If you cannot explain how network traffic flows from a user's laptop to the virtual machine hosting a web server, you will fail the VCP-DCV exam. VMware vSphere Networking is the invisible plumbing that connects all your virtual machines to each other and to the outside world. For someone studying VCP-DCV, understanding virtual switches and port groups is non-negotiable—it is the foundation upon which every other configuration (from high availability to disaster recovery) is built.
Jump to a section
A simple way to picture VMware vSphere Networking
A busy apartment building with a central mailroom.
The building manager installs a big, locked mailroom on the ground floor with one delivery slot for the postal truck. Inside, there is a row of individual locked mailboxes, one for each apartment. Every resident has a unique apartment number. The mailroom itself has no brain—it is just a set of rules carved into the wall: 'If a parcel is for apartment 3B, slide it into mailbox 3B.' The postal worker does not know who lives in 3B or what is in the parcel; they just follow the rules.
Now, imagine the building is a physical server. The mailroom is a virtual switch. Each apartment mailbox is a virtual machine's network card. The postal worker is a physical cable bringing internet into the building. The carved rules are the VLAN configuration. If the building manager wanted to create a separate mailroom just for the gym (a DMZ), they would build a second mailroom with its own mailboxes and a separate delivery slot. The first mailroom could have a rule saying, 'Let the gym mailroom handle all parcels for the gym.' This is like a VLAN trunk for a DMZ port group.
If a resident moves out and a new one moves in, the manager just repoints the mailbox rules—they do not change the mailroom itself. That is exactly what happens when you migrate a virtual machine between hosts and only need to adjust the port group membership.
The entire system works because the mailroom is just a logical partition of the building's physical space. It costs nothing to add more mailboxes—until you run out of wall space. That wall space is the host's physical network interface cards (NICs) and their speed.
Let us start at the very beginning. A physical computer server has one or more physical network ports (called physical NICs, or pNICs). In a traditional, non-virtualised data centre, you would plug a cable from that pNIC into a physical network switch, and traffic would flow between servers. In a virtualised data centre, one physical server can run dozens of virtual machines (VMs). Each VM needs to send and receive network traffic as if it were a real physical computer.
That is where the virtual switch (vSwitch) comes in. A vSwitch is a software program that runs inside the VMware ESXi hypervisor—the operating system that runs directly on the server hardware and manages the VMs. The vSwitch does exactly what a physical network switch does: it takes incoming data packets and forwards them to the correct destination based on the destination MAC address (a unique hardware identifier burned into every network card). The key difference is that a vSwitch is entirely logical; it exists only as code within the hypervisor.
A vSwitch has two main types of connections: uplinks and port groups. An uplink is a connection from the vSwitch to a physical NIC on the server. This is how the vSwitch gets out to the physical network—the office LAN or the internet. If your server has two physical NICs, you can connect both to the same vSwitch to provide redundancy (if one NIC fails, the other takes over) and more bandwidth (traffic can split across both). A port group is a logical bucket on the vSwitch. You assign a VM to a port group, and that VM gets its own virtual network card (vNIC) that is plugged into that port group. The port group defines how the VM communicates: which VLAN (Virtual Local Area Network) it belongs to, what speed it negotiates, and what security policies (like promiscuous mode, which we will discuss later) apply.
Think of a port group as a labelled club inside the vSwitch. Every VM in the same port group can talk to each other directly through the vSwitch. To talk to a VM on a different port group, traffic must go out of the uplink to a physical router and then come back in. This separation is how you keep different departments (e.g., HR network vs Guest Wi-Fi) isolated from each other without needing separate physical switches.
There are two types of virtual switches in vSphere: standard vSwitches and distributed vSwitches (dvSwitches). A standard vSwitch exists only on one ESXi host. If you have ten ESXi hosts in a cluster, you must configure a standard vSwitch on each host separately. A distributed vSwitch, available only with a vSphere Enterprise Plus license, exists across an entire data centre. You configure it once, and it appears identically on every host that is attached to it. This massively simplifies management. The VCP-DCV exam expects you to know the difference and when to use each.
VLANs (Virtual Local Area Networks) are a critical concept here. A VLAN allows you to split a single physical network into multiple isolated logical networks. For example, you can have VLAN 10 for production traffic, VLAN 20 for management traffic, and VLAN 30 for storage traffic—all running over the same cables and physical switches, but kept completely separate. In vSphere, you configure VLANs at the port group level. A port group can be set to one of three VLAN modes:
VLAN 0 (or none): The VM traffic is untagged and gets whatever network the physical switch offers by default.
