shaping and enable or disable traffic shaping policy exceptions with the Status dropdown menu. The Status policy is applied to each VMkernel adapter or virtual machine network adapter attached to the port group, not to the standard switch as a whole. If you enable the traffic policy exception, you set limits on the amount of networking bandwidth allocation for each VMkernel adapter of virtual machine network adapter associated with this particular port group. If you disable the policy, services have a clear connection to the physical network by default. 5 6 For each traffic shaping policy (Average Bandwidth, Peak Bandwidth, and Burst Size), enter a bandwidth value. Click OK.
Edit the Traffic Shaping Policy for a Standard Port Group in the vSphere Web Client
Use traffic shaping policies to control the bandwidth and burst size on a port group. Prerequisites Enable the port-level overrides. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46 Procedure 1 Browse to a host in the vSphere Web Client navigator.
94
VMware, Inc.
2 3
Click the Manage tab, and click Networking > Virtual Switches. Select a standard switch from the list. A schematic of the standard switch infrastructure appears.
4 5
Click Edit settings. Click Traffic Shaping and click the Override check box to override the traffic shaping policy at the standard port group level and enter settings. NOTE If you have not enabled port group-level overrides, the options are not available.
Option Status Description If you enable the policy exception in the Status field, you are setting limits on the amount of networking bandwidth allocated for each virtual adapter associated with this particular port group. If you disable the policy, services have a free and clear connection to the physical network. A value measured over a particular period of time. Limits the maximum bandwidth during a burst. It can never be smaller than the average bandwidth. Specifies how large a burst can be in kilobytes (KB).
Average Bandwidth Peak Bandwidth Burst Size
Click OK.
Edit the Traffic Shaping Policy on a Distributed Port Group in the vSphere Web Client
ESXi allows you to shape both inbound and outbound traffic on vSphere distributed port groups. The traffic shaper restricts the network bandwidth available to any port in the group, but might also be configured to temporarily allow bursts of traffic to flow through a port at higher speeds. A traffic shaping policy is defined by three characteristics: average bandwidth, peak bandwidth, and burst size. Procedure 1 2 3 4 5 Browse to a distributed switch in the vSphere Web Client navigator. Right-click the distributed switch in the navigator and select Manage Distributed Port Groups. Select the Traffic Shaping check box and click Next. On the Select port groups page, select a port group from the list and click Next Click Traffic shaping, and select the Override check box to override ingress traffic shaping, egress traffic shaping, or both. NOTE The traffic is classified to ingress and egress according to the traffic direction in the switch, not in the host.
Option Status Description If you enable either Ingress Traffic Shaping or Egress Traffic Shaping by using the Status drop-down menus, you are setting limits on the amount of networking bandwidth allocated for each VMkernel adapter or virtual network adapter associated with this particular port group. If you disable the policy, services have a free, clear connection to the physical network by default. Establishes the number of bits per second to allow across a port, averaged over time, that is, the allowed average load.
Average Bandwidth
VMware, Inc.
95
vSphere Networking
Option Peak Bandwidth
Description The maximum number of bits per second to allow across a port when it is sending or receiving a burst of traffic. This parameter tops the bandwidth used by a port whenever it is using its burst bonus. The maximum number of bytes to allow in a burst. If this parameter is set, a port might gain a burst bonus when it does not use all its allocated bandwidth. Whenever the port needs more bandwidth than specified by Average Bandwidth, it might be allowed to temporarily transmit data at a higher speed if a burst bonus is available. This parameter tops the number of bytes that might be accumulated in the burst bonus and transferred at a higher speed.
Burst Size
Review your settings and click Finish. Use the Back button to edit any settings.
Edit the Traffic Shaping Policy on a Distributed Port in the vSphere Web Client
ESXi allows you to shape both inbound and outbound traffic on vSphere distributed switches. The traffic shaper restricts the network bandwidth available to a port, but might also be configured to temporarily allow bursts of traffic to flow through the port at higher speeds. A traffic shaping policy is defined by three characteristics: average bandwidth, peak bandwidth, and burst size. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 2 3 4 5 Browse to a distributed switch in the vSphere Web Client. To navigate to the distributed ports of the distributed switch, click Manage > Ports. Select a port from the list. Click Edit distributed port settings. Click Traffic shaping, and select the Override check box to override ingress traffic shaping, egress traffic shaping, or both. NOTE The traffic is classified to ingress and egress according to the traffic direction in the switch, not in the host.
Option Status Description If you enable either Ingress Traffic Shaping or Egress Traffic Shaping by using the Status drop-down menus, you are setting limits on the amount of networking bandwidth allocated for each VMkernel adapter or virtual network adapter associated with this particular port group. If you disable the policy, services have a free, clear connection to the physical network by default. Establishes the number of bits per second to allow across a port, averaged over time, that is, the allowed average load.
Average Bandwidth
96
VMware, Inc.
Option Peak Bandwidth
Description The maximum number of bits per second to allow across a port when it is sending or receiving a burst of traffic. This parameter tops the bandwidth used by a port whenever it is using its burst bonus. The maximum number of bytes to allow in a burst. If this parameter is set, a port might gain a burst bonus when it does not use all its allocated bandwidth. Whenever the port needs more bandwidth than specified by Average Bandwidth, it might be allowed to temporarily transmit data at a higher speed if a burst bonus is available. This parameter tops the number of bytes that might be accumulated in the burst bonus and transferred at a higher speed.
Burst Size
Review your settings in the Ready to complete section and click Finish. Use the Back button to edit any settings.
Resource Allocation Policy

The Resource Allocation policy allows you to associate a distributed port or port group with a user-created network resource pool. This policy provides you with greater control over the bandwidth given to the port or port group. For information about creating and configuring network resource pools, see vSphere Network I/O Control, on page 123.
Edit the Resource Allocation Policy on a Distributed Port Group in the vSphere Web Client
Associate a distributed port group with a network resource pool to give you greater control over the bandwidth that is given to the distributed port group. Prerequisites Enable Network I/O Control on the host and create one or more user-defined network resource pools. Procedure 1 2 3 4 5 Browse to a distributed switch in the vSphere Web Client navigator. Right-click the distributed switch in the navigator and select Manage Distributed Port Groups. Select the Resource allocation check box and click Next. Select the distributed port group to edit and click Next. Add or remove the distributed port group from the network resource pool and click Next.
n
To add the distributed port group, select a user-defined resource pool from the Network resource pool drop-down menu. To remove the distributed port group, select default from the Network resource pool drop-down menu.
Review your settings in the Ready to complete section and click Finish. Use the Back button to change any settings.
VMware, Inc.
97
vSphere Networking
Edit the Resource Allocation Policy on a Distributed Port in the vSphere Web Client
Associate a distributed port with a network resource pool to give you greater control over the bandwidth given to the port. Prerequisites
n n
Enable Network I/O Control on the host and create one or more user-defined network resource pools. Enable port-level overrides. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46.
Procedure 1 2 3 4 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab and click Ports. Select a port from the list and click Edit distributed port settings. In the Properties section, click the Override check box and add or remove the port from a network resource pool. If you did not enable port-level overrides, the options are not available.
n
To add the distributed port to a resource pool, select a user-defined resource pool from the Network resource pool drop-down menu. To remove the distributed port from a resource pool, select Default from the Network resource pool drop-down menu.
Click OK.
Monitoring Policy
The monitoring policy enables or disables NetFlow monitoring on a distributed port or port group. NetFlow settings are configured at the vSphere distributed switch level. See Configure NetFlow Settings with the vSphere Web Client, on page 161.
Edit the Monitoring Policy on a Distributed Port Group in the vSphere Web Client
With the Monitoring policy, you can enable or disable NetFlow monitoring on a distributed port group. Procedure 1 2 3 4 Browse to a distributed switch in the vSphere Web Client navigator. Right-click the distributed switch in the object navigator and select Manage Distributed Port Groups. Select the Monitoring check box and click Next. Select the distributed port group to edit and click Next.
98
VMware, Inc.
Use the drop-menu to enable or disable NetFlow and click Next.

Option Disabled Enabled Description NetFlow is disabled on the distributed port group. NetFlow is enabled on the distributed port group. You can configure NetFlow settings at the vSphere distributed switch level. See Configure NetFlow Settings with the vSphere Web Client, on page 161.
Review your settings and click Finish. Use the Back button to change any settings.
Edit the Monitoring Policy on a Distributed Port in the vSphere Web Client
With the Monitoring policy, you can enable or disable NetFlow monitoring on a distributed port. Prerequisites To override the monitoring policy at the port level, enable the port-level overrides. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46 Procedure 1 2 3 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and click Ports. Select a port from the list. Detailed port setting information appears at the bottom of the screen. 4 5 6 Click Edit distributed port settings. Click Monitoring and click the check box to override the NetFlow settings at the port group level. Enable or disable Netflow from the drop-down menu. NOTE If you have no enabled port-level overrides, the options are not available.
Option Disabled Enabled Description NetFlow is disabled on the distributed port group. NetFlow is enabled on the distributed port group. You can configure NetFlow settings at the vSphere distributed switch level. See Configure NetFlow Settings with the vSphere Web Client, on page 161.
Click OK.
Traffic Filtering and Marking Policy

In a vSphere distributed switch 5.5 and later, by using the traffic filtering and marking policy, you can protect the virtual network from unwanted traffic and security attacks or apply a QoS tag to a certain type of traffic. The traffic filtering and marking policy represents an ordered set of network traffic rules for security and for QoS tagging of the data flow through the ports of a distributed switch. In general, a rule consists of a qualifier for traffic, and of an action for restricting or prioritizing the matching traffic. The vSphere distributed switch applies rules on traffic at different places in the data stream. The distributed switch applies traffic filter rules on the data path between the virtual machine network adapter and distributed port, or between the uplink port and physical network adapter for rules on uplinks.
VMware, Inc.
99
vSphere Networking
Traffic Filtering and Marking on a Distributed Port Group or Uplink Port Group in the vSphere Web Client
Set traffic rules at the level of distributed port groups or of uplink port groups to introduce filtering and priority tagging for traffic access over virtual machines, VMkernel adapters, or physical adapters.
n
Enable Traffic Filtering and Marking on a Distributed Port Group or Uplink Port Group in the vSphere Web Client on page 100 Enable the traffic filtering and marking policy on a port group if you want to configure traffic security and marking on all virtual machine network adapters or uplink adapters that are participating in the group.
Mark Traffic on a Distributed Port Group or Uplink Port Group in the vSphere Web Client on page 101 Assign priority tags to traffic, such as VoIP and streaming video, that has higher networking requirements for bandwidth, low latency, and so on. You can mark the traffic with a CoS tag in Layer 2 of the network protocol stack or with a DSCP tag in Layer 3.
Filter Traffic on a Distributed Port Group or Uplink Port Group in the vSphere Web Client on page 103 Allow or stop traffic for securing the data that flows through the ports of a distributed port group or uplink port group.
Working with Network Traffic Rules on a Distributed Port Group or Uplink Port Group in the vSphere Web Client on page 104 Define traffic rules in a distributed port group or uplink port group to introduce a policy for processing traffic related to virtual machines or to physical adapters. You can filter specific traffic or describe its QoS demands.
Disable Traffic Filtering and Marking on a Distributed Port Group or Uplink Port Group in the vSphere Web Client on page 106 Let traffic flow to virtual machines or physical adapters without additional control related to security or QoS by disabling the traffic filtering and marking policy.
Enable Traffic Filtering and Marking on a Distributed Port Group or Uplink Port Group in the vSphere Web Client
Enable the traffic filtering and marking policy on a port group if you want to configure traffic security and marking on all virtual machine network adapters or uplink adapters that are participating in the group. NOTE You can disable the traffic filtering and marking policy on a particular port to avoid processing the traffic flowing through the port. See Disable Traffic Filtering and Marking on a Distributed Port or Uplink Port in the vSphere Web Client, on page 112. Procedure 1 Locate a distributed port group or an uplink port group in the vSphere Web Client. a b 2 3 4 Select a distributed switch and click the Related Objects tab. Click Distributed Port Groups to see the list of distributed port groups, or click Uplink Port Groups to see the list of uplink port groups.
Right-click the port group and select Edit settings. Select Traffic filtering and marking. From the Status drop-down menu, select Enabled.
100
VMware, Inc.
Click OK.
What to do next Set up traffic marking or filtering on the data that is flowing through the ports of the distributed port group or through the uplink port group. See Mark Traffic on a Distributed Port Group or Uplink Port Group in the vSphere Web Client, on page 101 and Filter Traffic on a Distributed Port Group or Uplink Port Group in the vSphere Web Client, on page 103.
Mark Traffic on a Distributed Port Group or Uplink Port Group in the vSphere Web Client
Assign priority tags to traffic, such as VoIP and streaming video, that has higher networking requirements for bandwidth, low latency, and so on. You can mark the traffic with a CoS tag in Layer 2 of the network protocol stack or with a DSCP tag in Layer 3. Priority tagging is a mechanism to mark traffic that has higher QoS demands. In this way, the network can recognize different classes of traffic. The network devices can handle the traffic from each class according to its priority and requirements. You can also re-tag traffic to either raise or lower the importance of the flow. By using a low QoS tag, you can restrict data tagged in a guest operating system. Procedure 1 Locate a distributed port group or an uplink port group in the vSphere Web Client. a b 2 3 4 5 6 7 Select a distributed switch and click the Related Objects tab. Click Distributed Port Groups to see the list of distributed port groups, or click Uplink Port Groups to see the list of uplink port groups.
Right-click the port group and select Edit settings. Select Traffic filtering and marking. If traffic filtering and marking is disabled, enable it from the Status drop-down menu. Click New to create a new rule, or select a rule and click Edit to edit it. In the network traffic rule dialog box, select the Tag option from the Action drop-down menu. Set the priority tag for the traffic within the scope of the rule.
Option CoS value DSCP value Description Mark the traffic matching the rule with a CoS priority tag in network Layer 2. Select Update CoS tag and type a value from 0 to 7. Mark the traffic associated with the rule with a DSCP tag in network Layer 3. Select Update DSCP value and type a value from 0 to 63.
VMware, Inc.
101
vSphere Networking
Specify the kind of traffic that the rule is applicable to. To determine if a data flow is in the scope of a rule for marking or filtering, the vSphere distributed switch examines the direction of the traffic, and properties like source and destination, VLAN, next level protocol, infrastructure traffic type, and so on. a From the Traffic direction drop-down menu, select whether the traffic must be ingress, egress, or both so that the rule recognizes it as matching. The direction also influences how you are going to identify the traffic source and destination. b By using qualifiers for system data type, Layer 2 packet attributes, and Layer 3 packet attributes set the properties that packets must have to match the rule. A qualifier represents a set of matching criteria related to a networking layer. You can match traffic to system data type, Layer 2 traffic properties, and Layer 3 traffic properties. You can use the qualifier for a specific networking layer or can combine qualifiers to match packets more precisely.
n
Use the system traffic qualifier to match packets to the type of virtual infrastructure data that is flowing through the ports of the group . For example, you can select NFS for data transfers to network storage. Use the MAC traffic qualifier to match packets by MAC address, VLAN ID, and next level protocol. Locating traffic with a VLAN ID on a distributed port group works with Virtual Guest Tagging (VGT). To match traffic to VLAN ID if Virtual Switch Tagging (VST) is active, use a rule on an uplink port group or uplink port.
Use the IP traffic qualifier to match packets by IP version, IP address, and next level protocol and port.
In the rule dialog box, click OK to save the rule.
Example: Voice over IP Traffic Marking Voice over IP (VoIP) flows have special requirements for QoS in terms of low loss and delay. The traffic related to the Session Initiation Protocol (SIP) for VoIP usually has a DSCP tag equal to 26, which stands for Assured Forwarding Class 3 with Low Drop Probability (AF31). For example, to mark outgoing SIP UDP packets to a subnet 192.168.2.0/24, you can use the following rule:
Rule Parameter Action DSCP value Traffic direction Traffic qualifiers Protocol Destination port Source address Parameter Value Tag 26 Egress IP Qualifier UDP 5060 IP address matches 192.168.2.0 with prefix length 24
102
VMware, Inc.
Filter Traffic on a Distributed Port Group or Uplink Port Group in the vSphere Web Client
Allow or stop traffic for securing the data that flows through the ports of a distributed port group or uplink port group. Procedure 1 Locate a distributed port group or an uplink port group in the vSphere Web Client. a b 2 3 4 5 6 7 Select a distributed switch and click the Related Objects tab. Click Distributed Port Groups to see the list of distributed port groups, or click Uplink Port Groups to see the list of uplink port groups.
Right-click the port group and select Edit settings. Select Traffic filtering and marking. If traffic filtering and marking is disabled, enable it from the Status drop-down menu. Click New to create a new rule, or select a rule and click Edit to edit it. In the network traffic rule dialog box, use the Action options to let traffic pass through the ports of the distributed port group or uplink port group, or to restrict it. Specify the kind of traffic that the rule is applicable to. To determine if a data flow is in the scope of a rule for marking or filtering, the vSphere distributed switch examines the direction of the traffic, and properties like source and destination, VLAN, next level protocol, infrastructure traffic type, and so on. a From the Traffic direction drop-down menu, select whether the traffic must be ingress, egress, or both so that the rule recognizes it as matching. The direction also influences how you are going to identify the traffic source and destination. b By using qualifiers for system data type, Layer 2 packet attributes, and Layer 3 packet attributes set the properties that packets must have to match the rule. A qualifier represents a set of matching criteria related to a networking layer. You can match traffic to system data type, Layer 2 traffic properties, and Layer 3 traffic properties. You can use the qualifier for a specific networking layer or can combine qualifiers to match packets more precisely.
n
VMware, Inc.
103
vSphere Networking
Working with Network Traffic Rules on a Distributed Port Group or Uplink Port Group in the vSphere Web Client
Define traffic rules in a distributed port group or uplink port group to introduce a policy for processing traffic related to virtual machines or to physical adapters. You can filter specific traffic or describe its QoS demands. NOTE You can override the rules of the policy for traffic filtering and marking at port level. See Working with Network Traffic Rules on a Distributed Port or Uplink Port in the vSphere Web Client, on page 110.
n
View Traffic Rules on a Distributed Port Group or Uplink Group in the vSphere Web Client on page 104 View the traffic rules that form the traffic filtering and marking policy of a distributed port group or uplink port group.
Edit a Traffic Rule on a Distributed Port Group or Uplink Port Group in the vSphere Web Client on page 105 Create or edit traffic rules, and use their parameters to configure a policy for filtering or marking the traffic on a distributed port group or uplink port group.
Change Rule Priorities on a Distributed Port Group or Uplink Port Group in the vSphere Web Client on page 105 Reorder the rules that form the traffic filtering and marking policy of a distributed port group or uplink port group to change the sequence of actions for processing traffic.
Delete a Traffic Rule on a Distributed Port Group or Uplink Port Group in the vSphere Web Client on page 105 Delete a traffic rule on a distributed port group or uplink port group to stop processing packets flowing to virtual machines or physical adapters in a specific way.
View Traffic Rules on a Distributed Port Group or Uplink Group in the vSphere Web Client View the traffic rules that form the traffic filtering and marking policy of a distributed port group or uplink port group. Procedure 1 Locate a distributed port group or an uplink port group in the vSphere Web Client. a b 2 3 4 5 6 Select a distributed switch and click the Related Objects tab. Click Distributed Port Groups to see the list of distributed port groups, or click Uplink Port Groups to see the list of uplink port groups.
Right-click the port group and select Edit settings. Select Traffic filtering and marking. If traffic filtering and marking is disabled, enable it from the Status drop-down menu. Examine Action to see if the rule filters traffic (Allow or Deny) or marks traffic (Tag) with special QoS demands. From the upper list, select the rule for which you want to view the criteria for locating traffic. The traffic qualifying parameters of the rule appear in the Traffic Qualifiers list.
104
VMware, Inc.
Edit a Traffic Rule on a Distributed Port Group or Uplink Port Group in the vSphere Web Client Create or edit traffic rules, and use their parameters to configure a policy for filtering or marking the traffic on a distributed port group or uplink port group. Procedure 1 Locate a distributed port group or an uplink port group in the vSphere Web Client. a b 2 3 4 5 Select a distributed switch and click the Related Objects tab. Click Distributed Port Groups to see the list of distributed port groups, or click Uplink Port Groups to see the list of uplink port groups.
Right-click the port group and select Edit settings. Select Traffic filtering and marking. If traffic filtering and marking is disabled, enable it from the Status drop-down menu. Click New to create a new rule, or select a rule and click Edit to edit it.
What to do next Name the network traffic rule, and deny, allow, or tag the target traffic. Change Rule Priorities on a Distributed Port Group or Uplink Port Group in the vSphere Web Client Reorder the rules that form the traffic filtering and marking policy of a distributed port group or uplink port group to change the sequence of actions for processing traffic. The vSphere distributed switch applies network traffic rules in a strict order. If a packet already satisfies a rule, the packet might not be passed to the next rule in the policy. Procedure 1 Locate a distributed port group or an uplink port group in the vSphere Web Client. a b 2 3 4 5 6 Select a distributed switch and click the Related Objects tab. Click Distributed Port Groups to see the list of distributed port groups, or click Uplink Port Groups to see the list of uplink port groups.
Right-click the port group and select Edit settings. Select Traffic filtering and marking. If traffic filtering and marking is disabled, enable it from the Status drop-down menu. Select a rule and use the arrow buttons to change its priority. Click OK to apply the changes.
Delete a Traffic Rule on a Distributed Port Group or Uplink Port Group in the vSphere Web Client Delete a traffic rule on a distributed port group or uplink port group to stop processing packets flowing to virtual machines or physical adapters in a specific way. Procedure 1 Locate a distributed port group or an uplink port group in the vSphere Web Client. a b 2 Select a distributed switch and click the Related Objects tab. Click Distributed Port Groups to see the list of distributed port groups, or click Uplink Port Groups to see the list of uplink port groups.
Right-click the port group and select Edit settings.
VMware, Inc.
105
vSphere Networking
3 4 5 6
Select Traffic filtering and marking. If traffic filtering and marking is disabled, enable it from the Status drop-down menu. Select the rule and click Delete. Click OK.
Disable Traffic Filtering and Marking on a Distributed Port Group or Uplink Port Group in the vSphere Web Client
Let traffic flow to virtual machines or physical adapters without additional control related to security or QoS by disabling the traffic filtering and marking policy. NOTE You can enable and set up the traffic filtering and marking policy on a particular port. See Enable Traffic Filtering and Marking on a Distributed Port or Uplink Port in the vSphere Web Client, on page 107. Procedure 1 Locate a distributed port group or an uplink port group in the vSphere Web Client. a b 2 3 4 5 Select a distributed switch and click the Related Objects tab. Click Distributed Port Groups to see the list of distributed port groups, or click Uplink Port Groups to see the list of uplink port groups.
Right-click the port group and select Edit settings. Select Traffic filtering and marking. From the Status drop-down menu, select Disabled. Click OK.
Traffic Filtering and Marking on a Distributed Port or Uplink Port in the vSphere Web Client
Filter traffic or describe its QoS demands for an individual virtual machine, VMkernel adapter, or physical adapter by configuring the traffic filtering and marking policy on a distributed port or uplink port.
n
Enable Traffic Filtering and Marking on a Distributed Port or Uplink Port in the vSphere Web Client on page 107 Enable the traffic filtering and marking policy on a port to configure traffic security and marking on a virtual machine network adapter, VMkernel adapter, or uplink adapter.
Mark Traffic on a Distributed Port or Uplink Port in the vSphere Web Client on page 107 Assign priority tags in a rule for traffic that needs special treatment such as VoIP and streaming video. You can mark the traffic for a virtual machine, VMkernel adapter, or physical adapter with a CoS tag in Layer 2 of the network protocol stack or with a DSCP tag in Layer 3.
Filter Traffic on a Distributed Port or Uplink Port in the vSphere Web Client on page 109 By using a rule, permit or stop traffic for securing data flows through a virtual machine, a VMkernel adapter, or a physical adapter.
Working with Network Traffic Rules on a Distributed Port or Uplink Port in the vSphere Web Client on page 110 Define traffic rules in a distributed port or uplink port group to introduce a policy for processing traffic related to a virtual machine or to a physical adapter. You can filter specific traffic or describe its QoS demands.
106
VMware, Inc.
Disable Traffic Filtering and Marking on a Distributed Port or Uplink Port in the vSphere Web Client on page 112 Disable the traffic filtering and marking policy on a port to let traffic flow to a virtual machine or a physical adapter without filtering for security or marking for QoS.
Enable Traffic Filtering and Marking on a Distributed Port or Uplink Port in the vSphere Web Client
Enable the traffic filtering and marking policy on a port to configure traffic security and marking on a virtual machine network adapter, VMkernel adapter, or uplink adapter. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 2 Browse to a distributed switch in the vSphere Web Client. Navigate to a distributed port or an uplink port.
n n
To navigate to the distributed ports of the switch, click Manage > Ports. To navigate to the uplink ports of an uplink port group, click Related Objects > Uplink Port Groups, double-click an uplink port group from the list, and select Ports on the Manage tab.
3 4 5 6 7
Select a port from the list. Click Edit distributed port settings. Select Traffic filtering and marking. Select the Override check box, and from the Status drop-down menu, select Enabled. Click OK.
What to do next Set up traffic filtering or marking for the data flowing through the distributed port or through the uplink port. See Mark Traffic on a Distributed Port or Uplink Port in the vSphere Web Client, on page 107 and Filter Traffic on a Distributed Port or Uplink Port in the vSphere Web Client, on page 109.
Mark Traffic on a Distributed Port or Uplink Port in the vSphere Web Client
Assign priority tags in a rule for traffic that needs special treatment such as VoIP and streaming video. You can mark the traffic for a virtual machine, VMkernel adapter, or physical adapter with a CoS tag in Layer 2 of the network protocol stack or with a DSCP tag in Layer 3. Priority tagging is a mechanism to mark traffic that has higher QoS demands. In this way, the network can recognize different classes of traffic. The network devices can handle the traffic from each class according to its priority and requirements. You can also re-tag traffic to either raise or lower the importance of the flow. By using a low QoS tag, you can restrict data tagged in a guest operating system. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46.
VMware, Inc.
107
vSphere Networking
Procedure 1 Navigate to a distributed port or an uplink port.

