VMware vSphere Knowledge Base

Access the host via DCUI or iLO/iDRAC console

# Enable ESXi Shell from DCUI if not already enabled:
# DCUI → Troubleshooting Options → Enable ESXi Shell

# Or via iLO/iDRAC remote console, press Alt+F1 for ESXi Shell
# Login with root credentialsCopy

Restore management network to vSS

# List current virtual switches and uplinks:
esxcli network vswitch standard list
esxcli network vswitch dvs vmware list

# Create a new vSS if none exists:
esxcli network vswitch standard add -v vSwitch0

# Add a physical NIC back to vSS:
esxcli network vswitch standard uplink add -v vSwitch0 -u vmnic0

# Add a port group for management:
esxcli network vswitch standard portgroup add -v vSwitch0 -p "Management Network"

# Set VLAN if required:
esxcli network vswitch standard portgroup set -p "Management Network" --vlan-id 100

# Move vmk0 to vSS management port group:
esxcli network ip interface remove -i vmk0
esxcli network ip interface add -i vmk0 -p "Management Network"
esxcli network ip interface ipv4 set -i vmk0 -I 10.0.0.10 -N 255.255.255.0 -t static

# Restart management agents:
/etc/init.d/hostd restart
/etc/init.d/vpxa restartCopy

Verify connectivity and reconnect host in vCenter

# Test network connectivity:
vmkping 10.0.0.1
vmkping <vcenter-ip>

# Check management network interface:
esxcli network ip interface list
esxcli network ip interface ipv4 get -i vmk0

# In vCenter: Right-click host → Connection → Reconnect
# Then re-plan vDS migration with a safe rollback strategyCopy

Verify VMkernel configuration and vMotion tag

# List all VMkernel interfaces and their enabled services:
esxcli network ip interface list

# Check which VMkernel has vMotion enabled:
esxcli network ip interface tag get -i vmk1

# If vMotion is NOT listed, enable it:
# vCenter UI: Host → Configure → VMkernel adapters → vmk1 → Edit → Enable vMotion

# Verify vMotion interface IP:
esxcli network ip interface ipv4 get -i vmk1

# Check VLAN assignment:
esxcli network vswitch dvs vmware list
esxcli network vswitch standard portgroup listCopy

Test vMotion network connectivity between hosts

# Ping target host vMotion IP using the vMotion VMkernel interface:
vmkping -I vmk1 <target-host-vMotion-IP>

# Test with jumbo frames (if MTU 9000 configured):
vmkping -I vmk1 -d -s 8972 <target-host-vMotion-IP>

# Check for firewall rules blocking vMotion (port 8000):
esxcli network firewall ruleset list | grep -i vmotion
esxcli network firewall ruleset set -e true -r vMotion

# Verify TCP port 8000 connectivity:
nc -z <target-host-vMotion-IP> 8000Copy

Check TCP/IP stack and routing for vMotion

# List TCP/IP stacks — vMotion should use dedicated stack:
esxcli network ip netstack list

# Check routing table for vMotion stack:
esxcli network ip route ipv4 list -N vmotion

# If using default stack, ensure no conflicting default gateways:
esxcli network ip route ipv4 list -N defaultTcpipStack

# Test vMotion after fixes — migrate a test VM:
# PowerCLI:
Move-VM -VM "test-vm" -Destination "target-host" -VMotionPriority HighCopy

Test end-to-end MTU path

# Test jumbo frame connectivity (9000 MTU = 8972 payload + 28 header):
vmkping -I vmk1 -d -s 8972 <target-IP>

# -d = set Don't Fragment bit (critical for MTU testing)
# -s 8972 = payload size (9000 - 20 IP header - 8 ICMP header)

# If this fails but regular ping works, MTU mismatch exists:
vmkping -I vmk1 <target-IP>            # Should work (1500 MTU)
vmkping -I vmk1 -d -s 8972 <target-IP>  # Fails = MTU mismatch

# Binary search to find actual MTU:
vmkping -I vmk1 -d -s 4000 <target-IP>
vmkping -I vmk1 -d -s 6000 <target-IP>
vmkping -I vmk1 -d -s 7000 <target-IP>Copy