VLAN ID: A specific numeric ID (1-4094) that the vSwitch tags onto every packet coming from that port group. The physical switch must know how to handle that tagged traffic.
VLAN trunk: The port group passes all VLAN tags through to the VM. This is used for advanced configurations like virtual firewalls.
Network I/O Control (NIOC) is a feature that prevents one VM from hogging all the network bandwidth. Imagine ten VMs sharing a single 1 Gbps uplink. Without NIOC, one VM could saturate the link, starving the other nine. NIOC allows you to reserve, limit, and set shares (priority weights) for different types of network traffic: management, virtual machine, vMotion, iSCSI, NFS, and so on. This guarantees that critical services always get their fair share.
Finally, a feature called promiscuous mode. In a normal vSwitch, a VM can only see traffic destined for its own MAC address. If you enable promiscuous mode on a port group, every VM in that port group can see all traffic passing through the vSwitch—including traffic intended for other VMs. This is sometimes needed for network monitoring tools or intrusion detection appliances. It is a security risk and should be used sparingly. The exam loves to test whether you know when it is appropriate.
Create a Virtual Switch
In the vSphere Client, navigate to the host or data centre. Choose 'Add Networking'. Select 'Virtual Switch' (standard or distributed). For a standard switch, you give it a name (e.g., 'vSwitch0') and specify the number of physical NIC uplinks. For a distributed switch, you create the switch object first and then add hosts to it. This is the foundation; without a vSwitch, VMs cannot communicate.
Add Uplink Adapters
You select one or more physical NICs (pNICs) from the host and attach them to the vSwitch as uplinks. This physically connects the software switch to the outside network. Without an uplink, the vSwitch is isolated to that host only VMs can talk to each other but not to the rest of the network.
Create Port Groups
After the switch exists, you create port groups. Each port group gets a name, a VLAN ID (or 'none'), and optional security or traffic-shaping policies. Port groups are where you assign VMs. A misconfigured port group (e.g., wrong VLAN ID) can cause the VM to be unreachable.
Configure Teaming and Failover
In the vSwitch or port group settings, you specify the load-balancing policy (e.g., IP hash, MAC hash) and the active/standby order of uplinks. This step ensures that if one NIC fails, traffic moves to another without losing connectivity. You also set whether to use Network I/O Control here.
Assign a Virtual Machine to a Port Group
Edit the VM's settings, go to the virtual network adapter, and select the port group you created. If you change the port group on a running VM, the network disconnects momentarily while the VM reconnects to the new network segment. This step is how you logically place the VM into the correct VLAN.
Test Connectivity
After assignment, ping the VM's IP address from another VM on the same port group, then from a different port group, and finally from outside the host (e.g., an admin laptop). This step catches misconfigurations like wrong VLAN ID, missing uplink, or firewall rules blocking traffic.
You are the sole IT administrator for a mid-sized company that runs its entire production workload on a three-host vSphere cluster. The company has four departments: Accounting, Sales, Engineering, and a Guest Wi-Fi network. Each department must be completely isolated from the others. The accounting team also needs access to a specific legacy financial application that runs on a separate subnet.
Here is how you would actually configure vSphere Networking in this scenario:
First, you log into the vSphere Client and create a distributed switch (dvSwitch) across all three hosts. Why? Because a distributed switch makes it trivial to add a new host later—just attach it, and all port groups appear automatically. You name it 'Corp-DVSwitch'.
Next, you create four port groups on this dvSwitch: 'Accounting-PG', 'Sales-PG', 'Engineering-PG', and 'Guest-PG'. You assign each a unique VLAN ID: VLAN 100, 200, 300, and 400 respectively. You also create a special port group called 'Legacy-App-PG' with VLAN 500, and you add a note in the description that it is for the financial application.
Now you need to connect the vSwitch to the physical network. You have two physical NICs per host (NIC1 and NIC2). You add both NICs as uplinks to the dvSwitch. Then you configure a teaming policy: 'Route based on IP hash'. This means traffic is distributed across both NICs based on the source and destination IP addresses. You also enable failover: if NIC1 fails, NIC2 takes over. No interruption.
You then go to each VM. For the accounting VM, you edit its settings, and under network adapter, you select 'Accounting-PG'. You do the same for the other departments. Each VM automatically inherits the VLAN of its port group. The VMs are now isolated. If a VM from Sales tries to send a packet to an Engineering VM, that packet will never leave the physical switch because the port groups are on different VLANs—the physical switch sees them as separate networks and will not route between them unless you explicitly create routing rules.