n n
2 3 4 5
Select a port from the list. Click Edit distributed port settings. If traffic filtering and marking is not enabled at the port level, click Override, and from the Status dropdown menu, select Enabled. Click New to create a new rule, or select a rule and click Edit to edit it. You can change a rule inherited from the distributed port group or uplink port group. In this way, the rule becomes unique within the scope of the port.
6 7
In the network traffic rule dialog box, select the Tag option from the Action drop-down menu. Set the priority tag for the traffic within the scope of the rule.
Option CoS value DSCP value Description Mark the traffic matching the rule with a CoS priority tag in network Layer 2. Select Update CoS tag and type a value from 0 to 7. Mark the traffic associated with the rule with a DSCP tag in network Layer 3. Select Update DSCP value and type a value from 0 to 63.
Specify the kind of traffic that the rule is applicable to. To determine if a data flow is in the scope of a rule for marking or filtering, the vSphere distributed switch examines the direction of the traffic, and properties like source and destination, VLAN, next level protocol, infrastructure traffic type, and so on. a From the Traffic direction drop-down menu, select whether the traffic must be ingress, egress, or both so that the rule recognizes it as matching. The direction also influences how you are going to identify the traffic source and destination. b By using qualifiers for system data type, Layer 2 packet attributes, and Layer 3 packet attributes set the properties that packets must have to match the rule. A qualifier represents a set of matching criteria related to a networking layer. You can match traffic to system data type, Layer 2 traffic properties, and Layer 3 traffic properties. You can use the qualifier for a specific networking layer or can combine qualifiers to match packets more precisely.
n
108
VMware, Inc.
Filter Traffic on a Distributed Port or Uplink Port in the vSphere Web Client
By using a rule, permit or stop traffic for securing data flows through a virtual machine, a VMkernel adapter, or a physical adapter. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 Navigate to a distributed port or an uplink port.
n n
2 3 4 5
Select a port from the list. Click Edit distributed port settings. If traffic filtering and marking is not enabled at the port level, click Override, and from the Status dropdown menu, select Enabled. Click New to create a new rule, or select a rule and click Edit to edit it. You can change a rule inherited from the distributed port group or uplink port group. In this way, the rule becomes unique within the scope of the port.
6 7
In the network traffic rule dialog box, select the Allow action to let traffic pass through the distributed port or uplink port, or the Drop action to restrict it. Specify the kind of traffic that the rule is applicable to. To determine if a data flow is in the scope of a rule for marking or filtering, the vSphere distributed switch examines the direction of the traffic, and properties like source and destination, VLAN, next level protocol, infrastructure traffic type, and so on. a From the Traffic direction drop-down menu, select whether the traffic must be ingress, egress, or both so that the rule recognizes it as matching. The direction also influences how you are going to identify the traffic source and destination. b By using qualifiers for system data type, Layer 2 packet attributes, and Layer 3 packet attributes set the properties that packets must have to match the rule. A qualifier represents a set of matching criteria related to a networking layer. You can match traffic to system data type, Layer 2 traffic properties, and Layer 3 traffic properties. You can use the qualifier for a specific networking layer or can combine qualifiers to match packets more precisely.
n
VMware, Inc.
109
vSphere Networking
Working with Network Traffic Rules on a Distributed Port or Uplink Port in the vSphere Web Client
Define traffic rules in a distributed port or uplink port group to introduce a policy for processing traffic related to a virtual machine or to a physical adapter. You can filter specific traffic or describe its QoS demands.
n
View Traffic Rules on a Distributed Port or Uplink Port in the vSphere Web Client on page 110 Review the traffic rules that form the traffic filtering and marking policy of a distributed port or uplink port.
Edit a Traffic Rule on a Distributed Port or Uplink Port in the vSphere Web Client on page 111 Create or edit traffic rules, and use their parameters to configure a policy for filtering or marking the traffic on a distributed port or uplink port.
Change Rule Priorities on a Distributed Port or Uplink Port in the vSphere Web Client on page 111 Reorder the rules that form the traffic filtering and marking policy of a distributed port or uplink port to change the sequence of actions for analyzing traffic for security and QoS.
Delete a Traffic Rule on a Distributed Port or Uplink Port in the vSphere Web Client on page 112 Delete a traffic rule on a distributed port or uplink port to stop filtering or marking certain type of packets that are flowing to a virtual machine or a physical adapter.
View Traffic Rules on a Distributed Port or Uplink Port in the vSphere Web Client Review the traffic rules that form the traffic filtering and marking policy of a distributed port or uplink port. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 Navigate to a distributed port or an uplink port.
n n
2 3 4 5 6 7
Select a port from the list. Click Edit distributed port settings. Select Traffic filtering and marking. If traffic filtering and marking is not enabled at the port level, click Override, and from the Status dropdown menu, select Enabled. Examine Action to see if the rule filters traffic (Allow or Deny) or marks traffic (Tag) with special QoS demands. From the upper list, select the rule for which you want to view the criteria for locating traffic. The traffic qualifying parameters of the rule appear in the Traffic Qualifiers list.
110
VMware, Inc.
Edit a Traffic Rule on a Distributed Port or Uplink Port in the vSphere Web Client Create or edit traffic rules, and use their parameters to configure a policy for filtering or marking the traffic on a distributed port or uplink port. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 Navigate to a distributed port or an uplink port.
n n
2 3 4 5 6
Select a port from the list. Click Edit distributed port settings. Select Traffic filtering and marking. If traffic filtering and marking is not enabled at the port level, click Override, and from the Status dropdown menu, select Enabled. Click New to create a new rule, or select a rule and click Edit to edit it. You can change a rule inherited from the distributed port group or uplink port group. In this way, the rule becomes unique within the scope of the port.
What to do next Name the network traffic rule, and deny, allow, or tag the target traffic. Change Rule Priorities on a Distributed Port or Uplink Port in the vSphere Web Client Reorder the rules that form the traffic filtering and marking policy of a distributed port or uplink port to change the sequence of actions for analyzing traffic for security and QoS. The vSphere distributed switch applies network traffic rules in a strict order. If a packet already satisfies a rule, the packet might not be passed to the next rule in the policy. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 Navigate to a distributed port or an uplink port.
n n
2 3 4 5
Select a port from the list. Click Edit distributed port settings. Select Traffic filtering and marking. If traffic filtering and marking is not enabled at the port level, click Override, and from the Status dropdown menu, select Enabled.
VMware, Inc.
111
vSphere Networking
6 7
Select a rule and use the arrow buttons to change its priority. Click OK to apply the changes.
Delete a Traffic Rule on a Distributed Port or Uplink Port in the vSphere Web Client Delete a traffic rule on a distributed port or uplink port to stop filtering or marking certain type of packets that are flowing to a virtual machine or a physical adapter. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 Navigate to a distributed port or an uplink port.
n n
2 3 4 5 6 7
Select a port from the list. Click Edit distributed port settings. Select Traffic filtering and marking. If traffic filtering and marking is not enabled at the port level, click Override, and from the Status dropdown menu, select Enabled. Select the rule and click Delete. Click OK.
Disable Traffic Filtering and Marking on a Distributed Port or Uplink Port in the vSphere Web Client
Disable the traffic filtering and marking policy on a port to let traffic flow to a virtual machine or a physical adapter without filtering for security or marking for QoS. Prerequisites Enable the port-level override option for this policy. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46. Procedure 1 Navigate to a distributed port or an uplink port.
n n
2 3 4 5 6
Select a port from the list. Click Edit distributed port settings. Select Traffic filtering and marking. Click Override, and from the Status drop-down menu, select Disabled. Click OK.
112
VMware, Inc.
Qualifying Traffic for Filtering and Marking

The traffic that you want to filter or want to mark with QoS tags can be matched to the type of carried infrastructure data, such as data for storage, vCenter Server management, and so on, and to Layer 2 and Layer 3 properties . To match the traffic in the scope of the rule more precisely, you can combine criteria for system data type, Layer 2 header, and Layer 3 header.
System Traffic Qualifier

By using the system traffic qualifier in a rule for port group or port, you can determine whether certain system data traffic must be marked with a QoS tag, allowed, or dropped. System Traffic Type You can select the type of traffic through the ports of the group that carries system data, that is, traffic for management from vCenter Server , storage, VMware vSphere vMotion , and vSphere Fault Tolerance. You can mark or filter only a specific traffic type, or for all system data traffic except for a infrastructure feature. For example, you can mark with a QoS value or filter the traffic for management from vCenter Server , storage and vMotion, but not the traffic carrying the Fault Tolerance data.
MAC Traffic Qualifier

By using the MAC traffic qualifier in a rule, you can define matching criteria for the Layer 2 (Data Link Layer) properties of packets such as MAC address, VLAN ID, and next level protocol that consumes the frame payload. Protocol Type The Protocol type attribute of the MAC traffic qualifier corresponds to the EtherType field in Ethernet frames. EtherType represents the type of next level protocol that is going to consume the payload of the frame. You can select a protocol from the drop-down menu or type its hexadecimal number. For example, to capture traffic for the Link Layer Discovery Protocol (LLDP) protocol, type 88CC. VLAN ID You can use the VLAN ID attribute of the MAC traffic qualifier to mark or filter traffic in a particular VLAN. NOTE The VLAN ID qualifier on a distributed port group works with Virtual Guest Tagging (VGT). If a flow is tagged with a VLAN ID through Virtual Switch Tagging (VST), it cannot be located by using this ID in a rule on a distributed port group or distributed port. The reason is that the distributed switch checks the rule conditions, including the VLAN ID, after the switch has already untagged the traffic. In this case, to match traffic by VLAN ID successfully, you must use a rule on an uplink port group or uplink port. Source Address By using the Source Address group of attributes, you can match packets by the source MAC address or network. You can use a comparison operator to mark or filter packets that have or do not have the specified source address or network. You can match the traffic source in several ways.
VMware, Inc.
113
vSphere Networking
Table 61. Patterns for Filtering or Marking Traffic by MAC Source Address
Parameters to Match Traffic Source Address MAC address MAC network Comparison Operator is or is not matches or does not match Networking Argument Format Type the MAC address for matching. Use colons to separate the octets in it. Type the lowest address in the network and a wildcard mask. Set zeroes at the positions of the network bits, and ones for the host part.
00:50:56:00:00:00 and mask as 00:00:01:ff:ff:ff.
For example, for a MAC network with prefix 05:50:56 that is 23 bits long, set the address as
Destination Address By using the Destination Address group of attributes, you can match packets to their destination address. The MAC destination address options have the same format as those for the source address. Comparison Operators To match traffic in a MAC qualifier more closely to your needs, you can use affirmative comparison or negation. You can use operators such that all packets except the ones with certain attributes fall in the scope of a rule.
IP Traffic Qualifier
By using the IP traffic qualifier in a rule, you can define criteria for matching traffic to the Layer 3 (Network Layer) properties such as IP version, IP address, next level protocol, and port. Protocol The Protocol attribute of the IP traffic qualifier represents the next level protocol consuming the payload of the packet. You can select a protocol from the drop-down menu or type its decimal number according to RFC 1700. For the TCP and UDP protocols, you can also match traffic by source and destination ports. Source Port By using the Source port attribute, you can match TCP or UDP packets by the source port. Consider the traffic direction when matching traffic to a source port. Destination Port By using the Destination port attribute, you can match TCP or UDP packets by the destination port. Consider the traffic direction when matching traffic to a destination port. Source Address By using the Source Address attribute, you can match packets by source address or subnet. Consider the traffic direction when matching traffic to a source address or network. You can match traffic source in several ways.
114
VMware, Inc.
Table 62. Patterns for Filtering or Marking Traffic by IP Source Address

Parameters to Match Traffic Source Address IP version IP address IP subnet Comparison Operator any is or is not matches or does not match Networking Argument Format Select the IP version from the dropdown menu. Type the IP address that you want to match. Type the lowest address in the subnet and the bit length of the subnet prefix.
Destination Address Use the Destination Address to match packets by IP address, subnet, or IP version. The destination address has the same format as the one for the source. Comparison Operators To match traffic in an IP qualifier more closely to your needs, you can use affirmative comparison or negation. You can define that all packets fall in the scope of a rule except packets with certain attributes.
Port Blocking Policies

Port blocking policies allow you to selectively block ports from sending or receiving data.
Edit the Port Blocking Policy for a Distributed Port Group in the vSphere Web Client
You can configure various distributed port group policies. Procedure 1 2 3 4 5 Browse to a distributed switch in the vSphere Web Client navigator. Right-click the distributed switch in the object navigator and select Manage Distributed Port Groups. Select the Miscellaneous check box and click Next. Select a distributed port group to edit and click Next. Use the Block all ports drop-down menu to select Yes or No and click Next. Selecting Yes shuts down all ports in the port group. This might disrupt the normal network operations of the hosts or virtual machines using the ports. 6 Review your settings and click Finish. Use the Back button to change any settings.
Edit Distributed Port or Uplink Port Blocking Policies with the vSphere Web Client
You can configure distributed port or uplink port blocking policies. Prerequisites To override the traffic shaping policy at the port level, enable the port-level overrides. See Edit Advanced Distributed Port Group Settings with the vSphere Web Client, on page 46 Procedure 1 Browse to a distributed switch in the vSphere Web Client navigator.
VMware, Inc.
115
vSphere Networking
2 3 4 5
Click the Manage tab, and select Ports. Select a port from the list. Click Edit distributed port settings. In the Miscellaneous section, select the Block Port Override check box and choose Yes or No from the drop-down menu. Yes shuts down all ports in the port group. This might disrupt the normal network operations of the hosts or virtual machines using the ports.
Click OK.
Manage Policies for Multiple Port Groups on a vSphere Distributed Switch in the vSphere Web Client
You can modify networking policies for multiple port groups on a vSphere Distributed Switch. Prerequisites Create a vSphere Distributed Switch with one or more port groups. Procedure 1 2 3 Browse to a distributed switch in the vSphere Web Client. Right-click the distributed switch, and select Manage Distributed Port Groups. On the Select port group policies page, select the check box next to the policy categories to modify and click Next.
Option Security Traffic shaping VLAN Teaming and failover Resource allocation Monitoring Traffic filtering and marking Description Set MAC address changes, forged transmits, and promiscuous mode for the selected port groups. Set the average bandwidth, peak bandwidth, and burst size for inbound and outbound traffic on the selected port groups. Configure how the selected port groups connect to physical VLANs. Set load balancing, failover detection, switch notification, and failover order for the selected port groups. Set network resource pool association for the selected port groups. This option is available for vSphere Distributed Switch version 5.0. and later. Enable or disable NetFlow on the selected port groups. This option is available for vSphere Distributed Switch version 5.0.0 and later. Configure policy for filtering (allow or drop) and for marking certain types of traffic through the ports of selected port groups. This option is available for vSphere Distributed Switch version 5.5 and later . Enable or disable port blocking on the selected port groups.
Miscellaneous
On the Select port groups page, select the distributed port group(s) to edit and click Next.
116
VMware, Inc.
(Optional) On the Security page, use the drop-down menus to edit the security exceptions and click Next.
Option Promiscuous Mode Description
n n
Reject. Placing a guest adapter in promiscuous mode has no effect on which frames are received by the adapter. Accept. Placing a guest adapter in promiscuous mode causes it to detect all frames passed on the vSphere Distributed Switch that are allowed under the VLAN policy for the port group that the adapter is connected to. Reject. If set to Reject and the guest operating system changes the MAC address of the adapter to anything other than what is in the .vmx configuration file, all inbound frames are dropped. If the Guest OS changes the MAC address back to match the MAC address in the .vmx configuration file, inbound frames are passed again. Accept. Changing the MAC address from the Guest OS has the intended effect. Frames to the new MAC address are received. Reject. Any outbound frame with a source MAC address that is different from the one currently set on the adapter are dropped. Accept. No filtering is performed and all outbound frames are passed.
MAC Address Changes
Forged Transmits
n n
(Optional) On the Traffic shaping page, use the drop-down menus to enable or disable Ingress or Egress traffic shaping and click Next.
Option Status Description If you enable either Ingress Traffic Shaping or Egress Traffic Shaping, you are setting limits on the amount of networking bandwidth allocated for each VMkernel adapter or virtual network adapter associated with this port group. If you disable the policy, services have a free, clear connection to the physical network by default. Establishes the number of bits per second to allow across a port, averaged over time, that is, the allowed average load. The maximum number of bits per second to allow across a port when it is sending or receiving a burst of traffic. This maximum number tops the bandwidth used by a port whenever it is using its burst bonus. The maximum number of bytes to allow in a burst. If this parameter is set, a port might gain a burst bonus when it does not use all its allocated bandwidth. Whenever the port needs more bandwidth than specified by Average Bandwidth, it might be allowed to transmit data at a higher speed if a burst bonus is available. This parameter tops the number of bytes that can be accumulated in the burst bonus and transferred at a higher speed.
Average Bandwidth Peak Bandwidth
Burst Size
(Optional) On the VLAN page, use the drop-down menus to edit the VLAN policy and click Next.
Option None VLAN VLAN Trunking Private VLAN Description Do not use VLAN. In the VLAN ID field, enter a number between 1 and 4094. Enter a VLAN trunk range. Select an available private VLAN to use.
VMware, Inc.
117
vSphere Networking
(Optional) On the Teaming and failover page, use the drop-down menus to edit the settings and click Next.
Option Load Balancing Description IP-based teaming requires that the physical switch be configured with ether channel. For all other options, ether channel should be disabled. Select how to choose an uplink. n Route based on the originating virtual port. Choose an uplink based on the virtual port where the traffic entered the distributed switch. n Route based on IP hash. Choose an uplink based on a hash of the source and destination IP addresses of each packet. For non-IP packets, whatever is at those offsets is used to compute the hash. n Route based on source MAC hash. Choose an uplink based on a hash of the source Ethernet. n Route based on physical NIC load. Choose an uplink based on the current loads of physical NICs. n Use explicit failover order. Always use the highest order uplink, from the list of Active adapters, which passes failover detection criteria. Select the method to use for failover detection. n Link Status only. Relies solely on the link status that the network adapter provides. This option detects failures, such as cable pulls and physical switch power failures, but not configuration errors, such as a physical switch port being blocked by spanning tree or that is misconfigured to the wrong VLAN or cable pulls on the other side of a physical switch. n Beacon Probing. Sends out and listens for beacon probes on all NICs in the team and uses this information, in addition to link status, to determine link failure. Do not use beacon probing with IP-hash load balancing. Select Yes or No to notify switches in the case of failover. Do not use this option when the virtual machines using the port group are using Microsoft Network Load Balancing in unicast mode. If you select Yes, whenever a virtual NIC is connected to the distributed switch or whenever that virtual NICs traffic is routed over a different physical NIC in the team because of a failover event, a notification is sent out over the network to update the lookup tables on physical switches. Use this process for the lowest latency of failover occurrences and migrations with vMotion. Select Yes or No to disable or enable failback. This option determines how a physical adapter is returned to active duty after recovering from a failure. n Yes (default). The adapter is returned to active duty immediately upon recovery, displacing the standby adapter that took over its slot, if any. n No. A failed adapter is left inactive even after recovery until another currently active adapter fails, requiring its replacement. Select how to distribute the work load for uplinks. To use some uplinks but reserve others in case the uplinks in use fail, set this condition by moving them into different groups. n Active Uplinks. Continue to use the uplink when the network adapter connectivity is up and active. n Standby Uplinks . Use this uplink if one of the active adapters connectivity is down. When using IP-hash load balancing, do not configure standby uplinks. Unused Uplinks . Do not use this uplink. n
Network Failover Detection
Notify Switches
Failback
Failover Order
(Optional) On the Resource allocation page, use the network resource pool drop-down menu to add or remove resource allocations and click Next.
118
VMware, Inc.
10
(Optional) On the Monitoring page, use the drop-menu to enable or disable NetFlow and click Next.
Option Disabled Enabled Description NetFlow is disabled on the distributed port group. NetFlow is enabled on the distributed port group. You can configure NetFlow settings at the vSphere Distributed Switch level.
11
(Optional) On the Traffic filtering and marking page, enable or disable traffic filtering and marking from Status drop-down menu, configure traffic rules for filtering or marking specific data flows, and click Next. You can set the following attributes of a rule determining the target traffic and the action on it:
Option Name Action Description Name of the rule
n n n
Allow. Grant access to traffic of a certain type. Drop. Deny access to traffic of a certain type. Tag. Classify traffic in terms of QoS by inserting or retagging traffic with a CoS and DSCP tag.
Traffic direction
Set whether the rule is for incoming, outgoing or incoming and outgoing traffic. The direction also influences how you are going to identify the traffic source and destination. Indicate that the rule scopes over system traffic and set the type of infrastructure protocol to apply the rule on. For example, mark with a priority tag the traffic for management from vCenter Server.
System traffic qualifier
VMware, Inc.
119
vSphere Networking
Option MAC qualifier
Description
n
Qualify the traffic for the rule by Layer 2 header. Protocol type. Set the next level protocol (IPv4, IPv6, etc.) consuming the payload. This attribute corresponds to the EtherType field in Ethernet frames. You can select a protocol from the drop-down menu or type its hexadecimal number For example, to locate traffic for the Link Layer Discovery Protocol (LLDP) protocol, type 88CC. VLAN ID. Locate traffic by VLAN. The VLAN ID qualifier on a distributed port group works with Virtual Guest Tagging (VGT). If you have a flow tagged with a VLAN ID through Virtual Switch Tagging (VST), you cannot locate the flow by this ID in a distributed port group rule. The reason is that the distributed switch checks the rule conditions, including the VLAN ID, after the switch has already untagged the traffic. To match successfully traffic to a VLAN ID, use a rule for an uplink port group or uplink port. Source Filter. Set a single MAC address or a MAC network to match packets by source address. For a MAC network you enter the lowest address in the network and a wildcard mask. The mask contains zeroes at the positions of the network bits, and ones for the host part. For example, for a MAC network with prefix 05:50:56 that is 23 bits long, set the address as 00:50:56:00:00:00 and the mask as 00:00:01:ff:ff:ff. Destination Filter. Set a single MAC address or a MAC network to match packets by destination address. The MAC destination address supports the same format as the source address.
IP qualifier
Qualify the traffic for the rule by Layer 3 header. n Protocol. Set the next level protocol (TCP, UDP, etc.) consuming the payload. You can select a protocol from the drop-down menu or type its decimal number according to RFC 1700, Assigned Numbers. For TCP and UDP protocol, you can also set source and destination port. Source port. Match TCP or UDP packets to a source port. Consider the direction of the traffic that is within the scope of the rule when determining the source port to match packets to. Destination port. Match TCP or UDP packets by the source port. Consider the direction of the traffic that is within the scope of the rule when determining the destination port to match packets to. Source Filter. Set the IP version, a single IP address or a subnet to match packets by source address. For a subnet you enter the lowest address and the bit length of the prefix. Destination Filter. Set the IP version, a single IP address or a subnet to match packets by source address. The IP destination address supports the same format as the source address.
12
(Optional) On the Miscellaneous page, select Yes or No from the drop-down menu and click Next. SelectYes to shut down all ports in the port group. This shutdown might disrupt the normal network operations of the hosts or virtual machines using the ports.
120
VMware, Inc.
13
Review your settings on the Ready to complete page and click Finish. Use the Back button to change any settings.
VMware, Inc.
121
vSphere Networking
122
VMware, Inc.
Managing Network Resources
vSphere provides several different methods to help you manage your network resources. This chapter includes the following topics:
n n n n n
vSphere Network I/O Control, on page 123 TCP Segmentation Offload and Jumbo Frames, on page 127 NetQueue and Networking Performance, on page 130 DirectPath I/O, on page 131 Single Root I/O Virtualization (SR-IOV), on page 134
vSphere Network I/O Control