Check and set MTU on all layers

# Check VMkernel adapter MTU:
esxcli network ip interface list | grep -A5 vmk1

# Check vSwitch / vDS MTU:
esxcli network vswitch standard list     # vSS
esxcli network vswitch dvs vmware list   # vDS

# Set MTU on vSS:
esxcli network vswitch standard set -v vSwitch1 -m 9000

# Set MTU on VMkernel adapter:
esxcli network ip interface set -i vmk1 -m 9000

# For vDS — set via vCenter UI:
# vDS → Configure → Properties → Advanced → MTU: 9000

# Verify physical switch MTU (example Cisco):
# show interface TenGigabitEthernet1/1 | include MTU
# configure: system jumbo mtu 9216Copy

Validate end-to-end after changes

# Re-test from EVERY host to every target (storage, other hosts):
vmkping -I vmk1 -d -s 8972 <storage-IP>
vmkping -I vmk1 -d -s 8972 <host2-vMotion-IP>
vmkping -I vmk1 -d -s 8972 <host3-vMotion-IP>

# PowerCLI — Check MTU across all hosts:
Get-VMHost | ForEach-Object {
    $vmk = Get-VMHostNetworkAdapter -VMHost $_ -VMKernel | Where { $_.VMotionEnabled }
    [PSCustomObject]@{
        Host = $_.Name
        VMkernel = $vmk.Name
        MTU = $vmk.Mtu
        IP = $vmk.IP
    }
} | Format-Table -AutoSizeCopy

Check current NIC teaming policy

# vSS — Check teaming policy:
esxcli network vswitch standard policy failover get -v vSwitch0

# vDS — Check via vCenter UI:
# vDS → Port Groups → Edit → Teaming and failover

# PowerCLI — Audit NIC teaming across all hosts:
Get-VMHost | ForEach-Object {
    $vs = Get-VirtualSwitch -VMHost $_ -Standard
    foreach ($v in $vs) {
        $policy = Get-NicTeamingPolicy -VirtualSwitch $v
        [PSCustomObject]@{
            Host = $_.Name
            vSwitch = $v.Name
            LoadBalancing = $policy.LoadBalancingPolicy
            FailoverDetection = $policy.NetworkFailoverDetectionPolicy
            ActiveNic = ($policy.ActiveNic -join ",")
            StandbyNic = ($policy.StandbyNic -join ",")
        }
    }
} | Format-Table -AutoSizeCopy

Configure recommended teaming policy

# vSS — Set load balancing to "Route based on physical NIC load" (vDS) or "originating port" (vSS):
esxcli network vswitch standard policy failover set -v vSwitch0 \
    -l portid          # portid = originating port (default, safest)
                        # iphash = IP hash (needs LACP)
                        # mac    = source MAC hash
                        # explicit = explicit failover order

# Set failover order — Active and Standby NICs:
esxcli network vswitch standard policy failover set -v vSwitch0 \
    -a vmnic0,vmnic2 \
    -s vmnic1,vmnic3

# Enable notify switches and set failback:
esxcli network vswitch standard policy failover set -v vSwitch0 \
    -n true  \          # Notify switches on failover
    -b true             # Failback enabled

# Configure LACP on vDS (if using IP hash):
# vDS → Configure → LACP → New LAG → Mode: Active, Ports: 2Copy

Test failover behavior

# Simulate NIC failure — disconnect one uplink and verify:
esxcli network nic down -n vmnic0

# Check traffic continues on standby NIC:
esxcli network nic stats get -n vmnic1
vmkping <gateway-ip>

# Restore NIC:
esxcli network nic up -n vmnic0

# Verify failback occurred:
esxcli network vswitch standard policy failover get -v vSwitch0Copy

Check current VLAN configuration

# List vSS port groups and their VLAN IDs:
esxcli network vswitch standard portgroup list

# List vDS port groups:
esxcli network vswitch dvs vmware list

# VLAN types in ESXi:
# VLAN 0     = No VLAN tagging (frames sent untagged)
# VLAN 1-4094 = Specific VLAN (ESXi tags frames with this VLAN ID)
# VLAN 4095  = VLAN Trunking (passes all VLAN tags to guest OS — guest must tag)

# Check which port group a VM is connected to:
# PowerCLI:
Get-VM "web-server" | Get-NetworkAdapter | Select NetworkName, MacAddressCopy

Match ESXi VLAN with physical switch configuration

# ESXi port group VLAN must match physical switch:
#
# ESXi Port Group VLAN 100 → Physical switch: trunk allowed vlan 100
# ESXi Port Group VLAN 0   → Physical switch: access port (native vlan)
# ESXi Port Group VLAN 4095 → Physical switch: trunk all VLANs