For the legacy financial application, you configure a virtual router appliance (like a pfSense VM) with two vNICs: one on 'Guest-PG' (for administration) and one on 'Legacy-App-PG'. You set up firewall rules in the appliance to allow accounting IPs only. Now the accounting team can reach the legacy app, but nobody else can.
Finally, you enable Network I/O Control (NIOC) and assign shares: for vMotion traffic, you set high shares; for VM traffic, normal shares; for management traffic, low shares. This ensures that when a vMotion migration happens (which can use a lot of bandwidth), your production VMs do not slow down.
If a new host is added to the cluster next quarter, you simply attach it to the dvSwitch and the dvSwitch automatically pushes the same configuration to it. No manual set-up.
The VCP-DCV exam (exam number 2V0-21.19 and later versions) tests vSphere Networking extensively. Expect approximately 10–15% of the questions to come from Objective 2.2. The exam is multiple-choice and scenario-based. They love to give you a business requirement and ask which configuration meets it.
Key exam traps to watch for:
Port groups vs. dvPort groups: The exam will test whether you know that a standard virtual switch has port groups, while a distributed switch has dvPort groups. They are functionally similar, but the naming matters. A question might say 'An administrator wants to configure VLAN tagging for a set of VMs. What should they modify?' The answer is the port group (or dvPort group), not the virtual switch itself.
VLAN filtering: They will give a scenario where you need to isolate two sets of VMs on the same host. The trap answer is 'create two separate virtual switches'—which works but is wasteful and harder to manage. The better answer is 'create two port groups with different VLAN IDs on the same virtual switch.' The exam will punish you for choosing the more complex solution.
Teaming and failover order: You must memorise the load-balancing policies:
- Route based on originating virtual port (default) - Route based on source MAC hash - Route based on IP hash (requires the physical switch to support EtherChannel) - Use explicit failover order (the VM uses the first active uplink only, switches to second if first fails)
The exam will ask which policy is used for a specific scenario, e.g., 'Which policy requires configuration on the physical switch?' Answer: IP hash. - Promiscuous mode and Mac changes: They will ask when to enable promiscuous mode. The correct answer is 'when using a virtualised network monitoring appliance like VMware vRealize Network Insight.' They might trick you by saying 'to allow VMs on different port groups to communicate'—that is wrong; VLANs handle isolation, not promiscuous mode. - MTU size: Jumbo frames (MTU 9000) are commonly tested. A question like 'What is the maximum MTU supported by a vSphere standard switch?' Answer: 9000 bytes. They might contrast it with the default MTU of 1500. - NIOC shares: They will ask about the difference between reservation, limit, and shares. Reservation guarantees bandwidth; limit caps bandwidth; shares control priority when bandwidth is contested.
Common question formats: - 'A customer has four physical NICs on a host. What is the maximum number of virtual switches that can be created?' Answer: Up to 4096 per host (used to be 128 in older versions). They expect exact numbers. - 'Which component of vSphere Networking is responsible for tagging frames with a VLAN ID?' Answer: The virtual switch (port group). - 'An administrator notices that VMs on the same port group cannot communicate. What is the most likely cause?' Answer: The VLAN ID on the port group is set incorrectly (or the physical switch is not allowing that VLAN ID).
To prepare, practise building a standard and distributed switch in a lab environment. Force yourself to understand what happens when you change a VLAN ID on a running VM. That hands-on experience is worth more than any textbook.
A standard virtual switch is configured per host; a distributed virtual switch is configured once and applies to all attached hosts in a data centre.
Port groups are the logical containers that define VLAN membership, security policies, and traffic shaping for groups of virtual machines.
VLANs provide logical network isolation but do not encrypt traffic; use separate security measures for sensitive data.
The default load-balancing policy for a virtual switch is 'Route based on originating virtual port', which assigns each VM's traffic to a single uplink based on the vSwitch port.
Promiscuous mode must only be enabled when a virtual machine needs to see all traffic on a network segment, such as a network monitoring appliance.
Network I/O Control (NIOC) uses reservations, limits, and shares to guarantee fair bandwidth allocation among different network traffic types (management, VM, vMotion, etc.).
These come up on the exam all the time. Here's how to tell them apart.