Network resource pools determine the bandwidth that different network traffic types are given on a vSphere distributed switch. When network I/O control is enabled, distributed switch traffic is divided into the following predefined network resource pools: Fault Tolerance traffic, iSCSI traffic, vMotion traffic, management traffic, vSphere Replication (VR) traffic, NFS traffic, and virtual machine traffic. You can also create custom network resource pools for virtual machine traffic. You can control the bandwidth each network resource pool is given by setting the physical adapter shares and host limit for each network resource pool. The physical adapter shares assigned to a network resource pool determine the share of the total available bandwidth guaranteed to the traffic associated with that network resource pool. The share of transmit bandwidth available to a network resource pool is determined by the network resource pool's shares and what other network resource pools are actively transmitting. For example, if you set your FT traffic and iSCSI traffic resource pools to 100 shares, while each of the other resource pools is set to 50 shares, the FT traffic and iSCSI traffic resource pools each receive 25% of the available bandwidth. The remaining resource pools each receive 12.5% of the available bandwidth. These reservations apply only when the physical adapter is saturated. NOTE The iSCSI traffic resource pool shares do not apply to iSCSI traffic on a dependent hardware iSCSI adapter. The host limit of a network resource pool is the upper limit of bandwidth that the network resource pool can use. Assigning a QoS priority tag to a network resource pool applies an 802.1p tag to all outgoing packets associated with that network resource pool.
VMware, Inc.
123
vSphere Networking
Enable Network I/O Control on a vSphere Distributed Switch with the vSphere Web Client on page 124 Enable network resource management to use network resource pools to prioritize network traffic by type.
Create a Network Resource Pool with the vSphere Web Client on page 124 Create user-defined network resource pools for customized network resource management. Add or Remove Distributed Port Groups from a Network Resource Pool with the vSphere Web Client on page 125 Add a distributed port group to a user-defined network resource pool to include in the network resource pool all virtual machine network traffic from that distributed port group.
Edit Network Resource Pool Settings with the vSphere Web Client on page 126 You can change both system and user-defined network resource pool settings to change the priority network traffic for that network resource pool.
Delete a User-Defined Network Resource Pool with the vSphere Web Client on page 126 You can delete user-defined network resource pools that are no longer in use.
Enable Network I/O Control on a vSphere Distributed Switch with the vSphere Web Client
Enable network resource management to use network resource pools to prioritize network traffic by type. Prerequisites Verify that your datacenter has at least one vSphere distributed switch version 4.1.0 or later. Procedure 1 2 3 4 5 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and select Settings > Properties. Click Edit. Select to Enable or Disable network I/O control from the Network I/O Control drop-down menu. Click OK.
Create a Network Resource Pool with the vSphere Web Client

Create user-defined network resource pools for customized network resource management. User-defined network resource pools are available only on vSphere distributed switches version 5.0.0 or later. Procedure 1 2 3 4 5 6 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and click Resource Allocation. Click New. Type a Name for the network resource pool or accept the generated name. (Optional) Type a Description for the network resource pool. Set the Host limit for the network resource pool in megabits per second, or select Unlimited.
124
VMware, Inc.
Chapter 7 Managing Network Resources
Select the Physical adapter shares for the network resource pool from the drop-down menu.
Option Low Normal High Custom Description Sets the shares for this resource pool to 25. Sets the shares for this resource pool to 50. Sets the shares for this resource pool to 100. Aspecific number of shares, from 1 to 100, for this network resource pool.
(Optional) Select the QoS tag for the network resource pool. The QoS priority tag specifies an IEEE 802.1p tag, allowing quality of service at the media access control level.
Click OK. The new resource pool appears in the User-defined network resource pools section.
What to do next Add one or more distributed port groups to the network resource pool.
Add or Remove Distributed Port Groups from a Network Resource Pool with the vSphere Web Client
Add a distributed port group to a user-defined network resource pool to include in the network resource pool all virtual machine network traffic from that distributed port group. Prerequisites Create one or more user-defined network resource pools on the vSphere distributed switch. Procedure 1 2 3 4 5 Browse to a distributed switch in the vSphere Web Client. Right-click the distributed switchin the navitgator and select Manage Distributed Port Groups. On the Select port group policies page, select the Resource allocation check box and click Next. On the Select port groups page, select port groups to edit and click Next. On the Configure policies - Resource allocation page, add or remove the distributed switch from the network resource pool and click Next.
n
To add the distributed port group to a resource pool, select a user-defined resource pool from the Network resource pool drop-down menu. To remove the distributed port group from a resource pool, select default from the Network resource pool drop-down menu.
NOTE If there are no user-defined network resource pools on the distributed switch, you will only see default in the drop-down menu. 6 Review your settings on the Ready to Complete page and click Finish. Use the Back button to change your selections.
VMware, Inc.
125
vSphere Networking
Edit Network Resource Pool Settings with the vSphere Web Client
You can change both system and user-defined network resource pool settings to change the priority network traffic for that network resource pool. Procedure 1 2 3 4 5 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and click Resource Allocation. Select a network resource pool from the list and click Edit. Edit the Host limit for the network resource pool in megabits per second or select Unlimited. Select an option for the network resource pool from the Physical adapter shares drop-down menu.
Option Low Normal High Custom Description Sets the shares for this resource pool to 25. Sets the shares for this resource pool to 50. Sets the shares for this resource pool to 100. A specific number of shares, from 1 to 100, for this network resource pool.
(Optional) Select a QoS tag for the network resource pool. The QoS priority tag specifies an IEEE 802.1p tag, allowing quality of service at the media access control level.
Click OK.
Delete a User-Defined Network Resource Pool with the vSphere Web Client
You can delete user-defined network resource pools that are no longer in use. NOTE You cannot delete a system network resource pool. Prerequisites Remove all distributed port groups from the network resource pool. Procedure 1 2 3 4 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and click Resource Allocation. Select a user-defined resource allocation pool and click Remove. Click Yes to delete the resource pool.
126
VMware, Inc.
TCP Segmentation Offload and Jumbo Frames

Using TCP Segmentation Offload (TSO) in a VMkernel network adapter and virtual machines, and jumbo frames on a vSphere distributed switch or vSphere standard switch, improves the network performance in virtual machines and infrastructure workloads.
Enabling TSO
Use TCP Segmentation Offload (TSO) in VMkernel network adapters and virtual machines to improve the network performance. TSO on the transmission path of physical and virtual machine NICs improves the performance of ESX/ESXi hosts by reducing the overhead of the CPU for TCP/IP network operations. When TSO is enabled, the NIC divides larger data chunks into TCP segments instead of the CPU. The host can use more CPU cycles to run applications.
Enable TSO Support for a Virtual Machine by Using the vSphere Web Client
You can enable TSO support on a virtual machine by using an enhanced VMXNET adapter for that virtual machine. To enable TSO at the virtual machine level, you must replace the existing VMXNET or flexible virtual network adapters with enhanced VMXNET virtual network adapters. This replacement might result in a change in the MAC address of the virtual network adapter. Prerequisites To use TSO, verify that the virtual machine runs one of the following guest operating systems:
n n n n
Microsoft Windows Server 2003 Enterprise Edition with Service Pack 2 (32 bit and 64 bit) Red Hat Enterprise Linux 4 (64 bit) Red Hat Enterprise Linux 5 (32 bit and 64 bit) SUSE Linux Enterprise Server 10 (32 bit and 64 bit)
Procedure 1 Locate the virtual machine in the vSphere Web Client. a b 2 3 4 5 6 7 8 9 Select a datacenter, folder, cluster, resource pool, or host and click the Related Objects tab. Click Virtual Machines and select the virtual machine from the list.
On the Manage tab of the virtual machine, select Settings > VM Hardware. Click Edit and select the Virtual Hardware tab. Expand the network adapter section and write down the network settings and MAC address for the network adapter. Click Remove to remove the network adapter from the virtual machine. From the New device drop-down menu, select Network and click Add. From the Adapter Type drop-down menu, select VMXNET 2 (Enhanced) or VMXNET 3. Set the network setting and MAC address used by the old network adapter. Click OK.
VMware, Inc.
127
vSphere Networking
What to do next If the virtual machine is not set to upgrade VMware Tools each time it is powered on, you must upgrade VMware Tools manually.
Enable TSO Support for a VMkernel Network Adapter

When using TSO on a VMkernel network adapter, the physical NIC splits large data chunks into TCP segments instead of the CPU. As a result, the CPU has more cycles for applications. By default, a host is configured to use hardware TSO if its NICs support it. If TSO becomes disabled for a particular VMkernel adapter, the only way you can re-enable TSO is by deleting the adapter and recreating it with TSO enabled. Prerequisites Verify that one of the following requirements are satisfied:
n
The VMkernel adapter does not handle traffic related to host networking services, such as iSCSI, vSphere vMotion, and so on. The networking services can send traffic by using an alternative VMkernel adapter.
Procedure 1 2 3 In the vSphere Web Client, navigate to the host. Under Manage, select Networking and then select VMkernel adapters. Select a VMkernel adapter from the list, and note its settings. Later you should set the same settings to the newly added VMkernel adapter. 4 5 6 7 8 9 10 11 Click Remove. In the confirmation dialog, click Analyze impact, verify that no networking services are impacted, and click OK. In the VMkernel adapters list, click Add host networking. On the Add connection type page, select VMkernel Network Adapter and click Next. On the Select target device page, assign the VMkernel adapter to a standard switch or distributed port group. On the Port properties page, configure the IP version and networking services related to the old adapter, and click Next. On the IPv4 Settings and IPv6 Settings pages, configure the IP settings used by the old adapter. Review your settings and click Finish.
Enabling Jumbo Frames

Jumbo frames let ESXi hosts send larger frames out onto the physical network. The network must support jumbo frames end-to-end that includes physical network adapters, physical switches, and storage devices. Before enabling jumbo frames, check with your hardware vendor to ensure that your physical network adapter supports jumbo frames. You can enable jumbo frames on a vSphere distributed switch or vSphere standard switch by changing the maximum transmission unit (MTU) to a value greater than 1500 bytes. 9000 bytes is the maximum frame size that you can configure.
128
VMware, Inc.
Enable Jumbo Frames on a vSphere Distributed Switch with the vSphere Web Client
Enable jumbo frames for the entire traffic that passes through a vSphere distributed switch. Procedure 1 2 3 4 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and click Settings > Properties. Click Edit. Click Advanced and set the MTU property to a value greater than 1500 bytes. You cannot set the MTU size to a value greater than 9000 bytes. 5 Click OK.
Enable Jumbo Frames on a vSphere Standard Switch with the vSphere Web Client
Enable jumbo frames for all traffic through a vSphere standard switch on a host. Procedure 1 2 3 4 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking, and select Virtual switches. Select a standard switch from the virtual switch table and click Edit settings. In the Properties section, set the MTU property to a value greater than 1500 bytes. You can increase the MTU size up to 9000 bytes. 5 Click OK.
Enable Jumbo Frames for a VMkernel Adapter in the vSphere Web Client
Jumbo frames reduce the CPU load caused by transferring data. Enable jumbo frames on a VMkernel adapter by changing the maximum transmission units (MTU) of the adapter. Procedure 1 2 3 In the vSphere Web Client, navigate to the host. Under Manage, select Networking and then select VMkernel adapters. Select a VMkernel adapter from the adapter table. The properties of the adapter appear. 4 5 6 Click the name of the VMkernel adapter. Click Edit. Select NIC settings and set the MTU property to a value greater than 1500. You can increase the MTU size up to 9000 bytes. 7 Click OK.
VMware, Inc.
129
vSphere Networking
Enable Jumbo Frame Support on a Virtual Machine with the vSphere Web Client
Enabling jumbo frame support on a virtual machine requires an enhanced VMXNET adapter for that virtual machine. Procedure 1 Locate the virtual machine in the vSphere Web Client. a b 2 3 4 5 6 7 8 9 10 Select a datacenter, folder, cluster, resource pool, or host and click the Related Objects tab. Click Virtual Machines and select the virtual machine from the list.
On the Manage tab of the virtual machine, select Settings > VM Hardware. Click Edit and select the Virtual Hardware tab. Click the Virtual Hardware section, and expand the network adapter section. Record the network settings and MAC address that the network adapter is using. Click Remove to remove the network adapter from the virtual machine. From the New device drop-down menu, select Network and click Add. From the Adapter Type drop-down menu, select VMXNET 2 (Enhanced) or VMXNET 3. Set the network settings to the ones recorded for the old network adapter. Set the MAC Address to Manual, and type the MAC address that the old network adapter was using. Click OK.
What to do next
n
Check that the enhanced VMXNET adapter is connected to a standard switch or to a distributed switch with jumbo frames enabled. Inside the guest operating system, configure the network adapter to allow jumbo frames. See the documentation of your guest operating system. Configure all physical switches and any physical or virtual machines to which this virtual machine connects to support jumbo frames.
NetQueue and Networking Performance

NetQueue takes advantage of the ability of some network adapters to deliver network traffic to the system in multiple receive queues that can be processed separately, allowing processing to be scaled to multiple CPUs, improving receive-side networking performance.
Enable NetQueue on a Host

NetQueue is enabled by default. To use NetQueue after it has been disabled, you must reenable it. Prerequisites Familiarize yourself with the information on configuring NIC drivers in Getting Started with vSphere Command-Line Interfaces.
130
VMware, Inc.
Procedure 1 In the VMware vSphere CLI, use the following command depending on the host version:
ESX/ESXi Version ESX/ESXi 4.x ESXi 5.x Command vicfg-advcfg --set true VMkernel.Boot.netNetQueueEnable esxcli system settings kernel set --setting="netNetqueueEnabled" -value="TRUE"
2 3
Use the VMware vSphere CLI to configure the NIC driver to use NetQueue. Reboot the host.
Disable NetQueue on a Host

NetQueue is enabled by default. Prerequisites Familiarize yourself with the information on configuring NIC drivers in Getting Started with vSphere Command-Line Interfaces. Procedure 1 In the VMware vSphere CLI, use the following command depending on the host version:
ESX/ESXi version ESX/ESXi 4.x ESXi 5.x Command vicfg-advcfg --set false VMkernel.Boot.netNetQueueEnable esxcli system settings kernel set --setting="netNetqueueEnabled" -value="FALSE"
To disable NetQueue on the NIC driver, use the vicfg-module -s "" module name command. For example, if you are using the s2io NIC driver, use vicfg-module -s "" s2io.
Reboot the host.
DirectPath I/O
DirectPath I/O allows virtual machine access to physical PCI functions on platforms with an I/O Memory Management Unit. The following features are unavailable for virtual machines configured with DirectPath:
n n n n n n n
Hot adding and removing of virtual devices Suspend and resume Record and replay Fault tolerance High availability DRS (limited availability. The virtual machine can be part of a cluster, but cannot migrate across hosts) Snapshots
Cisco Unified Computing Systems (UCS) through Cisco Virtual Machine Fabric Extender (VM-FEX) distributed switches support the following features for migration and resource management of virtual machines which use DirectPath I/O:
n
vMotion
VMware, Inc.
131
vSphere Networking
n n n n n
Hot adding and removing of virtual devices Suspend and resume High availability DRS Snapshots
See Cisco VM-FEX documentation for details on supported switches and switch configuration information.
n
Configure Passthrough Devices on a Host with the vSphere Web Client on page 132 Passthrough devices provide the means to use resources efficiently and improve performance of your environment. You can configure passthrough networking devices on a host.
Configure a PCI Device on a Virtual Machine with the vSphere Web Client on page 133 Passthrough devices provide the means to more efficiently use resources and improve performance in your environment. You can configure a passthrough PCI device on a virtual machine in the vSphere Web Client.
Enable DirectPath I/O with vMotion on a Virtual Machine with the vSphere Web Client on page 133 You can enable DirectPath I/O with vMotion for virtual machines in a datacenter on a Cisco UCS system that has at least one supported Cisco UCS Virtual Machine Fabric Extender (VM-FEX) distributed switch.
Configure Passthrough Devices on a Host with the vSphere Web Client

Passthrough devices provide the means to use resources efficiently and improve performance of your environment. You can configure passthrough networking devices on a host. Procedure 1 2 3 4 Browse to a host in the vSphere Web Client navigator. Click the Manage tab, click Settings. In the Hardware section, click PCI Devices. To add a PCI device to the host, click Edit. A list of available passthrough devices appears.
Icon green icon orange icon Description A device is active and can be enabled. The state of the device has changed, and you must reboot the host before you can use the device.
Select the devices to be used for passthrough and click OK.
The selected PCI device appears in the table. Device information is displayed at the bottom of the screen. What to do next You must reboot the host to to make the PCI device available for use.
132
VMware, Inc.
Configure a PCI Device on a Virtual Machine with the vSphere Web Client
Passthrough devices provide the means to more efficiently use resources and improve performance in your environment. You can configure a passthrough PCI device on a virtual machine in the vSphere Web Client. Prerequisites Verify that a passthrough networking device is configured on the host of the virtual machine. See Configure Passthrough Devices on a Host with the vSphere Web Client, on page 132. Procedure 1 Locate the virtual machine in the vSphere Web Client. a b 2 3 4 5 6 7 8 Select a datacenter, folder, cluster, resource pool, or host and click the Related Objects tab. Click Virtual Machines and select the virtual machine from the list.
Power off the virtual machine. On the Manage tab of the virtual machine, select Settings > VM Hardware. Click Edit and select the Virtual Hardware tab. Expand the Memory section, and set the Limit to Unlimited. From the New device drop-down menu select PCI Device and click Add. From the New PCI device drop-down menu select the passthrough device to use, and click OK. Power on the virtual machine.
Adding a DirectPath device to a virtual machine sets memory reservation to the memory size of the virtual machine.
Enable DirectPath I/O with vMotion on a Virtual Machine with the vSphere Web Client
You can enable DirectPath I/O with vMotion for virtual machines in a datacenter on a Cisco UCS system that has at least one supported Cisco UCS Virtual Machine Fabric Extender (VM-FEX) distributed switch. Prerequisites Enable high performance network I/O on at least one Cisco UCS port profile on a supported Cisco VM-FEX distributed switch. For supported switches and switch configuration, see documentation at the CIsco Web site.http://www.cisco.com/go/unifiedcomputing/b-series-doc Procedure 1 Locate the virtual machine in the vSphere Web Client. a b 2 3 4 5 6 7 Select a datacenter, folder, cluster, resource pool, or host and click the Related Objects tab. Click Virtual Machines and select the virtual machine from the list.
Power off the virtual machine. On the Manage tab of the virtual machine, select Settings > VM Hardware. Click Edit and select the Virtual Hardware tab. Expand the Memory section, and set the Limit to Unlimited. Expand the Network adapter section to configure a passthrough device. Select a port profile with high performance enabled from the network drop-down menu and click OK.
VMware, Inc.
133
vSphere Networking
Power on the virtual machine.
Single Root I/O Virtualization (SR-IOV)

vSphere 5.1 and later releases support Single Root I/O Virtualization (SR-IOV). You can use SR-IOV for networking of virtual machines that are latency sensitive or require more CPU resources.
Overview of SR-IOV
SR-IOV is a specification that allows a single Peripheral Component Interconnect Express (PCIe) physical device under a single root port to appear as multiple separate physical devices to the hypervisor or the guest operating system. SR-IOV uses physical functions (PFs) and virtual functions (VFs) to manage global functions for the SR-IOV devices. PFs are full PCIe functions that are capable of configuring and managing the SR-IOV functionality. It is possible to configure or control PCIe devices using PFs, and the PF has full ability to move data in and out of the device. VFs are lightweight PCIe functions that support data flowing but have a restricted set of configuration resources. The number of virtual functions provided to the hypervisor or the guest operating system depends on the device. SR-IOV enabled PCIe devices require appropriate BIOS and hardware support, as well as SR-IOV support in the guest operating system driver or hypervisor instance. See SR-IOV Support, on page 134.
Using SR-IOV in vSphere