# Set correct VLAN on vSS port group:
esxcli network vswitch standard portgroup set -p "VM Network" --vlan-id 100

# For vDS — set via vCenter:
# vDS → Port Groups → Edit → VLAN type: VLAN, VLAN ID: 100

# Verify physical switch (Cisco example):
# show interface GigabitEthernet0/1 switchport
# Expected: Trunking, Allowed VLANs: 100,200,300
# If access port: switchport access vlan 100Copy

Validate connectivity after VLAN fix

# From inside the VM, test connectivity:
ping <default-gateway>
ping <external-host>

# From ESXi, use packet capture to verify VLAN tagging:
pktcap-uw --uplink vmnic0 --vlan 100 -o /tmp/vlan100.pcap

# Capture on specific port group:
pktcap-uw --switchport <port-id> --dir 0 -o /tmp/capture.pcap

# PowerCLI — Audit all port group VLANs across cluster:
Get-VDPortgroup | Select Name, VlanConfiguration | Format-Table -AutoSize
Get-VirtualPortGroup | Select Name, VLanId, VirtualSwitch | Format-Table -AutoSizeCopy

Create vDS and configure port groups

# PowerCLI — Create a new vDS:
$dc = Get-Datacenter "Production"
$vds = New-VDSwitch -Name "Production-vDS" -Location $dc `
    -NumUplinkPorts 4 -Mtu 9000 -Version "7.0.3"

# Create port groups matching your vSS port groups:
New-VDPortgroup -VDSwitch $vds -Name "VLAN100-Web" -VlanId 100
New-VDPortgroup -VDSwitch $vds -Name "VLAN200-App" -VlanId 200
New-VDPortgroup -VDSwitch $vds -Name "VLAN300-DB" -VlanId 300
New-VDPortgroup -VDSwitch $vds -Name "vMotion-VLAN500" -VlanId 500

# Add hosts to vDS (without assigning uplinks yet):
Get-VMHost "esxi-01.lab.local" | Add-VDSwitchVMHost -VDSwitch $vdsCopy

Migrate one uplink and VM networking

# Move ONE physical NIC from vSS to vDS (keep the other on vSS):
$vmhost = Get-VMHost "esxi-01.lab.local"
$pnic = Get-VMHostNetworkAdapter -VMHost $vmhost -Physical -Name "vmnic1"
Add-VDSwitchPhysicalNetworkAdapter -DistributedSwitch $vds `
    -VMHostPhysicalNic $pnic -Confirm:$false

# Migrate VM networking from vSS port groups to vDS port groups:
Get-VM -Location $vmhost | Where {
    ($_ | Get-NetworkAdapter).NetworkName -eq "VM Network"
} | Get-NetworkAdapter | Set-NetworkAdapter `
    -NetworkName "VLAN100-Web" -Confirm:$false

# Verify VMs can still communicate:
# Test ping from VMs to gateway and between VMsCopy

Migrate VMkernel adapters and remaining uplinks

# After VM networking verified, migrate VMkernel adapters:
$vmk = Get-VMHostNetworkAdapter -VMHost $vmhost -VMKernel -Name "vmk1"
$pg = Get-VDPortgroup -Name "vMotion-VLAN500"
Set-VMHostNetworkAdapter -VirtualNic $vmk -PortGroup $pg -Confirm:$false

# Move remaining uplinks to vDS:
$pnic0 = Get-VMHostNetworkAdapter -VMHost $vmhost -Physical -Name "vmnic0"
Add-VDSwitchPhysicalNetworkAdapter -DistributedSwitch $vds `
    -VMHostPhysicalNic $pnic0 -Confirm:$false

# Remove the now-empty vSS (optional — keep for rollback):
# Remove-VirtualSwitch -VirtualSwitch (Get-VirtualSwitch -VMHost $vmhost -Name "vSwitch0")

# Repeat for remaining hosts one at a timeCopy

Enable NIOC on the vDS

# vCenter UI:
# Networking → vDS → Configure → Resource Allocation → Enable Network I/O Control

# PowerCLI — Enable NIOC:
$vds = Get-VDSwitch -Name "Production-vDS"
$vds | Set-VDSwitch -EnableNetworkIOControl $true

# Check NIOC status:
(Get-VDSwitch -Name "Production-vDS").ExtensionData.Config.NetworkResourceManagementEnabledCopy

Configure traffic type shares and reservations

# vCenter UI:
# vDS → Configure → Resource Allocation → System Traffic
# Click each traffic type → Edit:
#   Management: Shares = High (100), Reservation = 0.5 Gbps
#   vMotion:    Shares = High (100), Reservation = 2 Gbps
#   VM Traffic: Shares = Normal (50), Reservation = 1 Gbps
#   NFS:        Shares = High (100), Reservation = 2 Gbps