Standard vSwitch
Configured independently on each ESXi host
No centralised management; each host must be configured separately
Free with any vSphere license (including Essentials)
Distributed vSwitch
Exists across all hosts in a data centre; configured once
Centralised management via vCenter Server; changes replicate to all hosts
Requires vSphere Enterprise Plus license
Port Group
Belongs to a standard virtual switch on a single host
Does not support private VLANs or port-level policies
Simpler to configure for small environments
dvPort Group
Belongs to a distributed switch across multiple hosts
Supports private VLANs, port-level traffic shaping, and I/O control
More complex to set up but more powerful
VLAN ID (Tagged)
Specific VLAN ID assigned to all traffic from a port group
Traffic is always tagged with that single ID
Used for isolating a group of VMs on one VLAN
VLAN Trunk (All Tags Pass)
Port group is configured with VLAN 4095 (trunk mode)
VM receives all VLAN tags and decides which to use internally
Used when a virtual firewall or router needs to route multiple VLANs
Route Based on Originating Virtual Port
Default load-balancing policy
Each VM's traffic uses a single uplink based on its virtual switch port
Does not require any physical switch configuration
Route Based on IP Hash
Distributes traffic per IP flow across uplinks
Traffic from the same VM to different destinations can use different uplinks
Requires physical switch ports to be configured for EtherChannel or LACP
Mistake
A virtual switch is the same as a virtual machine, and you can RDP into it to configure it.
Correct
A virtual switch is a kernel-level component of the ESXi hypervisor. You cannot SSH or RDP into a vSwitch. You configure it entirely through the vSphere Client or command-line tools like esxcli.
Beginners assume that any virtual component has a console, because VMs have consoles. The vSwitch is invisible, and that feels unintuitive.
Mistake
If I create a port group with VLAN 100, all traffic is automatically encrypted.
Correct
VLANs provide isolation, not encryption. Traffic inside a VLAN is still plaintext unless you separately configure encryption (like IPsec or a virtual VPN appliance).
The word 'virtual' and 'separate' leads people to assume security. In reality, VLAN hopping attacks exist, so VLANs are only a logical boundary, not a security boundary.
Mistake
Distributed switches are always better because they are newer and have more features.
Correct
Distributed switches require an Enterprise Plus license. For smaller environments (a single host, or a lab), a standard switch is simpler and perfectly adequate. dvSwitches add management complexity and are only worth it when you have multiple hosts and need centralised configuration.
Marketing materials tend to highlight dvSwitch features. Beginners then assume 'more features = always better', ignoring the licensing cost and administrative overhead.
Mistake
You need a physical network switch for each VLAN you create.
Correct
Modern physical switches support VLAN trunking. You can run hundreds of VLANs over a single physical cable by tagging frames with VLAN IDs. The physical switch separates them internally.
If you grew up in a pre-virtualisation world, you might assume each VLAN requires its own cable and port. The exam tests that you understand trunking.
Mistake
The default teaming policy (route based on originating virtual port) means traffic is evenly distributed across all uplinks.
Correct
This policy distributes traffic per virtual port, not per packet or per flow. If you have 10 VMs and 2 uplinks, each VM gets its own uplink, but a single VM's traffic always uses one uplink. It is not true load balancing.
The word 'balance' is in vSphere's documentation, but the actual mechanism is more like 'pinning'. Beginners expect all NICs to be used equally at all times.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, you can change the port group of a running VM in vSphere. The VM will experience a brief network interruption (a few seconds) as its virtual network card reconnects to the new segment.
A standard switch is configured independently on each ESXi host. A distributed switch is a single switch that spans multiple hosts, so you configure it once and it applies everywhere. Distributed switches require an Enterprise Plus license.
Each port group on a virtual switch can be assigned a VLAN ID. When a VM in that port group sends a packet, the vSwitch adds a 4-byte VLAN tag to the Ethernet frame. The physical switch reads the tag and places the packet on the correct VLAN.
Most likely, the VLAN ID on the port group is set incorrectly, or the physical switch is not allowing that VLAN ID. Check that the port group's VLAN ID matches the physical network's configuration, and ensure there are no firewall filters on the VM itself.
Promiscuous mode allows a virtual machine to see all traffic passing through the virtual switch, including traffic destined for other VMs. It should be enabled only for network monitoring appliances or intrusion detection systems—never for standard production VMs.
Yes. The physical switch ports that connect to your ESXi hosts must be configured as trunk ports (carrying multiple VLANs) if you are using VLAN IDs. Also, if you use the IP hash load-balancing policy, the physical switch ports must be part of an EtherChannel or LACP group.
You've finished VMware vSphere Networking. Continue through the VCP-DCV study guide to build a complete picture of the exam.
Done with this chapter?