In vSphere, a virtual machine can use an SR-IOV virtual function for networking. The virtual machine and the physical adapter exchange data directly without using the VMkernel as an intermediary. Bypassing the VMkernel for networking reduces latency and improves CPU efficiency. In vSphere 5.5 and later, though a virtual switch (standard switch or distributed switch) does not handle the network traffic of an SR-IOV enabled virtual machine connected to the switch, you can control the assigned virtual functions by using switch configuration policies at port group or port level.
SR-IOV Support
vSphere 5.1 and later supports SR-IOV in an environment with specific configuration only. Some features of vSphere are not functional when SR-IOV is enabled.
Supported Configurations
To use SR-IOV in vSphere 5.5, your environment must meet several configuration requirements. Table 71. Supported Configurations for Using SR-IOV
Component vSphere Requirements
n n
Hosts with Intel processors require ESXi 5.1 or later. Hosts with AMD processors are supported with SRIOV in ESXi 5.5 or later. Must be compatible with the ESXi release. Must have an Intel processor if you are running ESXi 5.1, or an Intel or AMD processor if you are running ESXi 5.5 and later. Must support I/O memory management unit (IOMMU), and must have IOMMU enabled in the BIOS. Must support SR-IOV, and must have SR-IOV enabled in the BIOS. Contact the server vendor to determine whether the host supports SR-IOV.
Physical host
n n
134
VMware, Inc.
Table 71. Supported Configurations for Using SR-IOV (Continued)

Component Physical NIC Requirements
n n
Must be compatible with the ESXi release. Must be supported for use with the host and SR-IOV according to the technical documentation from the server vendor. Must have SR-IOV enabled in the firmware. Must be certified by VMware. Must be installed on the ESXi host. The ESXi release provides a default driver for certain NICs, while for others you must download and manually install it. Red Hat Enterprise Linux 6.x Windows Server 2008 R2 with SP2 Must be compatible with the NIC. Must be supported on the guest OS release according to the technical documentation from the NIC vendor. Must be Microsoft WLK or WHCK certified for Windows virtual machines. Must be installed on the operating system. The operating system release contains a default driver for certain NICs, while for others you must download and install it from a location provided by the vendor of the NIC or the host.
PF driver in ESXi for the physical NIC
n n
Guest OS VF driver in the guest OS
n n n n n n
To verify that your physical hosts and NICs are compatible with ESXi releases, see the VMware Compatibility Guide.
Availability of Features
The following features are not available for virtual machines configured with SR-IOV:
n n n n n n n n n n n n n n
vSphere vMotion Storage vMotion vShield NetFlow VXLAN Virtual Wire vSphere High Availability vSphere Fault Tolerance vSphere DRS vSphere DPM Virtual machine suspend and resume Virtual machine snapshots MAC-based VLAN for passthrough virtual functions Hot addition and removal of virtual devices, memory, and vCPU Participation in a cluster environment
VMware, Inc.
135
vSphere Networking
Network statistics for a virtual machine NIC using SR-IOV passthrough
NOTE Attempts to enable or configure unsupported features with SR-IOV in the vSphere Web Client result in unexpected behavior in your environment.
Supported NICs
All NICs must have drivers and firmware that support SR-IOV. Some NICs might require SR-IOV to be enabled on the firmware. The following NICs are supported for virtual machines configured with SR-IOV:
n n n
Products based on the Intel 82599ES 10 Gigabit Ethernet Controller Family (Niantic) Products based on the Intel Ethernet Controller X540 Family (Twinville) Emulex OneConnect (BE3)
Upgrading from vSphere 5.0 and Earlier

If you upgrade from vSphere 5.0 or earlier to vSphere 5.5 or later, SR-IOV support is not available until you update the NIC drivers for the vSphere release. Firmware and drivers that support SR-IOV must be enabled for NICs so that SR-IOV functionality can operate.
Upgrading from vSphere 5.1

Although SR-IOV is supported on ESXi 5.1 hosts satisfying the requirements, you cannot configure SR-IOV on them by using the vSphere Web Client. Use the max_vfs parameter of the NIC driver module to enable SR-IOV on these hosts. See Enabling SR-IOV by Using Host Profiles in the vSphere Web Client or Through an ESXCLI Command, on page 142. You also cannot assign an SR-IOV passthrough adapter to a virtual machine on such a host. The adapter is available for virtual machines that are compatible with ESXi 5.5 and later. Although a vCenter Server 5.5 release might be managing an ESXi 5.1 host, the configuration is the same as in release 5.1. You must add a PCI device to the virtual machine hardware and manually select a VF for the device.
SR-IOV Component Architecture and Interaction

vSphere SR-IOV support relies on the interaction between the virtual functions (VFs) and the physical function (PF) of the NIC port for better performance, and interaction between the driver of the PF and the host switch for traffic control. In a host that runs virtual machine traffic on top of SR-IOV physical adapters, virtual machine adapters directly contact the virtual functions to communicate data. However, the ability to configure networks is based on the active policies for the port holding the virtual machines. On an ESXi host without SR-IOV, the virtual switch sends external network traffic through its ports on the host from or to the physical adapter for the relevant port group. The virtual switch also applies the networking policies on managed packets.
136
VMware, Inc.
Figure 71. Data and Configuration Paths in the SR-IOV Support of vSphere
VM VF driver VM VF driver VM VM
Port group Uplink port Virtual Switch 3 4 Uplink port
Port group
Virtual Switch PF driver
PF driver VMware ESXi 1 2 5
IOMMU PCI Express PCI Express
VF
VF
PF
PF Physical network adapter without SR-IOV Port association Data path Control path
Physical network adapter with SR-IOV
Data Path in SR-IOV

After the virtual machine network adapter is assigned to a virtual function, the VF driver in the guest operating system uses the I/O memory management unit (IOMMU) technology to access the virtual function that must receive or send the data over the network. The VMkernel, that is, the virtual switch in particular, does not process the data flow, which reduces the overall latency of SR-IOV enabled workloads.
Configuration Path in SR-IOV

If the guest operating system attempts to change the configuration of a virtual machine adapter mapped to a VF, the change takes place if it is allowed by the policy on the port associated with the virtual machine adapter. The configuration workflow consists of the following operations: 1 2 3 The guest operating system requests a configuration change on the VF. The VF forwards the request to the PF through a mailbox mechanism. The PF driver checks the configuration request with the virtual switch (standard switch or host proxy switch of a distributed switch).
VMware, Inc.
137
vSphere Networking
4 5
The virtual switch verifies the configuration request against the policy on the port with which the VF enabled virtual machine adapter is associated. The PF driver configures the VF if the new settings are in compliance with the port policy of the virtual machine adapter. For example, if the VF driver tries to modify the MAC address, the address remains the same if MAC address change is not allowed in the security policy for the port group or port. The guest operating system might show that the change is successful but a log message indicates that the operation has failed. As a result, the guest operating system and the virtual device save different MAC addresses. The network interface in the guest operating system might not be able to acquire an IP address and communicate. In this case, you have to reset the interface in the guest operating system to get the latest MAC address from the virtual device and acquire an IP address.
vSphere and Virtual Function Interaction

Virtual functions (VFs) are lightweight PCIe functions that contain all the resources necessary for data exchange but have a minimized set of configuration resources. Interaction between vSphere and VFs is limited.
n
VFs do not implement rate control in vSphere. Every VF can potentially use the entire bandwidth of a physical link. When a VF device is configured as a passthrough device on a virtual machine, the standby and hibernate functions for the virtual machine are not supported. The maximum number of VFs that you can create and the maximum number of VFs that you can use for passthrough are different. The maximum number of VFs that you can instantiate depends on the NIC capability and on the hardware configuration of the host. However, due to the limited number of interrupt vectors available for passthrough devices, only a limited number of all instantiated VFs can be used on an ESXi host. Each ESXi host has a total of 256 interrupt vectors. When the host boots, devices on the host such as storage controllers, physical network adapters, and USB controllers consume a subset of the 256 vectors. If these devices require more than 128 vectors, the maximum number of potentially supported VFs is reduced. For example, out of 64 VFs that can be instantiated on an Intel NIC, the host can use up to 43 VFs for passthrough (128 / 3 = 42.6) if all 128 interrupt vectors are available.
If you have Intel and Emulex NICs present with SR-IOV enabled, the number of VFs available for the Intel NICs depends on how many VFs are configured for the Emulex NIC, and the reverse. You can use the following formula to estimate the maximum number of VFs for use if all 128 interrupt vectors are available for passthrough:
3X + 2Y < 128
where X is the number of Intel VFs, and Y is the number of Emulex VFs. This number might be smaller if other types of devices on the host use more than 128 interrupt vectors from the total of 256 vectors on the host.
n
vSphere SR-IOV supports up to 43 VFs on supported Intel NICs and up to 64 VFs on supported Emulex NICs. If a supported Intel NIC loses connection, all VFs from the physical NIC stop communication completely, including that between VFs. If a supported Emulex NIC loses connection, all VFs stop communication with the external environment, but communication between VFs still works VF drivers offer many different features, such as IPv6 support, TSO, and LRO checksum. See the technical documentation of the NIC vendor for more details.
138
VMware, Inc.
DirectPath I/O vs SR-IOV

SR-IOV offers performance benefits and tradeoffs similar to those of DirectPath I/O. DirectPath I/O and SRIOV have similar functionality but you use them to accomplish different things. SR-IOV is beneficial in workloads with very high packet rates or very low latency requirements. Like DirectPath I/O, SR-IOV is not compatible with certain core virtualization features, such as vMotion. SR-IOV does, however, allow for a single physical device to be shared amongst multiple guests. With DirectPath I/O you can map only one physical function to one virtual machine. SR-IOV lets you share a single physical device, allowing multiple virtual machines to connect directly to the physical function.
Configure a Virtual Machine to Use SR-IOV in the vSphere Web Client

To use the capabilities of SR-IOV, you must enable the SR-IOV virtual functions on the host and connect a virtual machine to the functions. Prerequisites Verify that the configuration of your environment supports SR-IOV. See SR-IOV Support, on page 134. Procedure 1 Enable SR-IOV on a Host Physical Adapter in the vSphere Web Client on page 139 Before you can connect virtual machines to virtual functions, use the vSphere Web Client to enable SRIOV and set the number of virtual functions on your host. 2 Assign a Virtual Function as SR-IOV Passthrough Adapter to a Virtual Machine by Using the vSphere Web Client on page 140 To ensure that a virtual machine and a physical NIC can exchange data, you must associate the virtual machine with one or more virtual functions as SR-IOV passthrough network adapters. The traffic passes from an SR-IOV passthrough adapter to the physical adapter in compliance with the active policy on the associated port on the standard or distributed switch. To examine which virtual function is assigned to an SR-IOV passthrough network adapter, on the Summary tab for the virtual machine expand the VM Hardware panel and check the properties of the adapter. The topology diagram of the switch marks virtual machine adapters that use virtual functions with the icon. What to do next Set up the traffic passing through the virtual functions attached to the virtual machine by using the networking policies on the switch, port group, and port. See Networking Options for the Traffic Related to an SR-IOV Enabled Virtual Machine, on page 141.
Enable SR-IOV on a Host Physical Adapter in the vSphere Web Client

Before you can connect virtual machines to virtual functions, use the vSphere Web Client to enable SR-IOV and set the number of virtual functions on your host. Procedure 1 2 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking and select Physical adapters. You can look at the SR-IOV property to see whether a physical adapter supports SR-IOV. 3 Select the physical adapter and click Edit adapter settings.
VMware, Inc.
139
vSphere Networking
4 5 6 7
Under SR-IOV, select Enabled from the Status drop-down menu. In the Number of virtual functions text box, type the number of virtual functions that you want to configure for the adapter. Click OK. Restart the host.
The virtual functions become active on the NIC port represented by the physical adapter entry. They appear in the PCI Devices list in the Settings tab for the host. You can use the esxcli network sriovnic vCLI commands to examine the configuration of virtual functions on the host. What to do next Associate a virtual machine with a virtual function through an SR-IOV passthrough network adapter.
Assign a Virtual Function as SR-IOV Passthrough Adapter to a Virtual Machine by Using the vSphere Web Client
To ensure that a virtual machine and a physical NIC can exchange data, you must associate the virtual machine with one or more virtual functions as SR-IOV passthrough network adapters. Prerequisites
n n
Verify that the virtual functions exist on the host. Verify that the passthrough networking devices for the virtual functions are active in the PCI Devices list on the Settings tab for the host. Verify that the virtual machine compatibility is ESXi 5.5 and later. Verify that Red Hat Enterprise Linux 6 and later or Windows has been selected as the guest operating system when the virtual machine was created.
n n
Procedure 1 Locate the virtual machine in the vSphere Web Client. a b 2 3 4 5 6 Select a datacenter, folder, cluster, resource pool, or host and click the Related Objects tab. Click Virtual Machines and select the virtual machine from the list.
Power off the virtual machine. On the Manage tab of the virtual machine, select Settings > VM Hardware. Click Edit and select the Virtual Hardware tab. From the New device drop-down menu, select Network and click Add. Expand the New Network section and connect the virtual machine to a port group. The virtual NIC does not use this port group for data traffic. The port group is used to extract the networking properties, for example VLAN tagging, to apply on the data traffic.
7 8 9
From the Adapter type drop-down menu, select SR-IOV passthrough. From the Physical function drop-down menu, select the physical adapter to back the passthrough virtual machine adapter. To allow changes in the MTU of packets from the guest operating system, use the Guest OS MTU Change drop-down menu.
140
VMware, Inc.
10
Expand the Memory section, select Reserve all guest memory (All locked) and click OK. I/O memory management unit (IOMMU) must reach all virtual machine memory so that the passthrough device can access the memory by using direct memory access (DMA).
11
Power on the virtual machine.
When you power on the virtual machine, the ESXi host selects a free virtual function from the physical adapter and maps it to the SR-IOV passthrough adapter. The host validates all properties of the virtual machine adapter and the underlying virtual function against the settings of the port group to which the virtual machine belongs.
Networking Options for the Traffic Related to an SR-IOV Enabled Virtual Machine
In vSphere 5.5 and later, you can configure certain networking features on a virtual machine adapter that is associated virtual function (VF). Use settings for the switch, for the port group, or for a port depending on the type of the virtual switch (standard or distributed) that handles the traffic. Table 72. Networking Options for a Virtual Machine Adapter That Uses a VF
Networking Option MTU size Security policy for VF traffic Description Change the size of the MTU, for example, to enable jumbo frames.
n
If the guest operating system changes the initially set MAC address of a virtual machine network adapter that uses a VF, accept or drop incoming frames for the new address by setting the MAC address changes option. Enable global promiscuous mode for virtual machine network adapters, including adapters that use VFs.
VLAN tagging mode
Configure VLAN tagging in the standard or distributed switch, that is, enable VLAN Switch Tagging (VST) mode, or let the tagged traffic reach the virtual machines that are associated with VFs, that is, enable Virtual Guest Tagging (VGT).
Using an SR-IOV Physical Adapter to Handle Virtual Machine Traffic

In vSphere 5.5 and later, both the physical function (PF) and virtual functions (VFs) of an SR-IOV capable physical adapter can be configured to handle virtual machine traffic. The PF of an SR-IOV physical adapter controls the VFs that virtual machines use, and can carry the traffic flowing through the standard or distributed switch that handles the networking of these SR-IOV enabled virtual machines. The SR-IOV physical adapter works in different modes depending on whether it backs the traffic of the switch.
Mixed Mode
The physical adapter provides virtual functions to virtual machines attached to the switch and directly handles traffic from non SR-IOV virtual machines on the switch. You can check whether an SR-IOV physical adapter is in mixed mode in the topology diagram of the switch. icon in the list of physical adapters for a An SR-IOV physical adapter in mixed mode appears with the standard switch or in the list of uplink group adapters for a distributed switch.
VMware, Inc.
141
vSphere Networking
SR-IOV Only Mode

The physical adapter provides virtual functions to virtual machines connected to a virtual switch, but does not back traffic from non SR-IOV virtual machines on the switch. To verify whether the physical adapter is in SR-IOV only mode, examine the topology diagram of the switch. In this mode, the physical adapter is in a separate list called External SR-IOV Adapters and appears with the icon.
Non SR-IOV Mode

The physical adapter is not used for traffic related to VF aware virtual machines. It handles traffic from non SR-IOV virtual machines only.
Enabling SR-IOV by Using Host Profiles in the vSphere Web Client or Through an ESXCLI Command
You can configure the virtual functions on an ESXi host by using an ESXCLI command, or by using a host profile to set up multiple hosts simultaneously or to set up stateless hosts.
Enable SR-IOV in a Host Profile by Using the vSphere Web Client

For multiple hosts or a stateless host, you can configure the virtual functions of the physical NIC by using a host profile and apply the profile on a host by using Auto Deploy. For information about running ESXi by using Auto Deploy with host profiles, see the vSphere Installation and Setup documentation. You can also enable SR-IOV virtual functions on the host by using the esxcli system module parameters set vCLI command on the NIC driver parameter for virtual functions in accordance with the driver documentation. For more information about using vCLI commands, see vSphere Command-Line Interface Documentation. Prerequisites
n
Verify that the configuration of your environment supports SR-IOV. See SR-IOV Support, on page 134. Create a host profile based on the SR-IOV capable host. See the vSphere Host Profiles documentation.
Procedure 1 2 3 4 From the vSphere Web Client Home page, click Rules and Profiles > Host Profiles. Select the host profile from the list and click the Manage tab. Click Edit Host Profile and expand the General System Settings node. Expand Kernel Module Parameter and select the parameter of the physical function driver for creating virtual functions. For example, the parameter for the physical function driver of an Intel physical NIC is max_vfs. 5 In the Value text box, type a comma-separated list of valid virtual function numbers. Each list entry indicates the number of virtual functions that you want to configure for each physical function. A value of 0 ensures that SR-IOV is not enabled for that physical function. For example, if you have a dual port, set the value to x,y where x or y is the number of virtual functions you want to enable for a single port.
142
VMware, Inc.
0,10,10,10.
If the target number of virtual functions on a single host is 30, you might have two dual port cards set to
NOTE The number of virtual functions supported and available for configuration depends on your system configuration. 6 7 Click Finish. Remediate the host profile to the host as required.
The virtual functions appear in the PCI Devices list on the Settings tab for the host. What to do next Associate a virtual function with a virtual machine adapter by using the SR-IOV passthrough network adapter type. See Assign a Virtual Function as SR-IOV Passthrough Adapter to a Virtual Machine by Using the vSphere Web Client, on page 140.
Enable SR-IOV on a Host Physical Adapter by Using an ESXCLI Command

In certain troubleshooting situations or to configure hosts directly, you can run a console command on ESXi to create SR-IOV virtual functions on a physical adapter. You can create SR-IOV virtual functions on the host by manipulating the NIC driver parameter for virtual functions in accordance with the driver documentation. Prerequisites Install the vCLI package, deploy the vSphere Management Assistant (vMA) virtual machine, or use the ESXi Shell. See Getting Started with vSphere Command-Line Interfaces. Procedure 1 To create virtual functions by setting the parameter for virtual functions of the NIC driver, run the esxcli system module parameters set command at the command prompt.
esxcli system module parameters set -m driver -p vf_param=w,x,y,z
Where driver is the name of the NIC driver, and vf_param is the driver-specific parameter for creating the virtual function. You can use a comma-separated list to set values for the vf_param parameter, where each entry indicates the number of virtual functions for a port. A value of 0 ensures that SR-IOV is not enabled for that physical function. If you have two dual port NICs, you can set the value to w,x,y,z, where w,x,y, and z is the number of virtual functions you want to enable for a single port. For example, to create 30 virtual functions distributed on two dual port Intel cards by using the ixgbe driver, run the following command for the ixgbe driver and the max_vfs parameter:
esxcli system module parameters set -m ixgbe -p max_vfs=0,10,10,10
Restart the host to create the virtual functions.
What to do next Associate a virtual function with a virtual machine adapter by using the SR-IOV passthrough network adapter type. See Assign a Virtual Function as SR-IOV Passthrough Adapter to a Virtual Machine by Using the vSphere Web Client, on page 140.
VMware, Inc.
143
vSphere Networking
A Virtual Machine That Uses an SR-IOV Virtual Function Is Powered off Because the Host Is Out of Interrupt Vectors
On an ESXi host, one or more virtual machines that use SR-IOV virtual functions (VFs) for networking are powered off. Problem On an ESXi host, one or more virtual machines that use SR-IOV virtual functions (VFs) for networking are powered off when the total number of assigned virtual functions is close to the maximum number of VFs specified in the vSphere Configuration Maximums guide. The virtual machine log file vmware.log contains the following message about the VF:
PCIPassthruChangeIntrSettings: vf_name failed to register interrupt (error code 195887110)
The VMkernel log file vmkernel.log contains the following messages about the VF assigned to the virtual machine:
VMKPCIPassthru: 2565: BDF = vf_name intrType = 4 numVectors: 3 WARNING: IntrVector: 233: Out of interrupt vectors
Cause Each ESXi host has a total of 256 interrupt vectors. When the host boots, devices on the host such as storage controllers, physical network adapters, and USB controllers consume a subset of the 256 vectors. If these devices require more than 128 vectors, the maximum number of potentially supported VFs is reduced. When a virtual machine powers on and the guest operating system VF driver starts, interrupt vectors are consumed. If the required number of interrupt vectors is not available, the guest operating system shuts down unexpectedly without any error messages. No method presently exists to determine the number of interrupt vectors consumed or available on a host. This number depends on the hardware configuration of the host. Solution To be able to power on the virtual machines, reduce the total number of VFs assigned to virtual machines on the host. For example, change the SR-IOV network adapter of a virtual machine to an adapter that is connected to a vSphere Standard Switch or vSphere Distributed Switch.
144
VMware, Inc.
MAC Address Management
MAC addresses are used in the Layer 2 (Data Link Layer) of the network protocol stack to transmit frames to a recipient. In vSphere, vCenter Server generates MAC addresses for virtual machine adapters and VMkernel adapters, or you can assign addresses manually. Each network adapter manufacturer is assigned a unique three-byte prefix called an Organizationally Unique Identifier (OUI), which it can use to generate unique MAC addresses. VMware supports several address allocation mechanisms, each of them with a separate OUI:
n
Generated MAC addresses

n n
Assigned by vCenter Server Assigned by the ESXi host
n n
Manually set MAC addresses Generated for legacy virtual machines, but no longer used with ESXi
If you reconfigure the network adapter of a powered off virtual machine, for example by changing the automatic MAC address allocation type, or setting a static MAC address, vCenter Server resolves any MAC address conflict before the adapter reconfiguration takes effect. This chapter includes the following topics:
n n n
MAC Address Assignment from vCenter Server, on page 145 MAC Address Generation on ESXi Hosts, on page 149 Setting a Static MAC Address to a Virtual Machine, on page 150
MAC Address Assignment from vCenter Server

vSphere 5.1 and later provides several schemes for automatic allocation of MAC addresses in vCenter Server. You can select the scheme that best suits your requirements for MAC address duplication, OUI requirements for locally administered or universally administered addresses, and so on. The following schemes of MAC address generation are available in vCenter Server:
n n n
VMware OUI allocation, default allocation Prefix-based allocation Range-based allocation
VMware, Inc.
145
vSphere Networking
After the MAC address is generated, it does not change unless the virtual machine's MAC address conflicts with that of another registered virtual machine. The MAC address is saved in the configuration file of the virtual machine. NOTE If you use invalid prefix- or range-based allocation values, an error is logged in the vpxd.log file. vCenter Server does not allocate MAC addresses when provisioning a virtual machine.
Preventing MAC Address Conflicts

The MAC address of a powered off virtual machine is not checked against the addresses of running or suspended virtual machines. When a virtual machine is powered on again, it might acquire a different MAC address. The change might be caused by an address conflict with another virtual machine. While this virtual machine has been powered off, its MAC address has been assigned to another virtual machine that has been powered on. If you reconfigure the network adapter of a powered off virtual machine, for example, by changing the automatic MAC address allocation type or setting a static MAC address, vCenter Server resolves MAC address conflicts before the adapter reconfiguration takes effect. For information about resolving MAC address conflicts, see the vSphere Troubleshooting documentation.
VMware OUI Allocation

VMware Organizationally Unique Identifier (OUI) allocation assigns MAC addresses based on the default VMware OUI 00:50:56 and the vCenter Server ID. VMware OUI allocation is the default MAC address assignment model for virtual machines. The allocation works with up to 64 vCenter Server instances, and each vCenter Server can assign up to 64000 unique MAC addresses. The VMware OUI allocation scheme is suitable for small scale deployments.
MAC Address Format

According to the VMware OUI allocation scheme, a MAC address has the format 00:50:56:XX:YY:ZZ where 00:50:56 represents the VMware OUI, XX is calculated as (80 + vCenter Server ID), and YY and ZZ are
random two-digit hexadecimal numbers.