# PowerCLI — Set shares for a traffic type:
$vds = Get-VDSwitch -Name "Production-vDS"

# Get current resource allocation:
$vds.ExtensionData.Config.InfrastructureTrafficResourceConfig |
    Select Key,
    @{N='Shares';E={$_.AllocationInfo.Shares.Shares}},
    @{N='Level';E={$_.AllocationInfo.Shares.Level}},
    @{N='Reservation';E={$_.AllocationInfo.Reservation}},
    @{N='Limit';E={$_.AllocationInfo.Limit}} |
    Format-Table -AutoSizeCopy

Create Network Resource Pools for VM traffic isolation

# Create custom resource pool for specific workloads:
# vDS → Configure → Resource Allocation → Network Resource Pools → New

# Assign a port group to a resource pool:
# vDS → Port Groups → Edit Settings → Resource Allocation → Pool

# Monitor NIOC effectiveness:
# vDS → Monitor → Resource Allocation
# Check per-host bandwidth utilization per traffic type

# PowerCLI — View network resource pools:
$vds = Get-VDSwitch -Name "Production-vDS"
$vds.ExtensionData.NetworkResourcePool | Select Key, Name,
    @{N='Shares';E={$_.AllocationInfo.Shares.Shares}},
    @{N='Limit';E={$_.AllocationInfo.Limit}} |
    Format-Table -AutoSizeCopy

List TCP/IP stacks and current routing

# List all TCP/IP stacks:
esxcli network ip netstack list

# Check routing table for each stack:
esxcli network ip route ipv4 list -N defaultTcpipStack
esxcli network ip route ipv4 list -N vmotion
esxcli network ip route ipv4 list -N vSphereProvisioning

# List VMkernel adapters and their TCP/IP stack assignment:
esxcli network ip interface list
# Look for "NetStack" field — shows which stack each vmk uses

# Check DNS per stack:
esxcli network ip dns server list -N defaultTcpipStack
esxcli network ip dns server list -N vmotionCopy

Create VMkernel adapter on dedicated vMotion stack

# Remove existing vMotion vmk from default stack (if needed):
esxcli network ip interface remove -i vmk1

# Create VMkernel adapter on the vMotion TCP/IP stack:
# vCenter UI: Host → Configure → VMkernel Adapters → Add
#   Port Group: vMotion-PG
#   TCP/IP Stack: vMotion  (CANNOT change after creation)
#   IPv4: 10.10.50.10/24

# Set default gateway on vMotion stack:
esxcli network ip route ipv4 add -N vmotion -n default -g 10.10.50.1

# Set DNS on vMotion stack (optional):
esxcli network ip dns server add -N vmotion -s 10.0.0.53

# Verify:
esxcli network ip route ipv4 list -N vmotionCopy

Fix routing issues on default stack

# Problem: multiple VMkernel adapters on default stack with wrong routes
# Check current routes:
esxcli network ip route ipv4 list -N defaultTcpipStack

# Add a static route for a specific subnet:
esxcli network ip route ipv4 add -N defaultTcpipStack \
    -n 172.16.0.0/16 -g 10.0.0.1

# Remove a conflicting route:
esxcli network ip route ipv4 remove -N defaultTcpipStack \
    -n 172.16.0.0/16 -g 10.0.0.1

# Change default gateway:
esxcli network ip route ipv4 add -N defaultTcpipStack \
    -n default -g 10.0.0.1

# PowerCLI — Audit VMkernel stack assignments across hosts:
Get-VMHost | ForEach-Object {
    $vmks = Get-VMHostNetworkAdapter -VMHost $_ -VMKernel
    foreach ($vmk in $vmks) {
        [PSCustomObject]@{
            Host = $_.Name
            VMkernel = $vmk.Name
            IP = $vmk.IP
            VMotion = $vmk.VMotionEnabled
            Mtu = $vmk.Mtu
        }
    }
} | Format-Table -AutoSizeCopy

List and manage firewall rulesets

# List all firewall rulesets and their status:
esxcli network firewall ruleset list

# Check if firewall is enabled globally:
esxcli network firewall get

# Get details of a specific ruleset (allowed IPs, ports):
esxcli network firewall ruleset rule list -r sshServer
esxcli network firewall ruleset rule list -r nfsClient
esxcli network firewall ruleset rule list -r vMotion