00:50:56:BF:YY:ZZ.
The addresses created through the VMware OUI allocation are in the range 00:50:56:80:YY:ZZ -
Prefix-Based MAC Address Allocation

On ESXi hosts 5.1 and later, you can use prefix-based allocation to specify an OUI other than the default one 00:50:56 by VMware, or to introduce Locally Administered MAC Addresses (LAA) for a larger address space. Prefix-based MAC address allocation overcomes the limits of the default VMware allocation to provide unique addresses in larger scale deployments. Introducing an LAA prefix leads to a very large MAC address space (2 to the power of 46) instead of an universally unique address OUI which can give only 16 million MAC addresses. Verify that the prefixes that you provide for different vCenter Server instances in the same network are unique. vCenter Server relies on the prefixes to avoid MAC address duplication issues. See the vSphere Troubleshooting documentation.
146
VMware, Inc.
Chapter 8 MAC Address Management
Range-Based MAC Address Allocation

On ESXi hosts 5.1 and later you can use range-based allocation to include or exclude ranges of Locally Administered Addresses (LAA). You specify one or more ranges using a starting and ending MAC addresses, for example, (02:50:68:00:00:02, 02:50:68:00:00:FF). MAC addresses are generated only from within the specified range. You can specify multiple ranges of LAA, and vCenter Server tracks the number of used addresses for each range. vCenter Server allocates MAC addresses from the first range that still has addresses available. vCenter Server checks for MAC address conflicts within its ranges. When using range-based allocation, you must provide different instances of vCenter Server with ranges that do not overlap. vCenter Server does not detect ranges that might be in conflict with other vCenter Server instances. See the vSphere Troubleshooting documentation for more information about resolving issues with duplicate MAC addresses.
Assigning a MAC Address

Use the vSphere Web Client to enable prefix-based or range-based MAC address allocation and to adjust the allocation parameters. If you are changing from one type of allocation to another, for example changing from the VMware OUI allocation to a range-based allocation, use the vSphere Web Client. However, when a schema is prefix-based or range-based and you want to change to a different allocation schema, you must edit the vpxd.cfd file manually and restart vCenter Server.
Change to or Adjust Range- or Prefixed-Based Allocations in the vSphere Web Client

By switching from the default VMware OUI to range- or prefixed-based MAC address allocation through the vSphere Web Client, you can avoid and resolve MAC address duplication conflicts in vSphere deployments. Change the allocation scheme from the default VMware OUI to range- or to prefixed-based allocation by using the Advanced Settings available for the vCenter Server instance in the vSphere Web Client. To switch from range- or prefixed-based allocation back to VMware OUI allocation, or between range- and prefixed-based allocation, edit the vpxd.cfg file manually. See Set or Change Allocation Type, on page 148. NOTE You should use prefix-based MAC address allocation in vCenter Server 5.1 and ESXi 5.1 hosts, and later. If a vCenter Server 5.1 instance manages hosts running ESXi versions earlier than ESXi 5.1, use VMware OUI prefix-based MAC address allocation. Virtual machines assigned non VMware OUI prefixed MAC addresses fail to power on on the pre-5.1 hosts. These hosts explicitly check if an assigned MAC address uses the VMware OUI 00:50:56 prefix. Procedure 1 2 3 Browse to a vCenter Server in the vSphere Web Client. Click the Manage tab, and select Settings > Advanced Settings. Click Edit.
VMware, Inc.
147
vSphere Networking
Add or edit parameters for the target allocation type. Use only one allocation type.
n
Change to prefix-based allocation.

Key config.vpxd.macAllocScheme.prefixScheme.prefix config.vpxd.macAllocScheme.prefixScheme.prefixLength Example Value 005026 23
prefix and prefixLength determine the range of MAC address prefixes that newly added vNICs have. prefix is the starting OUI of MAC addresses related to the vCenter Server instance, and prefixLength determines the length of the prefix in bits.
For example, the settings from the table result in vNIC MAC addresses starting with 00:50:26 or 00:50:27.
n
Change to range-based allocation.

Key config.vpxd.macAllocScheme.rangeScheme.range[X].begin config.vpxd.macAllocScheme.rangeScheme.range[X].end Example Value 005067000000 005067ffffff
X in range[X] stands for the range sequence number. For example, 0 in range[0] represents the allocation settings of the first range for MAC address allocation. 5 Click OK.
Set or Change Allocation Type

If you are changing from range- or prefixed-based allocation to the VMware OUI allocation, you must set the allocation type in the vpxd.cfd file and restart the vCenter Server. Prerequisites Decide on an allocation type before changing the vpxd.cfg file. For information on allocation types, see MAC Address Assignment from vCenter Server, on page 145 Procedure 1 On the host machine of vCenter Server, navigate to the directory that contains the configuration file:
n
On a Windows Server operating system, the location of the directory is vCenter Server home directory\Application Data\VMware\VMware VirtualCenter. On the vCenter Server Appliance, the location of the directory is /etc/vmware-vpx.
Open the vpxd.cfg file.
148
VMware, Inc.
Decide on an allocation type to use and enter the corresponding XML code in the file to configure the allocation type. The following are examples of XML code to use. NOTE Use only one allocation type.
u
VMware OUI allocation

<vpxd> <macAllocScheme> <VMwareOUI>true</VMwareOUI> </macAllocScheme> </vpxd>
Prefix-based allocation
<vpxd> <macAllocScheme> <prefixScheme> <prefix>005026</prefix> <prefixLength>23</prefixLength> </prefixScheme> </macAllocScheme> </vpxd>
Range-based allocation
<vpxd> <macAllocScheme> <rangeScheme> <range id="0"> <begin>005067000001</begin> <end>005067000001</end> </range> </rangeScheme> </macAllocScheme> </vpxd>
4 5
Save the vpxd.cfg. Restart the vCenter Server host.
MAC Address Generation on ESXi Hosts

An ESXi host generates the MAC address for a virtual machine adapter when the host is not connected to vCenter Server. Such addresses have a separate VMware OUI to avoid conflicts. The ESXi host generates the MAC address for a virtual machine adapter in one of the following cases:
n n
The host is not connected to vCenter Server. The virtual machine configuration file does not contain the MAC address and information about the MAC address allocation type.
MAC Address Format

The host generates MAC addresses that consists of the VMware OUI 00:0C:29 and the last three octets in hexadecimal format of the virtual machine UUID. The virtual machine UUID is based on a hash calculated by using the UUID of the ESXi physical machine and the path to the configuration file (.vmx) of the virtual machine.
VMware, Inc.
149
vSphere Networking
Preventing MAC Address Conflicts

All MAC addresses that have been assigned to network adapters of running and suspended virtual machines on a given physical machine are tracked for conflicts. If you import a virtual machine with a host-generated MAC address from one vCenter Server to another, select the I Copied It option when you power on the virtual machine to regenerate the address and avoid potential conflicts in the target vCenter Server or between the vCenter Server systems.
Setting a Static MAC Address to a Virtual Machine

In most network deployments, generated MAC addresses are a good approach. However, you might need to set a static MAC address for a virtual machine adapter with unique value. The following cases show when you might set a static MAC address:
n
Virtual machine adapters on different physical hosts share the same subnet and are assigned the same MAC address, causing a conflict. Ensure that a virtual machine adapter always has the same MAC address.
By default, VMware uses the Organizationally Unique Identifier (OUI) 00:50:56 for manually generated addresses, but all unique manually generated addresses are supported. NOTE Make sure that no other non-VMware devices use addresses assigned to VMware components. For example, you might have physical servers in the same subnet, which use 11:11:11:11:11:11, 22:22:22:22:22:22 as static MAC addresses. The physical servers do not belong to the vCenter Server inventory, and vCenter Server is not able to check for address collision.
VMware OUI in Static MAC Addresses

By default, static MAC addresses have the VMware Organizationally Unique Identifier (OUI) as the prefix. However, the range of free address provided by the VMware OUI is restrictions. If you choose to use the VMware OUI, part of the range is reserved for use by vCenter Server, host physical NICs, virtual NICs, and for future use. You can set a static MAC address that contains the VMware OUI prefix in compliance with the following format:
00:50:56:XX:YY:ZZ
where XX is a valid hexadecimal number between 00 and 3F, and YY and ZZ are valid hexadecimal numbers between 00 and FF. To avoid conflict with MAC addresses that are generated by vCenter Server or are assigned to VMkernel adapters for infrastructure traffic, the value for XX must not be greater than 3F. The maximum value for a manually generated MAC address is as follows.
00:50:56:3F:FF:FF
To avoid conflicts between the generated MAC addresses and the manually assigned ones, select a unique value for XX:YY:ZZ from your hard-coded addresses.
150
VMware, Inc.
Assign a Static MAC Address with the vSphere Web Client

You can assign static MAC addresses to the virtual NIC of a powered off virtual machine by using the vSphere Web Client. Procedure 1 Locate the virtual machine in the vSphere Web Client. a b 2 3 4 5 6 7 8 Select a datacenter, folder, cluster, resource pool, or host and click the Related Objects tab. Click Virtual Machines and select the virtual machine from the list.
Power off the virtual machine. On the Manage tab of the virtual machine, select Settings > VM Hardware. Click Edit and select the Virtual Hardware tab. In the Virtual Hardware tab, expand the network adapter section. Under MAC Address, select Manual from the drop-down menu. Type the static MAC address, and click OK. Power on the virtual machine.
Assign a Static MAC Address in the Virtual Machine Configuration File

To set a static MAC address for a virtual machine, you can edit the configuration file of the virtual machine by using the vSphere Web Client. Procedure 1 Locate the virtual machine in the vSphere Web Client. a b 2 3 4 5 6 Select a datacenter, folder, cluster, resource pool, or host and click the Related Objects tab. Click Virtual Machines and select the virtual machine from the list.
Power off the virtual machine. On the Manage tab of the virtual machine, select Settings. On the VM Options tab, expand Advanced. Click Edit Configuration. To assign a static MAC address, add or edit parameters as required.
Parameter ethernetX.addressType ethernetX.address Value static MAC_address_of_the_virtual_NIC
X next to ethernet stands for the sequence number of the virtual NIC in the virtual machine. For example, 0 in ethernet0 represents the settings of the first virtual NIC device added to the virtual machine. 7 8 Click OK. Power on the virtual machine.
VMware, Inc.
151
vSphere Networking
152
VMware, Inc.
Advanced Networking
Advanced networking configuration options allow you greater control over your vSphere networking environment. This chapter includes the following topics:
n n n n n n n n
Enable or Disable IPv6 Support on a Host by Using the vSphere Web Client, on page 153 Working With Port Mirroring, on page 154 Configure NetFlow Settings with the vSphere Web Client, on page 161 Switch Discovery Protocol, on page 161 Mounting NFS Volumes, on page 163 Networking Rollback and Recovery, on page 163 Configuring Protocol Profiles for Virtual Machine Networking, on page 166 Stateless Network Deployment, on page 170
Enable or Disable IPv6 Support on a Host by Using the vSphere Web Client
The IPv6 support in vSphere lets hosts work in an IPv6 network that has a very large address space, enhanced multicasting, simplified routing, and so on. IPv6 is designated by the Internet Engineering Task Force as the successor to IPv4. The most obvious advantage of IPv6 to IPv4 is address length. IPv6 uses 128-bit addresses rather than the 32-bit addresses used by IPv4. This increase resolves the problem of address exhaustion and eliminates the need for network address translation. Other differences include link-local addresses that appear as the interface is initialized, addresses that are set by router advertisements, and the ability to have multiple IPv6 addresses on an interface. In ESXi 5.1 and later releases, IPv6 is enabled by default. Prerequisites Required privilege: Host.Configuration.Network.Configuration. Procedure 1 2 3 4 In the vSphere Web Client, navigate to the host. On the Manage tab, click Networking and select Advanced. Click Edit. From the IPv6 support drop-down menu, enable or disable IPv6 support.
VMware, Inc.
153
vSphere Networking
5 6
Click OK. Reboot the host to apply the changes in the IPv6 support.
What to do next Configure the IPv6 settings of VMkernel adapters, for example, of the management network. See Edit a VMkernel Adapter Configuration in the vSphere Web Client, on page 74.
Working With Port Mirroring

Port mirroring allows you to mirror a distributed port's traffic to other distributed ports or specific physical switch ports. Port mirroring is used on a switch to send a copy of packets seen on one switch port (or an entire VLAN) to a monitoring connection on another switch port. Port mirroring is used to analyze and debug data or diagnose errors on a network.
Port Mirroring Version Compatibility

Certain port mirroring functionality in vSphere 5.1 and later depends on which version of vCenter Server, vSphere distributed switch, and host you use, and how you use these aspects of vSphere together. Table 91. Port mirroring compatibility
vCenter Server version vSphere 5.1 and later vSphere distributed switch version vSphere 5.1 and later Host version vSphere 5.1 and later vSphere 5.1 port mirroring functionality vSphere 5.1 port mirroring is available for use. Features for vSphere 5.0 and earlier port mirroring are not available. vSphere 5.0 and earlier hosts can be added to vSphere 5.1 vCenter Server, but cannot be added to distributed switches version 5.1 and later. vSpherevCenter Server version 5.1 and later can configure port mirroring on a vSphere 5.0 distributed switch. Hosts running vSphere 5.1 can be added to vSphere 5.0 distributed switches and support vSphere 5.0 port mirroring. Port mirroring is not supported. A vSphere 5.1 host cannot be added to vCenter Server 5.0 and earlier.
vSphere 5.1 and later
vSphere 5.0 and earlier
vSphere 5.0
vSphere 5.0
vSphere 5.0
vSphere 5.1 and later vSphere 5.0 and earlier
Pre-vSphere 5.0 vSphere 5.0 and earlier
vSphere 5.5 and earlier vSphere 5.1
If you use a host profile with port mirroring settings, the host profile must be adapted to the new version of port mirroring in vSphere 5.1 and later.
154
VMware, Inc.
Chapter 9 Advanced Networking
Port Mirroring Interoperability

There are some interoperability issues to consider when using vSphere 5.1 port mirroring with other features of vSphere.
vMotion
vMotion functions differently depending on which vSphere 5.1 port mirroring session type you select. During vMotion, a mirroring path could be temporarily invalid, but is restored when vMotion completes. Table 92. vMotion Interoperability with port mirroring
Port mirroring session type Distributed Port Mirroring Source and destination Non-uplink distributed port source and destination Interoperable with vMotion Yes Functionality Port mirroring between distributed ports can only be local. If the source and destination are on different hosts due to vMotion, mirroring between them will not work. However, if the source and destination move to the same host, port mirroring works. When a source distributed port is moved from host A to host B, the original mirroring path from the source port to A's uplink is removed on A, and a new mirroring path from the source port to B's uplink is created on B. Which uplink is used is determined by the uplink name specified in session. Uplinks can not be moved by vMotion.
Remote Mirroring Source
Non-uplink distributed port source
Yes
Uplink port destinations Remote Mirroring Destination VLAN source Non-uplink distributed port destination
No No Yes
When a destination distributed port is moved from host A to host B, all original mirroring paths from source VLANs to the destination port are moved from A to B. When a source distributed port is moved from host A to host B, all original mirroring paths from the source port to destination IPs are moved from A to B.
Encapsulated Remote Mirroring (L3) Source
Non-uplink distributed port source
Yes
IP destination
No
VMware, Inc.
155
vSphere Networking
Table 92. vMotion Interoperability with port mirroring (Continued)

Port mirroring session type Distributed Port Mirroring (legacy) Source and destination IP source Non-uplink distributed port destination Interoperable with vMotion No No When a destination distributed port is moved from host A to host B, all original mirroring paths from source IPs to the destination port are invalid because the port mirroring session source still sees the destination on A. Functionality
TSO and LRO

TCP Segmentation Offload (TSO) and large receive offload (LRO) might cause the number of mirroring packets to not equal to the number of mirrored packets. When TSO is enabled on a vNIC, the vNIC might send a large packet to a distributed switch. When LRO is enabled on a vNIC, small packets sent to it might be merged into a large packet.
Source TSO TSO Any source Destination LRO Any destination LRO Description Packets from the source vNIC might be large packets, and whether they are split is determined by whether their sizes are larger than the destination vNIC LRO limitation. Packets from the source vNIC might be large packets, and they are split to standard packets at the destination vNIC. Packets from the source vNIC are standard packets, and they might be merged into larger packets at the destination vNIC.
Create a Port Mirroring Session with the vSphere Web Client

Create a port mirroring session with the vSphere Web Client to mirror vSphere distributed switch traffic to ports, uplinks, and agents remote IP addresses. Prerequisites Create a vSphere distributed switch version 5.0.0 or later. Procedure 1 2 Select Port Mirroring Session Type with the vSphere Web Client on page 157 To begin a port mirroring session, you must specify the type of port mirroring session. Specify Port Mirroring Name and Session Details with the vSphere Web Client on page 157 To continue creating a port mirroring session, specify the name, description, and session details for the new port mirroring session. 3 Select Port Mirroring Sources with the vSphere Web Client on page 158 To continue creating a port mirroring session, select sources and traffic direction for the new port mirroring session. 4 Select Port Mirroring Destinations and Verify Settings with the vSphere Web Client on page 158 To complete the creation of a port mirroring session, select ports or uplinks as destinations for the port mirroring session.
156
VMware, Inc.
Select Port Mirroring Session Type with the vSphere Web Client
To begin a port mirroring session, you must specify the type of port mirroring session. Procedure 1 2 3 4 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab and select Settings > Port Mirroring Click New. Select the session type for the port mirroring session.
Option Distributed Port Mirroring Description Mirror packets from a number of distributed ports to other distributed ports on the same host. If the source and the destination are on different hosts, this session type does not function. Mirror packets from a number of distributed ports to specific uplink ports on the corresponding host. Mirror packets from a number of VLANs to distributed ports. Mirror packets from a number of distributed ports to remote agents IP addresses. The virtual machines traffic is mirrored to a remote physical destination through an IP tunnel. Mirror packets from a number of distributed ports to a number of distributed ports and/or uplink ports on the corresponding host.
Remote Mirroring Source Remote Mirroring Destination Encapsulated Remote Mirroring (L3) Source Distributed Port Mirroring (legacy)
Click Next.
Specify Port Mirroring Name and Session Details with the vSphere Web Client
To continue creating a port mirroring session, specify the name, description, and session details for the new port mirroring session. Procedure 1 Set the session properties. Different options are available for configuration depending on which session type you selected.
Option Name Status Session type Normal I/O on destination ports Description You can enter a unique name for the port mirroring session, or accept the automatically generated session name. Use the drop down menu to enable or disable the session. Displays the type of session you selected. Use the drop-down menu to allow or disallow normal I/O on destination ports. This property is only available for uplink and distributed port destinations. If you disallow this option, mirrored traffic will be allowed out on destination ports, but no traffic will be allowed in. Use the check box to enable mirrored packet length in bytes. This puts a limit on the size of mirrored frames. If this option is selected, all mirrored frames are truncated to the specified length. Select the rate at which packets are sampled. This is enabled by default for all port mirroring sessions except legacy sessions. You have the option to enter a description of the port mirroring session configuration.
Mirrored packet length (Bytes)
Sampling rate Description
Click Next.
VMware, Inc.
157
vSphere Networking
Select Port Mirroring Sources with the vSphere Web Client

To continue creating a port mirroring session, select sources and traffic direction for the new port mirroring session. You can create a port mirroring session without setting the source and destinations. When a source and destination are not set, a port mirroring session is created without the mirroring path. This allows you to create a port mirroring session with the correct properties set. Once the properties are set, you can edit the port mirroring session to add the source and destination information. Procedure 1 Select the source of the traffic to be mirrored and the traffic direction. Depending on the type of port mirroring session you selected, different options are available for configuration.
Option Add existing ports from a list Description Click Select distributed ports. A dialog box displays a list of existing ports. Select the check box next to the distributed port and click OK. You can choose more than one distributed port. Click Add distributed ports, enter the port number and click OK. After adding ports, select the port in the list and click the ingress, egress, or ingress/egress button. Your choice appears in the Traffic Direction column. If you selected a Remote Mirroring Destination sessions type, you must specify the source VLAN. ClickAdd to add a VLAN ID. Edit the ID by using the up and down arrows, or clicking in the field and entering the VLAN ID manually.
Add existing ports by port number Set the traffic direction Specify the source VLAN
Click Next.
Select Port Mirroring Destinations and Verify Settings with the vSphere Web Client
To complete the creation of a port mirroring session, select ports or uplinks as destinations for the port mirroring session. You can create a port mirroring session without setting the source and destinations. When a source and destination are not set, a port mirroring session is created without the mirroring path. This allows you to create a port mirroring session with the correct properties set. Once the properties are set, you can edit the port mirroring session to add the source and destination information. Port mirroring is checked against the VLAN forwarding policy. If the VLAN of the original frames is not equal to or trunked by the destination port, the frames are not mirrored. Procedure 1 Select the destination for the port mirroring session. Depending on which type of session you chose, different options are available.
Option Select a destination distributed port Description Click Select distributed ports to select ports from a list, or click Add distributed ports to add ports by port number. You can add more than one distributed port. Select an available uplink from the list and click Add to add the uplink to the port mirroring session. You can select more than one uplink.
Select an uplink
158
VMware, Inc.
Option Select ports or uplinks
Description Click Select distributed ports to select ports from a list, or click Add distributed ports to add ports by port number. You can add more than one distributed port. Click Add uplinks to add uplinks as the destination. Select uplinks from the list and click OK. Click Add. A new list entry is created. Select the entry and either click Edit to enter the IP address, or click directly in the IP Address field and type the IP address. A warning appears if the IP address is invalid.
Specify IP address
2 3 4 5
Click Next. Review the information that you entered for the port mirroring session on the Ready to complete page. (Optional) Use the Back button to edit the information. Click Finish.
The new port mirroring session appears in the Port Mirroring section of the Settings tab.
View Port Mirroring Session Details in the vSphere Web Client

View port mirroring session details, including status, sources, and destinations. Procedure 1 2 3 4 5 6 Browse to a distributed switch in the vSphere Web Client navigator. On the Manage tab click Settings > Port Mirroring. Select a port mirroring session from the list to display more detailed information at the bottom of the screen. Use the tabs to review configuration details. (Optional) Click New to add a new port mirroring session. (Optional) Click Edit to edit the details for the selected port mirroring session. (Optional) Click Remove to delete the selected port mirroring session.
Edit Port Mirroring Session Details, Sources, and Destinations with the vSphere Web Client
Edit the details of a port mirroring session, including name, description, status, sources, and destinations. Procedure 1 2 3 4 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab and select Settings > Port Mirroring. Select a port mirroring session from the list and click Edit. On the Properties page, edit the session properties. Depending on the type of port mirroring session being edited, different options are available for configuration.
Option Name Status Description You can enter a unique name for the port mirroring session, or accept the automatically generated session name. Use the drop-down menu to enable or disable the session.
VMware, Inc.
159
vSphere Networking
Option Normal I/O on destination ports
Description Use the drop-down menu to allow or disallow normal I/O on destination ports. This property is only available for uplink and distributed port destinations. If you do not select this option, mirrored traffic will be allowed out on destination ports, but no traffic will be allowed in. Enter a valid VLAN ID in the field. This information is required for Remote Mirroring Source port mirroring sessions. Mark the check box next to Preserve original VLAN to create a VLAN ID that encapsulates all frames at the destination ports. If the original frames have a VLAN and Preserve original VLAN is not selected, the encapsulation VLAN replaces the original VLAN. Use the check box to enable mirrored packet length in bytes. This puts a limit on the size of mirrored frames. If this option is selected, all mirrored frames are truncated to the specified length. You have the option to enter a description of the port mirroring session configuration.
Encapsulated VLAN ID
Mirrored packet length (Bytes)
Description
On the Sources page, edit sources for the port mirroring session. Depending on the type of port mirroring session being edited, different options are available for configuration.
Option Add existing ports from a list Description Click the Select distributed ports button. A dialog opens with a list of existing ports. Select the check box next to the distributed port and click OK. You can choose more than one distributed port. Click the Add distributed ports button, enter the port number and click OK. After adding ports, select the port in the list and click the ingress, egress, or ingress/egress button. Your choice is displayed in the Traffic Direction column. If you selected a Remote Mirroring Destination sessions type, you must specify the source VLAN. Click the Add button to add a VLAN ID. Edit the ID by either using the up and down arrows, or clicking in the field and entering the VLAN ID manually.
Add existing ports by port number Set the traffic direction
Specify the source VLAN
In the Destinations section, edit the destinations for the port mirroring session. Depending on the type of port mirroring session being edited, different options are available for configuration.
Option Select a destination distributed port Description Click the Select distributed ports button to select ports from a list, or click the Add distributed ports button to add ports by port number. You can add more than one distributed port. Select an available uplink from the list and click Add > to add the uplink to the port mirroring session. You can select more than one uplink. Click the Select distributed ports button to select ports from a list, or click the Add distributed ports button to add ports by port number. You can add more than one distributed port. Click theAdd uplinks... button to add uplinks as the destination. Select uplinks from the list and click OK. Click the Add button. A new list entry is created. Select the entry and either click the Edit button to enter the IP address, or click directly into the IP Address field and enter the IP address. A warning dialog opens if the IP address is invalid.
Select a uplinks Select ports or uplinks
Specify IP address
160
VMware, Inc.
Click OK.
Configure NetFlow Settings with the vSphere Web Client

NetFlow is a network analysis tool that you can use to watch network monitoring and virtual machine traffic. NetFlow is available on vSphere distributed switches version 5.0.0 and later. Procedure 1 2 3 4 Browse to a distributed switch version 5.0.0 or later in the vSphere Web Client navigator. Right-click the distributed switch in the navigator and select All vCenter Actions > Edit Netflow. Type the IP address and Port of the NetFlow collector. Type the Switch IP address. With an IP address to the vSphere distributed switch, the NetFlow collector can interact with the vSphere distributed switch as a single switch, rather than interacting with a separate, unrelated switch for each associated host. 5 6 (Optional) Set the Active flow export timeout and Idle flow export timeout in seconds. (Optional) Set the Sampling Rate. The sampling rate determines what portion of data NetFlow collects, with the sampling rate number determining how often NetFlow collects the packets. A collector with a sampling rate of 2 collects data from every other packet. A collector with a sampling rate of 5 collects data from every fifth packet. 7 (Optional) Enable or disable Process internal flows only with the drop-down menu. When enabled, only data on network activity between virtual machines on the same host is collected. 8 Click OK.
Switch Discovery Protocol

Switch discovery protocols help vSphere administrators to determine which port of the physical switch is connected to a vSphere standard switch or vSphere distributed switch. vSphere 5.0 and later supports Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP). CDP is available for vSphere standard switches and vSphere distributed switches connected to Cisco physical switches. LLDP is available for vSphere distributed switches version 5.0.0 and later. When CDP or LLDP is enabled for a particular vSphere distributed switch or vSphere standard switch, you can view properties of the peer physical switch such as device ID, software version, and timeout from the vSphere Web Client.
Enable Cisco Discovery Protocol on a vSphere Distributed Switch with the vSphere Web Client
Cisco Discovery Protocol (CDP) allows vSphere administrators to determine which port of a physical Cisco switch connects to a vSphere standard switch or vSphere distributed switch. When CDP is enabled for a vSphere distributed switch, you can view the properties of the Cisco switch such as device ID, software version, and timeout. Procedure 1 2 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and click Settings > Properties.
VMware, Inc.
161
vSphere Networking
3 4 5 6
Click Edit. Click Advanced. In the Discovery Protocol section, select Cisco Discovery Protocol from the Type drop-down menu . Set the Operation from the drop-down menu.
Option Listen Description ESXi detects and displays information about the associated Cisco switch port, but information about the vSphere distributed switch is not available to the Cisco switch administrator. ESXi makes information about the vSphere distributed switch available to the Cisco switch administrator, but does not detect and display information about the Cisco switch. ESXi detects and displays information about the associated Cisco switch and makes information about the vSphere distributed switch available to the Cisco switch administrator.
Advertise
Both
Click OK.
Enable Link Layer Discovery Protocol on a vSphere Distributed Switch in the vSphere Web Client
With Link Layer Discovery Protocol (LLDP), vSphere administrators can determine which physical switch port connects to a given vSphere distributed switch. When LLDP is enabled for a particular distributed switch, you can view properties of the physical switch (such as chassis ID, system name and description, and device capabilities) from the vSphere Web Client. LLDP is available only on vSphere distributed switch version 5.0.0 and later. Procedure 1 2 3 4 5 6 Browse to a distributed switch in the vSphere Web Client navigator. Click the Manage tab, and select Settings > Properties. Click Edit. Click Advanced. Select Link Layer Discovery Protocol from the Type drop-down menu. Set Operation to Listen, Advertise, or Both.
Operation Listen Description ESXi detects and displays information about the associated physical switch port, but information about the vSphere distributed switch is not available to the switch administrator. ESXi makes information about the vSphere distributed switch available to the switch administrator, but does not detect and display information about the physical switch. ESXi detects and displays information about the associated physical switch and makes information about the vSphere distributed switch available to the switch administrator.
Advertise
Both
Click OK.
162
VMware, Inc.
View Switch Information with the vSphere Web Client

When CDP or LLDP is set to Listen or Both, you can view physical switch information from the vSphere Web Client. Procedure 1 2 3 Browse to a host in the vSphere Web Client navigator. Click the Manage tab, and click Networking > Physical adapters. Select a physical adapter from the list to view detailed information.
Depending on the enabled switch discovery protocol, the properties of the switch appear under Cisco Discovery Protocol or Link Layer Discovery Protocol. If the information is available in the network, under Peer device capability you can see the system capabilities of the switch.
Mounting NFS Volumes

ESXi supports VMkernel-based NFS mounts for storing virtual disks on NFS datastores. In addition to storing virtual disks on NFS datastores, you can also use NFS Datastores as a central repository for ISO images and virtual machine templates. For more information about creating NFS datastores, see vSphere Storage. ESXi supports NFS version 3 over Layer 2 and Layer 3 Network switches. Host servers and NFS storage arrays must be on different subnets and the network switch must handle the routing information.
Networking Rollback and Recovery

In vSphere 5.1 and later, you can prevent and recover from network misconfiguration by using rollback, backup configuration files or previous configurations. vSphere 5.1 and later can rollback to previous valid networking configuration if a misconfiguration of the management network occurs. To recover from misconfiguration, you can connect directly to a host to fix any networking issues through the DCUI. Rollback is available for use on both standard and distributed switches.
vSphere Networking Rollback

By rolling configuration changes back, vSphere protects hosts from losing connection to vCenter Server as a result from misconfiguration of the management network. In vSphere 5.1 and later, networking rollback is enabled by default. However, you can enable or disable rollbacks at the vCenter Server level.
Host Networking Rollbacks

Host networking rollbacks occur when an invalid change is made to the networking configuration for the connection with vCenter Server. Every network change that disconnects a host also triggers a rollback. The following examples of changes to the host networking configuration might trigger a rollback:
n n n
Updating the speed or duplex of a physical NIC. Updating DNS and routing settings. Updating teaming and failover policies or traffic shaping policies of a standard port group that contains the management VMkernel network adapter. Updating the VLAN of a standard port group that contains the management VMkernel network adapter.
VMware, Inc.
163
vSphere Networking
Increasing the MTU of management VMkernel network adapter and its switch to values not supported by the physical infrastructure. Changing the IP settings of management VMkernel network adapters. Removing the management VMkernel network adapter from a standard or distributed switch. Removing a physical NIC of a standard or distributed switch containing the management VMkernel network adapter.
n n n
If a network disconnects for any of these reasons, the task fails and the host reverts to the last valid configuration.
vSphere Distributed Switch Rollbacks

Distributed switch rollbacks occur when invalid updates are made to distributed switches, distributed port groups, or distributed ports. The following changes to the distributed switch configuration trigger a rollback:
n n
Changing the MTU of a distributed switch. Changing the following settings in the distributed port group of the management VMkernel network adapter:
n n n
Teaming and failover VLAN Traffic shaping
n n
Blocking all ports in the distributed port group containing the management VMkernel network adapter. Overriding the policies on at the level of the distributed port for the management VMkernel network adapter.
If a configuration becomes invalid because of any of the changes, one or more hosts might become out of synchronization with the distributed switch. If you know where the conflicting configuration setting is located, you can manually correct the setting. For example, if you have migrated a management VMkernel network adapter to a new VLAN, the VLAN might not be actually trunked on the physical switch. When you correct the physical switch configuration, the next distributed switch-to-host synchronization will resolve the configuration problem. If you are not sure where the problem exists, you can restore the state of the distributed switch or distributed port group to an earlier configuration. See Restore a vSphere Distributed Port Group Configuration with the vSphere Web Client, on page 48.
Disable Network Rollback with the vSphere Web Client

Rollback is enabled by default in vSphere 5.1 and later. You can disable rollback in vCenter Server using the vSphere Web Client. Procedure 1 2 3 4 Browse to a vCenter Server instance in the vSphere Web Client navigator. Click the Manage tab, and select Settings.. Select Advanced Settings and click Edit. Select the config.vpxd.network.rollback key, and change the value to false. If the key is not present, you can add it and set the value to false. 5 6 Click OK. Restart vCenter Server to apply the changes.
164
VMware, Inc.
Disable Network Rollback by Using the vCenter Server Configuration File

Rollback is enabled by default in vSphere 5.1 and later. You can disable rollback by editing the vpxd.cfg configuration file of vCenter Server directly. Procedure 1 On the host machine of vCenter Server, navigate to the directory that contains the configuration file:
n directory\Application Data\VMware\VMware VirtualCenter. n
On a Windows Server operating system, the location of the directory is vCenter Server home
On the vCenter Server Appliance, the location of the directory is /etc/vmware-vpx.
2 3
Open the vpxd.cfg file for editing. In the <network> element, set the <rollback> element to false:
<config> <vpxd> <network> <rollback>false</rollback> </network> </vpxd> </config>
4 5
Save and close the file. Restart the vCenter Server system.
Restore a Previous Networking Configuration with the vSphere Web Client

You can restore a previous configuration of a vSphere distributed switch or port group to revoke invalid changes. Procedure 1 2 3 In the vSphere Web Client, navigate to the affected a vSphere distributed switch, or to a distributed or uplink port group. Right-click the affected switch or port group and select All vCenter Actions > Restore Configuration. If you are restoring the configuration of a distributed switch, provide a backup file. a b c 4 Click Browse and navigate to the location of the distributed switch backup file. Select Restore distributed switch and all port groups or Restore distributed switch only. Click Next.
If you are restoring the configuration of a distributed port group or uplink port group: a Select Restore to previous configuration or Restore configuration from a file. Restore to previous configuration reverts the configuration one step back. b c If restoring from a file, click Browse to navigate to the location of a port group backup file. Click Next.
Review the configuration information and click Finish.
VMware, Inc.
165
vSphere Networking
Resolve Errors in the Management Network Configuration on a vSphere Distributed Switch

In vSphere 5.1 and later, you can use the Direct Console User Interface (DCUI) to restore the connection between vCenter Server and a host that accesses the management network through a distributed switch. If networking rollback is disabled, misconfiguring the port group for the management network on the distributed switch leads to loss of connection between vCenter Server and the hosts added to the switch. You have to use the DCUI to connect each host individually. For more information about accessing and using the DCUI, see the vSphere Security documentation. NOTE Recovery of the management connection on a distributed switch is not supported on stateless ESXi instances. Prerequisites Verify that the management network is configured on a port group on the distributed switch. Procedure 1 2 3 4 Connect to the DCUI of the host. From the Network Restore Options menu, select Restore vDS. Configure the uplinks and optionally the VLAN for the management network. Apply the configuration.
The DCUI creates a local ephemeral port and applies the values you provided for the VLAN and uplinks. The DCUI moves the VMkernel adapter for the management network to the new local port to restore connectivity to vCenter Server. What to do next After the connection of the host to vCenter Server is restored, correct the configuration of the distributed port group and re-add the VMkernel adapter to the group.
Configuring Protocol Profiles for Virtual Machine Networking

A network protocol profile contains a pool of IPv4 and IPv6 addresses that vCenter Server assigns to vApps or to virtual machines with vApp functionality that are connected to port groups associated with the profile. Network protocol profiles also contain settings for the IP subnet, DNS, and HTTP proxy server. To configure the networking settings of virtual machines by using from network protocol profiles, perform the following operations:
n n n
Create network profiles at the level of a datacenter or a vSphere distributed switch. Associate a protocol profile with the port group of a vApp virtual machine. Enable the transient or static IP allocation policy from the settings of the vApp or from the vApp options of a virtual machine.
NOTE If you move a vApp or a virtual machine that retrieves its network settings from a protocol profile to another datacenter, to power it on you must assign a protocol profile to the connected port group on the destination datacenter.
166
VMware, Inc.
Add a Network Protocol Profile on page 167 A network protocol profile contains a pool of IPv4 and IPv6 addresses. vCenter Server assigns those resources to vApps or to virtual machines with vApp functionality that are connected to port groups associated with the profile.
Associate a Port Group with a Network Protocol Profile in the vSphere Web Client on page 169 To apply the range of IP addresses from a network protocol profile to a virtual machine that is a part of a vApp or has vApp functionality enabled, associate the profile with a port group that controls the networking of the virtual machine.
Configure a Virtual Machine or vApp to Use a Network Protocol Profile in the vSphere Web Client on page 169 After you associate a protocol profile to a port group of a standard switch or a distributed switch, enable the usage of profile on a virtual machine that is connected to the port group and is associated with a vApp or has the vApp options enabled.
Add a Network Protocol Profile

A network protocol profile contains a pool of IPv4 and IPv6 addresses. vCenter Server assigns those resources to vApps or to virtual machines with vApp functionality that are connected to port groups associated with the profile. Network protocol profiles also contain settings for the IP subnet, DNS, and HTTP proxy server. Procedure 1 2 Navigate to a datacenter that is associated with the vApp and click the Manage tab. Click Network Protocol Profiles Existing network protocol profiles are listed. 3 Click the Add icon ( ) to add a new network protocol profile.
Select the Network Protocol Profile Name and Network

Name the network protocol profile and select the network that should use it. Procedure 1 2 Type the name of the network protocol profile. Select the networks that use this network protocol profile. A network can be associated with one network protocol profile at a time. 3 Click Next.
Specify Network Protocol Profile IPv4 Configuration

A network protocol profile contains a pool of IPv4 and IPv6 addresses for use by vApps. When you create a network protocol profile, you set up its IPv4 configuration. You can configure network protocol profile ranges for IPv4, IPv6, or both. vCenter Server uses these ranges to dynamically allocate IP addresses to virtual machines when a vApp is set up to use transient IP allocation. Procedure 1 2 Enter the IP Subnet and Gateway in their respective fields. Select DHCP Present to indicate that the DHCP server is available on this network.
VMware, Inc.
167
vSphere Networking
Enter the DNS server information. Specify the servers by IP addresses separated by a comma, semicolon, or space.
4 5
Select the Enable IP Pool check box to specify an IP pool range. If you enable IP Pools, enter a comma-separated list of host address ranges in the IP pool range field. A range consists of an IP address, a pound sign (#), and a number indicating the length of the range. The gateway and the ranges must be within the subnet. The ranges that you enter in the IP pool range field cannot include the gateway address. For example, 10.20.60.4#10, 10.20.61.0#2 indicates that the IPv4 addresses can range from 10.20.60.4 to 10.20.60.13 and 10.20.61.0 to 10.20.61.1.
Click Next.
Specify Network Protocol Profile IPv6 Configuration

A network protocol profile contains a pool of IPv4 and IPv6 addresses for use by vApps. When you create a network protocol profile, you set up its IPv6 configuration. You can configure network protocol profile ranges for IPv4, IPv6, or both.vCenter Server uses these ranges to dynamically allocate IP addresses to virtual machines when a vApp is set up to use transient IP allocation. Procedure 1 2 3 Enter the IP Subnet and Gateway in their respective fields. Select DHCP Present to indicate that the DHCP server is available on this network. Enter the DNS server information. Specify the servers by IP addresses separated by a comma, semicolon, or space. 4 5 Select the Enable IP Pool check box to specify an IP pool range. If you enable IP Pools, enter a comma-separated list of host address ranges in the IP pool range field. A range consists of an IP address, a pound sign (#), and a number indicating the length of the range. For example. assume that you specify the following IP pool range: fe80:0:0:0:2bff:fe59:5a:2b#10,fe80:0:0:0:2bff:fe59:5f:b1#2 Then the addresses are in this range: fe80:0:0:0:2bff:fe59:5a:2b - fe80:0:0:0:2bff:fe59:5a:34 and fe80:0:0:0:2bff:fe59:5f:b1 - fe80:0:0:0:2bff:fe59:5f:b2 The gateway and the ranges must be within the subnet. The ranges that you enter in the IP pool range field cannot include the gateway address. 6 Click Next.
Specify Network Protocol Profile DNS and Other Configuration

When you create a network protocol profile, you can specify the DNS domain, DNS search path, a host prefix, and HTTP proxy. Procedure 1 Enter the DNS domain.
168
VMware, Inc.
2 3
Enter the host prefix. Enter the DNS search path. The search paths are specified as a list of DNS domains separated by commas, semi-colons, or spaces.
Enter the server name and port number for the proxy server. The server name can optionally include a colon and a port number. For example, web-proxy:3912 is a valid proxy server.
Click Next.
Complete the Network Protocol Profile Creation

Procedure
u
Review the settings and click Finish to complete adding the network protocol profile.
Associate a Port Group with a Network Protocol Profile in the vSphere Web Client
To apply the range of IP addresses from a network protocol profile to a virtual machine that is a part of a vApp or has vApp functionality enabled, associate the profile with a port group that controls the networking of the virtual machine. You can associate a port group of a standard switch or a distributed port group of a distributed switch with a network protocol profile by using the settings of the group. Procedure 1 Navigate to a distributed port group of a vSphere distributed switch or to a port group of a vSphere standard switch in the Networking view of the vSphere Web Client. The port groups of standard switches are under the datacenter. The vSphere Web Client displays distributed port groups under the parent distributed switch object. 2 3 4 On the Manage tab, click Network Protocol Profiles. Click Associate a network protocol profile with the selected network. On the Set association type page of the Associate Network Protocol Profile wizard, select Use an existing network protocol profile and click Next. If the existing network protocol profiles do not contain settings suitable for the vApp virtual machines in the port group, you must create a new profile. 5 6 Select the network protocol profile and click Next. Examine the association and settings of the network protocol profile and click Finish.
Configure a Virtual Machine or vApp to Use a Network Protocol Profile in the vSphere Web Client
After you associate a protocol profile to a port group of a standard switch or a distributed switch, enable the usage of profile on a virtual machine that is connected to the port group and is associated with a vApp or has the vApp options enabled. Prerequisites Verify that the virtual machine is connected to a port group that is associated with the network protocol profile.
VMware, Inc.
169
vSphere Networking
Procedure 1 2 Navigate to the virtual machine or the vApp in the inventory of the vSphere Web Client. In the vSphere Web Client, open the settings of the vApp or the vApp Options tab of the virtual machine.
n n
Right-click a vApp and select Edit settings. Right-click a virtual machine, select Edit settings, and in the Edit Settings dialog box, click the vApp Options tab.
3 4 5
Click Enable vApp options. Under Authoring, expand IP allocation and set the IP allocation scheme to OVF environment. Under Deployment, expand IP allocation and set IP allocation to Transient - IP Pool or Static - IP Pool. Both the Static - IP Pool and Transient - IP Pool options allocate an IP address from the range in the network protocol profile that is associated with the port group. If you select Static - IP Pool, the IP address is assigned the first time the virtual machine or vApp is powered on and the address persists across restarts. If you select Transient - IP Pool, an IP address is assigned every time the virtual machine or vApp is powered on.
Click OK.
When the virtual machine is powered on, the adapters connected to the port group receive IP addresses from the range in the protocol profile. When the virtual machine is powered off, the IP addresses are released.
Stateless Network Deployment