# List only enabled rulesets:
esxcli network firewall ruleset list | grep trueCopy

Enable/disable rulesets and restrict by IP

# Enable a firewall ruleset:
esxcli network firewall ruleset set -e true -r syslog
esxcli network firewall ruleset set -e true -r nfsClient
esxcli network firewall ruleset set -e true -r sshServer

# Disable a ruleset:
esxcli network firewall ruleset set -e false -r CIMSLP

# Restrict SSH to specific IPs (security hardening):
esxcli network firewall ruleset set -r sshServer -a false  # Disable "allow all"
esxcli network firewall ruleset allowedip add -r sshServer -i 10.0.0.0/24
esxcli network firewall ruleset allowedip add -r sshServer -i 192.168.1.100

# Restrict vCenter access:
esxcli network firewall ruleset set -r vpxClient -a false
esxcli network firewall ruleset allowedip add -r vpxClient -i 10.0.0.50

# Refresh firewall rules:
esxcli network firewall refreshCopy

Create custom firewall rules

# Custom rules are XML files in /etc/vmware/firewall/
# Example: Allow custom monitoring agent on port 9100

cat > /etc/vmware/firewall/custom-monitor.xml << 'EOF'
<ConfigRoot>
  <service id="0050">
    <id>customMonitor</id>
    <rule id="0000">
      <direction>inbound</direction>
      <protocol>tcp</protocol>
      <porttype>dst</porttype>
      <port>9100</port>
    </rule>
    <enabled>true</enabled>
    <required>false</required>
  </service>
</ConfigRoot>
EOF

# Refresh firewall to load new rules:
esxcli network firewall refresh

# Verify custom rule loaded:
esxcli network firewall ruleset list | grep customMonitor
esxcli network firewall ruleset rule list -r customMonitorCopy

Enable IOMMU and verify hardware support

# Step 1: Enable Intel VT-d / AMD-Vi in server BIOS/UEFI
# Dell: BIOS → Processor Settings → Virtualization Technology → Intel VT-d: Enabled
# HP:   BIOS → Virtualization → Intel(R) VT-d: Enabled

# Verify IOMMU is enabled in ESXi:
esxcli system settings kernel list | grep -i iommu

# Check if passthrough-capable devices are detected:
esxcli hardware pci list | grep -i "network\|ethernet"

# vCenter UI: Host → Configure → Hardware → PCI Devices
# Devices available for passthrough will be listedCopy

Configure SR-IOV Virtual Functions

# Enable SR-IOV on a compatible NIC:
# vCenter UI: Host → Configure → Hardware → PCI Devices
# Select NIC → Configure SR-IOV → Number of VFs: 8 (max varies by NIC)

# Reboot host for SR-IOV to take effect

# After reboot, verify VFs are created:
lspci | grep "Virtual Function"
esxcli network sriovnic vf list -n vmnic4

# Check SR-IOV NIC status:
esxcli network sriovnic list

# Assign VF to a VM:
# VM → Edit Settings → Add New Device → Network Adapter
# Adapter Type: SR-IOV Passthrough
# Physical Function: vmnic4
# VM will get a VF from the NIC hardwareCopy

Configure DirectPath I/O (PCI Passthrough)

# Mark device for passthrough:
# vCenter UI: Host → Configure → Hardware → PCI Devices
# Select device → Toggle Passthrough → Reboot host

# Assign passthrough device to VM:
# VM → Edit Settings → Add New Device → PCI Device
# Select the passthrough device

# IMPORTANT: VM settings must also have:
# - Memory Reservation: Full (all memory must be reserved)
# - VM → Edit Settings → Memory → Reserve all guest memory

# PowerCLI — Check passthrough devices:
$vmhost = Get-VMHost "esxi-01.lab.local"
$vmhost.ExtensionData.Config.PciPassthruInfo | Where { $_.PassthruEnabled } |
    Select Id, PassthruEnabled, PassthruCapable, PassthruActive |
    Format-Table -AutoSize

# Verify VM has passthrough device:
(Get-VM "perf-vm").ExtensionData.Config.Hardware.Device |
    Where { $_ -is [VMware.Vim.VirtualPCIPassthrough] } |
    Select @{N='Device';E={$_.DeviceInfo.Summary}}Copy