Stateless is a mode of execution for ESXi hosts with no local storage that formerly would save configuration or state. Configurations are abstracted into a host profile, which is a template that applies to a class of machines. Stateless allows easy replacement, removal, and addition of failed hardware, and improves the ease of scaling a hardware deployment. Every stateless ESXi boot is like a first boot. The ESXi host boots with networking connectivity to vCenter Server through the built-in standard switch. If the host profile specifies distributed switch membership, vCenter Server joins the ESXi host to VMware distributed switches or a third party switch solution. When planning the network setup for stateless ESXi hosts, you should keep the configuration as generic as possible and avoid host-specific items. Currently the design has no hooks to reconfigure physical switches when deploying a new host. Any such requirement would need special handling. To set up stateless deployment, one ESXi host must be installed in the standard fashion. Then find and record the following network-related information to save in the host profile:
n n n n
vSphere standard switch instances and settings (port groups, uplinks, MTU, and so forth) Distributed switch instances (VMware and third party) Selection rules for uplinks and uplink port or port groups vNIC information:
n n n
Address information (IPv4 or IPv6, static or DHCP, gateway) Port groups and distributed port groups assigned to the physical network adapter (vmknic)
Etherchannel is configured
If there are distributed switches, record VLAN, physical NICs bound to the vmknic, and if
170
VMware, Inc.
The recorded information is used as a template for the host profile. Once the host profile virtual switch information has been extracted and placed in the host profile, you have the opportunity to change any of the information. Modifications are offered for both standard and distributed switches in these sections: uplink selection policy, based on either vmnic name or device number, and auto discovery based on VLAN ID. The (possibly modified) information is stored by the stateless boot infrastructure and applied to a stateless ESXi host on its next boot. During network initialization, a generic network plug-in interprets the recorded host profile setting and does the following:
n n
Loads appropriate physical NIC drivers. Creates all standard switch instances, along with port groups. It selects uplinks based on policy. If the policy is based on the VLAN ID, there is a probing process to gather relevant information. For VMkernel network adapters connected to the standard switch, it creates VMkernel network adapters and connects them to port groups. For each VMkernel network adapter connected to a distributed switch, it creates a temporary standard switch (as needed) with uplinks bound to the VMkernel network adapter. It creates a temporary port group with VLAN and teaming policies based on recorded information. Specifically, IP-hash is used if Etherchannel was used in the distributed switch. Configures all VMkernel network adapter settings (assigns address, gateway, MTU, and so forth).
Basic connectivity is functioning, and the networking setup is complete if there is no distributed switch present. If there is a distributed switch present, the system stays in maintenance mode until distributed switch remediation is complete. No virtual machines are started at this time. Because distributed switches requires vCenter Server, the boot process continues until vCenter Server connectivity is established, and vCenter Server notices that the host should be part of a distributed switch. It issues a distributed switch host join, creating a distributed switch proxy standard switch on the host, selects appropriate uplinks, and migrates the vmknic from the standard switch to the distributed switch. When this operation is complete, it deletes the temporary standard switch and port groups. At the end of the remediation process, the ESXi host is taken out of maintenance mode, and HA or DRS can start virtual machines on the host. In the absence of a host profile, a temporary standard switch is created with default networking logic, which creates a management network switch (with no VLAN tag) whose uplink corresponds to the PXE booting vNIC. A vmknic is created on the management network port group with the same MAC address as the PXE booting vNIC. This logic was previously used for PXE booting. If there is a host profile, but the networking host profile is disabled or fatally incomplete, vCenter Server falls back to default networking so that the ESXi host can be managed remotely. This triggers a compliance failure, so vCenter Server then initiates recovery actions.
VMware, Inc.
171
vSphere Networking
172
VMware, Inc.
Monitoring Network Packets
10
Monitor network packets that pass through the ports of a vSphere Standard Switch or a vSphere Distributed Switch to analyze the traffic between virtual machines and hosts.
Capturing and Tracing Network Packets by Using The pktcap-uw Utility

Monitor the traffic that flows through physical network adapters, VMkernel adapters and virtual machines adapters, and analyze packet information by using the graphical user interface of network analysis tools such as Wireshark. In vSphere 5.5 or later, in the ESXi Shell console to a host you can monitor packets by using the pktcap-uw utility. You can use the utility right away without addition installation on an ESXi host. pktcap-uw provides many points in the host network stack at which you can watch traffic. For detailed analysis of captured packets, you can save packet content from the pktcap-uw utility to files in Pcap or PcapNG format and open them in Wireshark. You can also troubleshoot dropped packets and trace a packet's path in the network stack. NOTE The pktcap-uw utility is not fully supported for backward compatibility across vSphere releases. The options of the utility might change in the future.
pktcap-uw Command Syntax

Use the pktcap-uw utility and its options to inspect packets while they traverse the network stack on an ESXi host. You apply different syntax when you capture packets and trace packets.
pktcap-uw Syntax for Capturing Packets

To obtain the packet content at a certain place in the network stack on the host, type the following pktcap-uw command including the options that suit your troubleshooting situation:
pktcap-uw switch_port_options capture_point_options filter_options general_options
NOTE Certain options of the pktcap-uw utility are designed for VMware internal use only and you should use them only under the supervision of VMware Technical Support. These options are not described in the vSphere Networking guide.
VMware, Inc.
173
vSphere Networking
Table 101. pktcap-uw Arguments for Capturing Packets

Argument Group switch_port_options Argument --uplink vmnicX Description Capture packets that are related to a physical adapter. You can combine the --uplink and --capture options for monitoring packets at a certain place in the path between the physical adapter and the virtual switch. See Capture Packets for a Physical Adapter, on page 177. --vmk vmkX Capture packets that are related to a VMKernel adapter. You can combine the vmk and --capture options for monitoring packets at a certain place in the path between the VMkernel adapter and the virtual switch. See Capture Packets for a VMkernel Adapter, on page 180. --switchport {vmxnet3_port_ID | vmkernel_adapter_port_ID} Capture packets that are related to a VMXNET3 virtual machine adapter or to a VMkernel adapter that is connected to a particular virtual switch port. You can view the ID of the port in the network panel of the esxtop utility. You can combine the switchport and capture options for monitoring packets at a certain place in the path between the VMXNET3 adapter or VMkernel adapter and the virtual switch. See Capture Packets for a VMXNET3 Virtual Machine Adapter, on page 178. Capture packets that are related to the logical interface of a distributed router. See the VMware NSX documentation. Capture packets at a particular place in the network stack. For example, you can monitor packets right after they arrive from a physical adapter.
--lifID lif_ID
capture_point_options
--capture capture_point
174
VMware, Inc.
Chapter 10 Monitoring Network Packets
Table 101. pktcap-uw Arguments for Capturing Packets (Continued)

Argument Group Argument --dir {0|1} Description Capture packets according to the direction of the flow with regard to the virtual switch. 0 stands for incoming and 1 for outgoing direction. By default, the pktcap-uw utility captures ingress traffic. Use the --dir option together with the --uplink, --vmk or --switchport option. --stage {0|1} Capture the packet closer to its source or to its destination. Use this option to examine how a package changes while it traverses the points in the stack. 0 stands for closer to source and 1 for closer to destination. Use the --stage option together with the --uplink, --vmk , --switchport or --dvfilter option. --dvfilter filter_name --capture PreDVFilter|PostDVFilter Capture packets before or after a vSphere Network Appliance (DVFilter) intercepts them. See Capture Packets at DVFilter Level, on page 182. List all capture points that the pktcap-uw utility supports.
-A | --availpoints
See Capture Points of the pktcap-uw Tool, on page 182. filter_options Filter captured packets according to source or destination address, VLAN ID, VXLAN ID, Layer 3 protocol, and TCP port. See Filter Options for Capturing and Tracing Packets, on page 176. Save packet content to a file, capture only a number of packets, and so on. See General Options for Capturing and Tracing Packets, on page 176.
general_options
pktcap-uw Syntax for Tracing Packets

To trace the path that a packet traverses in the network stack, type the following pktcap-uw command including the options that match best your troubleshooting goal:
pktcap-uw --trace filter_options general_options
To view the full information about packet paths together with timestamps, print the result to the default, console output. Table 102. pktcap-uw Arguments for Tracing Packets
Argument filter_options Description Filter traced packets according to source or destination address, VLAN ID, VXLAN ID, Layer 3 protocol, and TCP port. See Filter Options for Capturing and Tracing Packets, on page 176. Save packet content to a file, trace only a number of packets, and so on. See General Options for Capturing and Tracing Packets, on page 176.
general_options
VMware, Inc.
175
vSphere Networking
General Options for Capturing and Tracing Packets

Use the general options of the pktcap-uw utility to save packet content to a file, capture up to certain number of bytes from each packet, and limit the number of captured packets.
General pktcap-uw Options

The pktcap-uw general options are valid when you capture and trace packets. For information about the command syntax of the pktcap-uw, see pktcap-uw Command Syntax, on page 173. Table 103. General Options That Are Supported for Capturing and Tracing Packets
Option {-o | --outfile} pcap_file Description Save captured packets to a file in packet capture (Pcap) format. Use this option to examine closely the packets in a visual analyzer tool such as Wireshark. Save packet content in the PcapNG file format. Use this option together with the -o or --outfile option. Print packet details and content to the console output. By default, the pkcap-uw utility shows packet information in the console output. Captures the first number_of_packets of packets. Captures only the first snapshot_length bytes from each packet. If traffic on the host is intensive, use this option to reduce the load on the CPU and storage. To capture the complete packet, set 0 to this option. Prints help about the pkcap-uw utility.
-P | --ng --console
{-c | --count} number_of_packets {-s | --snaplen} snapshot_length
-h
Filter Options for Capturing and Tracing Packets

Narrow the range of packets that you monitor through the pktcap-uw utility by applying filtering options for source and destination address, VLAN, VXLAN, and next level protocol.
Filter Options
The pktcap-uw filter options are valid when you capture and trace packets. For information about the command syntax of the pktcap-uw utility, see pktcap-uw Command Syntax, on page 173. Table 104. Filter Options of the pktcap-uw Utility
Option --srcmac mac_address --dstmac mac_address --mac mac_address Description Capture or trace packets that have a specific source MAC address. Use colons to separate the octets in it. Capture or trace packets that have a specific destination MAC address. Use colons to separate the octets in it. Capture or trace packets that have a specific source or destination MAC address. Use colons to separate the octets in it.
176
VMware, Inc.
Table 104. Filter Options of the pktcap-uw Utility (Continued)

Option --ethtype 0xEthertype Description Capture or trace packets at Layer 2 according to the next level protocol that consumes packet payload. EtherType corresponds to the EtherType field in Ethernet frames. It represents the type of next level protocol that consumes the payload of the frame. For example, to monitor traffic for the Link Layer Discovery Protocol (LLDP) protocol, type --ethtype 0x88CC. Capture or trace packets that belong to a VLAN. Capture or trace packets that have a specific source IPv4 address or subnet. Capture or trace packets that have a specific destination IPv4 address or subnet. Capture or trace packets that have a specific source or destination IPv4 address. Capture or trace packets at Layer 3 according to the next level protocol that consumes the payload. For example, to monitor traffic for the UDP protocol, type --proto 0x11. Capture or trace packets according to their source TCP port. Capture or trace packets according to their destination TCP port. Capture or trace packets according to their source or destination TCP port. Capture or trace packets that belong to a VXLAN.
--vlan VLAN_ID --srcip IP_addess|IP_address/subnet_range --dstip IP_addess|IP_address/subnet_range --ip IP_addess --proto 0xIP_protocol_number
--srcport source_port --dstport destination_port --tcpport TCP_port --vxlan VXLAN_ID
Capturing Packets by Using The pkcap-uw Tool

Capture packets in the path between a virtual switch and physical, VMkernel and virtual machine adapters to troubleshoot data transfer in the network stack on an ESXi host.
Capture Packets for a Physical Adapter

Monitor host traffic related to the external network by capturing packets at certain places in the path between a vSphere Standard Switch or vSphere Distributed Switch and a physical adapter. You can specify a certain capture point in the data path between a virtual switch and a physical adapter or determine a capture point by traffic direction with regard to the switch and proximity to the packet source or destination. For information about supported capture points, see Capture Points of the pktcap-uw Tool, on page 182. Procedure 1 (Optional) Find the name of the physical adapter that you want to monitor in the host adapter list.
n
In the vSphere Web Client, on the Manage tab for the host, click Networking and select Physical adapters In the ESXi Shell to the host, to list the physical adapters and examine their state, type the following ESXCLI command:
esxcli network nic list
VMware, Inc.
177
vSphere Networking
Each physical adapter is represented as vmnicX. X is the number that ESXi assigned to the physical adapter port. 2 3 In the ESXi Shell to the host, type pktcap-uw --uplink vmnicX. Add command options to capture packets at a particular point in the ESXi network stack. By default, you obtain the content of packets that are incoming to the standard or distributed switch when they are in the virtual switch. You can check packets at another capture point or traffic direction. To check transmitted or received packets at a specific place, use the --capture option. To set the traffic direction, use the --dir option.
Goal Monitor packets at the point right before they enter the physical adapter device. Monitor packets at the point after they are received in the network stack from the physical adapter. Monitor packets that have transmit direction with regard to the virtual switch. Monitor packets that have receive direction with regard to the virtual switch. pktcap-uw Command Option --capture UplinkSnd --capture UplinkRcv --dir 1 --dir 0
Add an option to filter packets according to source and destination address, VLAN ID, VXLAN ID, Layer 3 protocol, and TCP port. For exampple, to capture packets from source IP address 192.168.25.113, use the --srcip 192.168.25.113 filter option.
Add options to capture the content of each packet or of a limited number of packets to a .pcap or .pcapng file.
n n
To save packets to a .pcap file, use the --outfile pcap_file_path option. To save packets to a .pcapng file, use the --ng and --outfile pcap_file_path options.
You can open the file in a network analyzer tool such as Wireshark. By default, the pktcap-uw tool saves the packet files to the root folder of the ESXi file system. 6 Press Enter.
Example: Capture Packets That Are Received at vmnic0 from an IP Address 192.168.25.113 To capture the first 60 packets from a source IP address 192.168.25.113 at vmnic0 and save them to a file called vmnic0_rcv_srcip.pcap, type the following pktcap-uw command:
pktcap-uw --uplink vmnic0 --capture UplinkRcv --srcip 192.168.25.113 --outfile vmnic0_rcv_srcip.pcap --count 60
What to do next If you have not limited the number of packets, to stop capturing or tracing, press Ctrl+C. If the packet content is saved to a file, copy the file from the ESXi host to the system that runs a graphical analyzer tool, such as Wireshark, and open it in the tool to examine the packet details.
Capture Packets for a VMXNET3 Virtual Machine Adapter

Troubleshoot traffic that flows between a virtual switch and a VMXNET3 virtual machine adapter by using the pktcap-uw utility. You can specify a certain capture point in the data path between a virtual switch and a virtual machine adapter. You can also determine a capture point by traffic direction with regard to the switch and proximity to the packet source or destination. For information about supported capture points, see Capture Points of the pktcap-uw Tool, on page 182.
178
VMware, Inc.
Prerequisites The virtual machine adapter must be of type VMXNET3. Procedure 1 On the host, learn the port ID of the virtual machine adapter by using the esxtop utility. a b c In the ESXi Shell to the host, to start the utility, type esxtop. Press n to switch to the network panel of the utility. In the USED-BY column, locate the virtual machine adapter, and write down the PORT-ID value for it. The USED-BY field contains the name of the virtual machine and the port to which the virtual machine adapter is connected. d 2 Press q to exit esxtop.
In the ESXi Shell to the host, type pktcap-uw --switchport port_ID. port_ID is the ID that the esxtop utility shows for the virtual machine adapter in the PORT-ID column.
Add options to capture packets at a particular point in the ESXi network stack. By default, you obtain the content of packets that are incoming to the standard or distributed switch when they are in the switch. You can check packets at another capture point or direction in the path between the guest operating system and the virtual switch. To check transmitted or received packets at a specific place, use the --capture option, or combine the values of the --dir and --stage options.
Goal Monitor packets at the point where they pass from the virtual machine to the switch. Monitor packets at the point after they arrive to the virtual machine. Monitor packets right after they leave the virtual switch. Monitor packets right before they enter the virtual machine. Monitor packets right after they enter the virtual switch. pktcap-uw Command Option --capture Vmxnet3Tx --capture Vmxnet3Rx --dir 1 --stage 0 --dir 1 --dir 0 --stage 1
n n
VMware, Inc.
179
vSphere Networking
Example: Capture Packets That Are Received at a Virtual Machine from an IP Address 192.168.25.113 To capture the first 60 packets from a source IP address 192.168.25.113 at virtual machine adapter with port ID 33554481 and save them to a file called vmxnet3_rcv_srcip.pcap, type the following pktcap-uw command:
pktcap-uw --switchport 33554481 --capture Vmxnet3Rx --srcip 192.168.25.113 --outfile vmxnet3_rcv_srcip.pcap --count 60
Capture Packets for a VMkernel Adapter

uw utility.
Monitor packets that are exchanged between a VMkernel adapter and a virtual switch by using the pktcap-
You can capture packets at a certain capture point in the stream between a virtual switch and a VMkernel adapter. You can also determine a capture point by traffic direction with regard to the switch and proximity to the packet source or destination. For information about supported capture points, see Capture Points of the pktcap-uw Tool, on page 182. Procedure 1 (Optional) Find the name of the VMkernel adapter that you want to monitor in the VMkernel adapter list.
n
In the vSphere Web Client, on the Manage tab for the host, click Networking and select VMkernel adapters In the ESXi Shell to the host, to list the physical adapters, type the following console command:
esxcli network ip interface list
Each VMkernel adapter is represented as vmkX. X is the sequence number that ESXi assigned to the adapter. 2 In the ESXi Shell to the host, type pktcap-uw --vmk vmkX. You can replace the --vmk vmkX option with --switchport vmkernel_adapter_port_ID. vmkernel_adapter_port_ID is the PORT-ID value that the network panel of the esxtop utility shows for the adapter. 3 Add command options to capture packets at a particular point in the ESXi network stack. By default, you obtain the content of packets that are outgoing from the VMkernel adapter. You can check packets at another direction in the path between the VMkernel adapter and the virtual switch. To check transmitted or received packets at a specific place, use the --capture option, or combine the values of the --dir and --stage options.
Goal Monitor packets right after they leave the virtual switch. Monitor packets right before they enter the VMkernel adapter. Monitor packets right before they enter the virtual switch. pktcap-uw Command Option --dir 1 --stage 0 --dir 1 --dir 0 --stage 1
180
VMware, Inc.
n n
Capture Dropped Packets

Troubleshoot lost connectivity by capturing dropped packets through the pktcap-uw utility. Many reasons exist to drop a packet at a point in the network stream, for example, a firewall rule, filtering in an IOChain and DVfilter, VLAN mismatch, physical adapter malfunction, checksum failure, and so on. You can use the pktcap-uw utility to examine where packets are dropped and the reason for the drop. Procedure 1 2 In the ESXi Shell to the host, type pktcap-uw --capture Drop. Add an option to filter packets according to source and destination address, VLAN ID, VXLAN ID, Layer 3 protocol, and TCP port. For exampple, to capture packets from source IP address 192.168.25.113, use the --srcip 192.168.25.113 filter option. 3 Add options to capture the content of each packet or of a limited number of packets to a .pcap or .pcapng file.
n n
By default, the pktcap-uw tool saves the packet files to the root folder of the ESXi file system. NOTE You can see the reason and the place where a packet is dropped only when you capture packets to the console output. The pktcap-uw utility saves only the content of packets to a .pcap or .pcapng file. 4 Press Enter.
Besides the content of dropped packets, in the console output the pktcap-uw utility shows the reason for the drop and the function in the network stack that handled the packet last. What to do next If you have not limited the number of packets, to stop capturing or tracing, press Ctrl+C.
VMware, Inc.
181
vSphere Networking
If the packet content is saved to a file, copy the file from the ESXi host to the system that runs a graphical analyzer tool, such as Wireshark, and open it in the tool to examine the packet details.
Capture Packets at DVFilter Level

Examine how packets change when they pass through a vSphere Network Appliance (DVFilter). DVFilters are agents that reside in the virtual stream between a virtual machine adapter and a virtual switch. They intercept packets to protect virtual machines from security attacks and unwanted traffic. Procedure 1 2 In the ESXi Shell to the host, type pktcap-uw --dvfilter filter_name. Add an option to capture packets before or after the DVFilter intercepts them.
n n
To capture packets before they enter the DVFilter, add the --PreDVFilter option. To capture packets after they leave the DVFilter, add the --PostDVFilter option.
n n
Capture Points of the pktcap-uw Tool

Use the capture points in the pktcap-uw utility to monitor packets when a function handles them at a specific place in the network stack on a host. Overview of Capture Points A capture point in the pktcap-uw utility represents a place in the path between a virtual switch on one side and a physical adapter, VMkernel adapter or a virtual machine adapter on the other. You can use certain capture points in combination with an adapter option. For example, you use the UplinkRcv point when you capture uplink traffic. You can address other points standalone. For example, use the Drop point to inspect all dropped packets. NOTE Certain capture points of the pktcap-uw utility are designed for VMware internal use only and you should use them only under the supervision of VMware Technical Support. These capture points are not described in the vSphere Networking guide.
182
VMware, Inc.
Option for Using Capture Points in the pktcap-uw Utility To examine a packet state or content at a capture point, add the --capture capture_point option to the pktcap-uw command. Listing All Capture Points
pktcap-uw utility supports.
In the ESXi Shell to the host, you can use the pktcap-uw -A command to list all capture points that the
Capture Points That Are Relevant to Physical Adapter Traffic You capture packets at capture points in the path between a physical adapter and a virtual switch by using the --capture and --uplink options of the pkcap-uw utility. See Capture Packets for a Physical Adapter, on page 177.
Capture Point UplinkRcv UplinkSnd PortInput PortOutput Description The function that receives packets from the physical adapter. The function that sends packets to the physical adapter. The function that passes a list of packets from UplinkRcv to a port on the virtual switch. The function that passes a list of packets from a port on the virtual switch to the UplinkSnd point.
Capture Points That Are Relevant to Virtual Machine Traffic You capture packets at capture points in the path between a VMXNET3 adapter and a virtual switch by using the --capture and --switchport options of the pkcap-uw utility. See Capture Packets for a VMXNET3 Virtual Machine Adapter, on page 178.
Capture Point Vmxnet3Rx Vmxnet3Tx PortOutput PortInput Description The function in the VMXNET3 backend that receives packets from the virtual switch. The function in the VMXNET3 backend that sends packets from the virtual machine to the virtual switch. The function that passes a list of packets from a port on the virtual switch to Vmxnet3Rx. The function that passes a list of packets from Vmxnet3Tx to a port on the virtual switch. Default capture point for traffic related to a VMXNET3 adapter.
Capture Points That Are Relevant to VMkernel Adapter Traffic You capture packets at capture points in the path between a VMkernel adapter and a virtual switch by combining the the--vmk or --switchport option with the --capture option of the pkcap-uw utility. See Capture Packets for a VMkernel Adapter, on page 180.
Capture Point PortOutput PortInput Description The function that passes a list of packets from a port on the virtual switch to the VMkernel adapter. The function that passes a list of packets from the VMkernel adapter to a port on the virtual switch. Default capture point for traffic related to a VMkernel adapter.
Capture Points That Are Relevant to Distributed Virtual Filters If you want to examine how packets change when they pass through a vSphere Network Appliance (DVFilter), you use the --dvfilter option of the pktcap-uw utility together with capture points or with the --stage option. See Capture Packets at DVFilter Level, on page 182.
VMware, Inc.
183
vSphere Networking
Capture Point PreDVFilter PostDVFilter
Description The point before a DVFilter intercepts a packet. The point after a DVFilter intercepts a packet.
Auto-Selecting a Capture Point For traffic that is related to a physical, VMkernel or VMXNET3 adapter, by combining the --dir and --stage options you can auto-select and switch between capture points to examine how a packet changes before and after a point. Standalone Capture Points Certain capture points are mapped directly to the network stack rather than to a physical, VMkernel or VMXNET3 adapter.
Capture Point Drop TcpipDispatch PktFree VdrRxLeaf VdrRxTerminal VdrTxLeaf VdrTxTerminal Description Captures dropped packets and shows the place where drops occur. See Capture Dropped Packets, on page 181. Capture packets at the function that dispatches traffic to the TCP/IP stack of the VMkernel from the virtual switch, and the reverse. Capture packets right before they are released. Capture packets at the receive leaf I/O chain of a dynamic router in VMware NSX. Use this capture point together with the --lifID option. Capture packets at the receive terminal I/O chain of a dynamic router in VMware NSX. Use this capture point together with the --lifID option. Capture packets at the transmit leaf I/O chain of a dynamic router in VMware NSX. Use this capture point together with the --lifID option. Capture packets at the transmit terminal I/O chain of a dynamic router in VMware NSX. Use this capture point together with the --lifID option.
For information about dynamic routers, see the VMware NSX documentation.
Trace Packets by Using the pktcap-uw Utility

Trace the path that packets traverse in the network stack by using the pktcap-uw utility. The pktcap-uw utility shows the path of packets together with timestamps that note the time when a packet goes through a networking function in ESXi. The utility reports the path of a packet right before it is released from the stack. To view the full path information, you should print the result from the pktcap-uw tool in the console output or save it to a PcapNG file. Procedure 1 2 In the ESXi Shell to the host, type pktcap-uw --trace. Add an option to filter packets according to source and destination address, VLAN ID, VXLAN ID, Layer 3 protocol, and TCP port. For exampple, to capture packets from source IP address 192.168.25.113, use the --srcip 192.168.25.113 filter option.
184
VMware, Inc.
n n
By default, the pktcap-uw tool saves the packet files to the root folder of the ESXi file system. A .pcap file contains only the content of traced packets. To collect packet paths besides packet content, save the output to a .pcapng file. 4 Press Enter.
VMware, Inc.
185
vSphere Networking
186
VMware, Inc.
Networking Best Practices
11
Consider these best practices when you configure your network.

n
Isolate from one another the networks for host management, vSphere vMotion, vSphere FT, and so on, to improve security and performance. Assign a group of virtual machines on a separate physical NIC. This separation allows for a portion of the total networking workload to be shared evenly across multiple CPUs. The isolated virtual machines can then better handle application traffic, for example, from a Web client.
To physically separate network services and to dedicate a particular set of NICs to a specific network service, create a vSphere Standard Switch or vSphere Distributed Switch for each service. If this is not possible, separate network services on a single switch by attaching them to port groups with different VLAN IDs. In either case, verify with your network administrator that the networks or VLANs you choose are isolated from the rest of your environment and that no routers connect them. Keep the vSphere vMotion connection on a separate network. When migration with vMotion occurs, the contents of the guest operating systems memory is transmitted over the network. You can do this either by using VLANs to segment a single physical network or by using separate physical networks (the latter is preferable). When using passthrough devices with a Linux kernel version 2.6.20 or earlier, avoid MSI and MSI-X modes because these modes have significant performance impact. You can add and remove network adapters from a standard or distributed switch without affecting the virtual machines or the network service that is running behind that switch. If you remove all the running hardware, the virtual machines can still communicate among themselves. If you leave one network adapter intact, all the virtual machines can still connect with the physical network. To protect your most sensitive virtual machines, deploy firewalls in virtual machines that route between virtual networks with uplinks to physical networks and pure virtual networks with no uplinks. For best performance, use VMXNET 3 virtual machine NICs. Physical network adapters connected to the same vSphere Standard Switch or vSphere Distributed Switch should also be connected to the same physical network. Configure all VMkernel network adapters in a vSphere Distributed Switch with the same MTU. When several VMkernel network adapters, configured with different MTUs, are connected to vSphere distributed switches, you might experience network connectivity problems. When creating a distributed port group, do not use dynamic port binding. Dynamic port binding has been deprecated since ESXi 5.0.
n n
VMware, Inc.
187
vSphere Networking
188
VMware, Inc.
Index
A
active uplinks 82 add host to distributed switch 31 adding distributed switch 27 vSphere distributed switch 27 adjust MAC address allocation parameters 147 average bandwidth, standard switch 94
B
bandwidth average 93 peak 93 beacon probing, standard switches 80 block all ports distributed port groups 115 distributed ports 115 blocked ports, distributed port groups 116 burst size, standard switch 94
C
capturing a number of packets 176 CDP 161 Cisco Discovery Protocol 161 Cisco switches 161 configuration distributed switch 55 importing 55 configure LACP 63 create LAG 63 create link aggregation group 63 create TCP/IP stack 76 custom TCP/IP stack 76
D
DCUI, restore vDS 166 Direct Console User Interface (DCUI), restore vDS 166 DirectPath I/O enable 133 virtual machine 133 vMotion 133 disable rollback 164 disabling rollback 165 disabling rollback with vpxd.cfg 165
distributed port changing rule priorities 111 defining traffic rules 110 deleting a rule 112 disabling traffic filtering and marking 112 edit name 49 edit settings 49 enabling traffic filtering and marking 107 granting or denying access to traffic 109 marking traffic with CoS and DSCP 107 monitoring port state 49 opening a traffic rule for editing 111 port state 49 Security policy 92 traffic filtering and marking 106 traffic shaping policy 96 viewing traffic rules 110 VLAN policies 88 distributed port group changing rule priorities 105 configuring traffic filtering and marking 100 connect to a virtual machine 50 defining traffic rules 104 deleting a rule 105 deleting a traffic rule 105 disabling traffic filtering and marking 106 enabling traffic filtering and marking 100 granting or denying access to traffic 103 marking traffic with CoS and DSCP tags 101 network resource pool 125 opening a traffic rule for editing 105 remove 47 traffic shaping policy 95 viewing traffic rules 104 distributed port groups add new 42 Advanced settings 46 average bandwidth 116 block all ports 115 blocked ports 116 burst size 116 export configuration 47, 54 failover order 84, 116 failover policies 84, 116 forged transmits 116
VMware, Inc.
189
vSphere Networking
general settings 45 import configuration 47, 48, 54 Layer 2 security policy 91 load balancing 116 MAC address changes 116 mass configuration 116 miscellaneous policies 116 Miscellaneous policy 115 Monitoring Policy 98 NetFlow 42, 116 NetFlow policy 98 Network I/O Control 116 network resource pools 97, 116 network resource pool 42, 45 notify switches 116 override port policies 46 peak bandwidth 116 port blocking 42 port policies 116 port allocation 42, 45 port binding 42, 45 promiscuous mode 116 PVLAN 116 QOS policies 116 reset at disconnect 46 restore configuration 47, 48, 54 security policy 116 security policies 42 teaming policies 84, 116 teaming and failover policies 42 traffic shaping 116 traffic filtering and marking 116 traffic shaping policies 42 VLAN 42, 45 VLAN policy 116 VLAN trunking 116 VLAN policies 87 distributed ports block all ports 115 blocking 115 failover order 85 failover policies 85 Miscellaneous policy 115 Monitoring Policy 99 NetFlow policy 99 network resource pools 98 port mirroring 157 teaming policies 85 distributed switch add hosts 30 add VMkernel adapters 34 adding 27
adding a network adapter 40 adding a NIC 40 adding a uplink adapter 40 administrator contact information 29 CDP 161, 163 Cisco Discovery Protocol 161 configure virtual networks 30 create VMkernel adapter 73 Dump Collector support 15 edit network resource pool 126 export configuration 54 Fault Tolerance traffic 34 health check 53 health check enable or disable 53 import configuration 54, 55 IP storage traffic 34 LACP 67 Link Layer Discovery Protocol 162 LLDP 162, 163 manage host networking 30 management traffic 34 migrate virtual machine networking 36 migrate virtual machine network adapters 36 migrate VMkernel adapters 34 migrating virtual machines 50 MTU 29 name 29 network adapter 35 Network I/O Control 29, 124 network resource pool 124, 125 new network resource pool 124 number of ports on hosts 37 physical network adapter 39 port mirroring 157 ports 41 private VLAN 57 proxy switch 39 recovery 163, 166 remove hosts 38 removing a network adapter 41 removing a NIC 41 removing a uplink adapter 41 restore configuration 54, 56, 165 rollback 163 settings 29 stateless 170 switch discovery protocol 29 template host 37 upgrading 28 uplinks 29 viewing network adapter information 71
190
VMware, Inc.
Index
virtual machine networking 36 virtual machine network adapter 39 virtual machine networking adapters 36 virtual machines 50 Virtual SAN traffic 34 VLAN 57 VMkernel adapters 34 VMkernel networking 34 VMkernel network adapter 35 vMotion traffic 34 DNS, configuration 76 Dump Collector 15
I
import configuration distributed port groups 47, 48 distributed switch 54 IOMMU 134, 139 IP address configuration 167, 168 IP storage traffic 70 IPv4 71, 74 IPv6 disabling 153 enabling 153 VMkernel 75 iSCSI traffic 70
E
EST 15 export configuration distributed port groups 47 distributed switch 54 External Switch Tagging 15
J
jumbo frames enabling in vSphere distributed switch 129 enabling in vSphere standard switch 129 enabling in virtual machines 130 enabling on vSphere standard switch 129 jumbo frames, enabling 129
F
failback 82, 116 failover, standard switches 80 failover order distributed port groups 84, 116 distributed ports 85 failover policies distributed port groups 84, 116 distributed ports 85 standard switch 82 Fault Tolerance logging 71, 74 Fault Tolerance traffic 70 forged transmits 90, 116
L
LACP convert to Enhanced LACP 61 distributed switch 67 enhanced support 61 host 67 IP Hash load balancing 67 iSCSI 67 limitations 67 upgrade 61 uplink port group 67 LACP support 59 LAG active 65 assign physical adapters 64 assign physical NICs 64 configure 62 create 62, 63 failover order 64 intermediate configuration 64 migrate network traffic 62 set as standby 64 teaming and failover order 65 unused 64 Layer 2 security 90 Layer 2 security policy, distributed port groups 91 link aggregation group add ports 66 change configuration 66 edit settings 66
G
guest operating system, remove NIC 42
H
health check enable or disable 53 view information 54 host disabling IPv6 153 enable SR-IOV 142, 143 enabling IPv6 153 host networking,rollback 163 host networking, viewing network adapter information 71 host profile enable SR-IOV 142 SR-IOV 142
VMware, Inc.
191
vSphere Networking
load balancing algorithm 66 VLAN and NetFlow policies 66 Link Layer Discovery Protocol 161, 162 link status, standard switches 80 LLDP 161, 162 load balancing distributed port groups 116 standard switches 80
M
MAC address adjust allocation parameters 147 assign MAC address 147 configuration 151 configuring 145 generation 145, 146 generation, host 149 Locally Administered Address (LAA) 147 manually assign MAC address 150 prefix-based allocation 146148 range-based allocation 147, 148 set allocation type 148 static 151 static MAC address 150 static, VMware OUI 150 vCenter Server 145 VMware OUI 146 VMware OUI allocation 148 MAC address changes 90, 116 MAC address conflict 147 manage host networking 31 management network 166 management traffic 70 Management traffic 71, 74 miscellaneous policies, distributed port groups 116 Miscellaneous policy distributed port groups 115 distributed ports 115 monitoring packets 173 Monitoring Policy distributed port groups 98 distributed ports 99 MTU, health check 53, 54
N
NAS, mounting 163 netdump 15 NetFlow collector settings 161 configure 161 disable 98, 116, 161
distributed port Groups 116 enable 98, 116, 161 NetFlow policy distributed port groups 98 distributed ports 99 netqueue, enable 130 NetQueue, disabling 131 network association settings 167 network failover detection 82 Network I/O Control 29, 97, 124 network protocol profile associating with a port group 169 configuring vApp 169 configuring virtual machine 169 network protocol profiles, See protocol profiles network resource management 123 network resource pool delete 126 host limit 124, 126 physical adapter shares 124, 126 QoS tag 124, 126 user-defined 126 network resource pools distributed port groups 97, 116 distributed ports 98 networking advanced 153 introduction 13 performance 130 networking best practices 187 networks distributed ports 49 IP address configuration 167, 168 resource pools 123 new resource pool, distributed switch 124 NFS traffic 70 NIC teaming definition 13 standard switch 22 standard switches 80 NICs guest operating system 42 remove from a vSphere distributed switch 42 remove from active virtual machine 42 removing from a distributed switch 41 NICS, adding to a distributed switch 40 notify switches 116 notify standard switch 82
P
packet capture capture points 182 capturing only the first bytes of a packet 176 capturing to a file 176
192
VMware, Inc.
Index
console command 173, 176178, 180182, 184 dropped packets 181 DVFilter 182 filtering packets 176 physical adapter 177 pkcap-uw 173 pktcap-uw 173, 177, 178, 180182, 184 tracing packets 184 uplink 177 VMkernel 180 VMXNET3 178 passthrough device add to a host 132 virtual machine 133 PCI, virtual machine 133 PCIe devices 134, 139 peak bandwidth, standard switch 94 physical network adapter add to standard switch 22 failover 22 standard switch 22 physical network adapters adding to a distributed switch 40 removing from a distributed switch 41 pktcap-uw capture points 182 capturing packets 177, 178, 180182 new information 11 options 173, 176 syntax 173 tracing packets 184 port configuration 21 port groups, definition 13 port blocking 79 port mirroring add uplinks 158 adding ports 158 create with vSphere Web Client 156 destinations 158, 159 edit destinations 159 edit sources 159 edit status 159 edit VLAN 159 feature compatibility 154 I/O 157 IP address 158 LRO 155 name 157 sampling rate 157 session type 157 session types 155 sources 158, 159
status 159 traffic direction 158 TSO 155 verify settings 158, 159 version compatibility 154 VLAN 157159 vMotion 155 port policies, distributed port groups 116 ports, distributed switch 41 prefix-based MAC address allocation 146 prefixed-based MAC address allocation 147 private VLAN create 57 primary 57 remove 58 removing 57 secondary 57, 58 promiscuous mode 90, 116 protocol profiles, configuring 166
Q
QOS policies, distributed port groups 116
R
range-based MAC address allocation 147 recovery, distributed switch 166 remove a port group 21 remove a standard port group 21 remove distributed port group 47 resource pools, networks 123 restore configuration distributed port groups 47, 48 distributed switch 54, 56 rollback disable 164 distributed switch 163, 165 host networking 163 restore configuration 165 standard switch 163 vpxd.cfg file 165
S
security policy distributed port groups 116 forged transmits 90 MAC address changes 90 policy exceptions 90 promiscuous mode 90 vSphere standard switch 90 Security policy, distributed port 92 set MAC address allocation type 148 Single Root I/O Virtualization enabling on a host physical adapter 139
VMware, Inc.
193
vSphere Networking
See also SR-IOV SR-IOV associating with a virtual machine as a network adapter 140 backing modes 141 components 136 control path 136 data path 136 enable 142, 143 enable with a host profile 142 enabling on a host physical adapter 139 enabling with a vCLI command 142 ESXCLI command 143 host profile 142 networking options 141 number of VFs available 138 out of interrupt vectors 144 overview 136 physical NIC interaction 138 physical function 139 security policy 141 updated information 11 VF 138 VF rate control 138 virtual function 138 virtual machine 139 VLAN policy 141 SR-IOV, virtual machine is powered off 144 standard port group, traffic shaping policy 94 standard switch average bandwidth 94 burst size 94 create new standard switch 19 failback 82 failover order 82 Fault Tolerance logging 71, 74 forged transmit 90 IPv4 71, 74 IPv6 71, 74 Layer 2 security policy 90, 91 load balancing 82 MAC address changes 90 Management traffic 71, 74 MTU 74 network adapter 71, 74 network failover detection 82 notify switches 82 peak bandwidth 94 physical network adapter 22 port configuration 21 port group 19, 20 port group network label 20
port group VLAN ID 20 promiscuous mode 90 Security policy 20 speed and duplex of physical network adapter 22 stateless 170 teaming and failover policies 82 Teaming and Failover policy 20 Traffic Shaping policy 20 traffic shaping policies 94 viewing network adapter information 71 virtual network adapter 40 VMkernel network adapter 71 VMKernel network adapter 74 vMotion 71, 74 standard switches beacon probing 80 configuration 21 Dump Collector support 15 failover 80 link status 80 load balancing 80 NIC teaming 80 properties 21 recovery 163 rollback 163 using 17 standby uplinks 82 stateless boot 170 stateless distributed switch 170 static MAC address 150 switch topology, SR-IOV 141
T
TCP Segmentation Offload, See TSO teaming policies distributed port groups 116 health check 53, 54 standard switch 82 third-party switch 26 traffic filtering and marking 99, 113, 116 filtering and marking by Data Link Layer properties 113 filtering and marking by MAC address 113 filtering and marking by VLAN ID 113 marking with CoS 101 marking with DSCP 101 view rules 104 traffic filtering, granting or denying access to traffic 103 traffic rules, adding 105, 111
194
VMware, Inc.
Index
traffic filtering and marking allow or drop action 109 by Data Link Layer properties 113 by IP address 114 by Layer 2 properties 113 by Layer 3 properties 113 by MAC address 113 by Network Layer properties 114 by type of system data 113 changing rule priorities 105 changing rule priorities on a port 111 defining traffic rules 104 defining traffic rules on a port 110 deleting a rule on a port 112 disabling 106 disabling on a port 112 enabling on a port 107 enabling on a port group 100 granting or denying access to traffic 109 marking traffic with CoS and DSCP on a port 107 opening a rule for editing 105 opening a rule on a port for editing 111 traffic filtering and marking by transport protocol and port 114 by VLAN ID 113 viewing traffic rules 104 viewing traffic rules on a port 110 traffic shaping, distributed port groups 116 traffic shaping policies average bandwidth 94 burst size 94 distributed port 96 distributed port group 95 peak bandwidth 94 standard port group 94 standard switch 94 TSO virtual machine 127 VMkernel network adapter 128
uplink port changing rule priorities 111 defining traffic rules 110 deleting a rule 112 disabling traffic filtering and marking 112 enabling traffic filtering and marking 107 granting or denying access to traffic 109 marking traffic with CoS and DSCP 107 opening a traffic rule for editing 111 traffic filtering and marking 106 viewing traffic rules 110 VLAN policies 88 uplink port group changing rule priorities 105 configuring traffic filtering and marking 100 defining traffic rules 104 deleting a traffic rule 105 disabling traffic filtering and marking 106 enabling traffic filtering and marking 100 granting or denying access to traffic 103 LACP 67 marking traffic with CoS and DSCP, port group 101 marking traffic with CoS and DSCP tags 101 opening a traffic rule for editing 105 viewing traffic rules 104 uplink port groups, VLAN policies 88 uplink ports, VLAN policies 89
V
vApp, network protocol profile 169 vApps configuring IPv4 167 configuring IPv6 168 selecting network associations 167 VDS add a host 32 assign physical NICs 33 assign vmnics 33 migrate vmnics 33 migrate physical NICs 33 VGT 15 Virtual LAN 15 Virtual Guest Tagging 15 virtual machine enabling TSO 127 network protocol profile 169 SR-IOV 139 static MAC address 150 virtual machine is powered off, SR-IOV 144 virtual machine networking 15, 18 virtual machines connect to a distributed port group 50
U
Universally Unique Identifier (UUID) 146 updated information pktcap-uw 11 SR-IOV 11 upgrading distributed switch 28 vSphere distributed switch 28 uplink adapters adding to a distributed switch 40 removing from a distributed switch 41
VMware, Inc.
195
vSphere Networking
enabling jumbo frames 130 migrating to and from and vSphere distributed switch 50 migrating to or from a distributed switch 50 networking 50 virtual network adapter remove from distributed switch 77 standard switch 40 Virtual SAN traffic 70 Virtual Switch Tagging 15 VLAN definition 13 health check 53, 54 port mirroring 159 private 57 secondary 58 type 57 VLAN ID primary 56, 57 secondary 56, 57 VLAN policies distributed port 88 distributed port groups 87 uplink port 88 uplink port groups 88 uplink ports 89 VLAN policy distributed port groups 116 SR-IOV 141 VLAN trunking, distributed port groups 116 VMkernel configuring 69 definition 13 DNS 75 gateway 75 IPv6 75 VMkernel adapter, viewing information 71 VMKernel network adapter 74 VMkernel network adapter, enabling TSO 128 VMkernel networking, create VMkernel adapter 73 vMotion compatibility 131 definition 13 networking configuration 69 port mirroring 155 vMotion traffic 70 VMware OUI MAC address, host 149 MAC address, static 150 vCenter Server assignment 146 VMware OUI allocation 146 vpxd.cfg 148, 165
vSphere Distributed Switch third-party 26 See also distributed switch vSphere distributed switch adding 27 CDP 161 Cisco Discovery Protocol 161 configuring traffic filtering and marking on a port group 100 edit network resource pool 126 jumbo frames, enabling 129 Link Layer Discovery Protocol 162 LLDP 162 migrate virtual machines to or from 50 mirror 154 port mirroring 154 ports 41 protection against MAC address impersonation 90 protection against traffic scanning 90 security policy 90 topology diagram, all hosts 51 topology diagram, host proxy switch 53 topology diagrams 51 traffic filtering and marking 99 traffic filtering and marking on a port 106 upgrading 28 virtual machines 50 vSphere standard switch configuration 21 definition 13 enabling jumbo frames 129 forged transmit 90 Layer 2 security policy 90 MAC address changes 90 port configuration 21 promiscuous mode 90 properties 21 protection against MAC address impersonation 90 protection against traffic scanning 90 security policy 90 topology diagram 23 using 17 VST 15
196
VMware, Inc.

Vsphere Esxi Vcenter Server 55 Networking Guide

Uploaded by

Copyright:

Available Formats

Vsphere Esxi Vcenter Server 55 Networking Guide

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Vsphere Esxi Vcenter Server 55 Networking Guide

Uploaded by

Copyright:

Available Formats

vSphere Networking

vSphere 5.5 ESXi 5.5 vCenter Server 5.5

VMware, Inc. 3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com

About vSphere Networking

1 Updated Information 11 2 Introduction to Networking 13

3 Setting Up Networking with vSphere Standard Switches 17

4 Setting Up Networking with vSphere Distributed Switches 25

Managing Networking on Host Proxy Switches

5 Setting Up VMkernel Networking 69

7 Managing Network Resources 123

8 MAC Address Management 145

9 Advanced Networking 153

Create a Port Mirroring Session with the vSphere Web Client

10 Monitoring Network Packets 173

11 Networking Best Practices 187

About vSphere Networking

Networking Concepts Overview

Physical Ethernet Switch

vSphere Standard Switch

vSphere Distributed Switch

Host Proxy Switch

Distributed Port Distributed Port Group

VMkernel TCP/IP Networking Layer IP Storage

TCP Segmentation Offload

Chapter 2 Introduction to Networking

Network Services in ESXi

VMware ESXi Dump Collector Support

Setting Up Networking with vSphere Standard Switches

vSphere Standard Switches

Standard Switch Overview

Figure 31. vSphere standard switch architecture

vNIC Network production Virtual port

Uplink port group

Uplink port group

Physical network adapters

Standard Port Groups

Port Group Configuration for Virtual Machines

Chapter 3 Setting Up Networking with vSphere Standard Switches

Edit a Standard Switch Port Group in the vSphere Web Client

Chapter 3 Setting Up Networking with vSphere Standard Switches

vSphere Standard Switch Properties

Change the Speed of a Physical Adapter in the vSphere Web Client

Chapter 3 Setting Up Networking with vSphere Standard Switches

Setting Up Networking with vSphere Distributed Switches

vSphere Distributed Switch Architecture

Distributed port groups

Uplink port group vCenter Server

ESXi host 1 Production

Uplink port group

Uplink port group

Chapter 4 Setting Up Networking with vSphere Distributed Switches

Create a vSphere Distributed Switch with the vSphere Web Client

Distributed Switch: 4.1.0

Distributed Switch: 4.0.0

Chapter 4 Setting Up Networking with vSphere Distributed Switches

Option Version 5.0.0 Version 4.1.0

Review your settings and click Finish.

Click Advanced to edit the vSphere Distributed Switch settings.

Managing Networking on Multiple Hosts on a vSphere Distributed Switch

Chapter 4 Setting Up Networking with vSphere Distributed Switches