vSphere Networking
Standard vs. distributed switches
A vSphere Standard Switch (vSS) is configured per host; a vSphere Distributed Switch (vDS) is configured once in vCenter and applied to many hosts. Port groups define VLAN, teaming, security and shaping policy. If vCenter is unavailable, hosts keep running with the last known distributed switch configuration but you cannot change it. A vDS therefore introduces a management dependency that a vSS does not.
Concepts to master
- Teaming policies: route based on originating virtual port, source MAC hash, IP hash, physical NIC load (LBT), and explicit failover order.
- Failover detection: link status versus beacon probing (requires at least three NICs).
- VLAN modes: virtual switch tagging (VST), virtual guest tagging (VGT, VLAN 4095), external switch tagging (EST).
- MTU consistency end to end for vMotion and vSAN traffic; NIOC for bandwidth shares; traffic shaping for average/peak/burst.
- Distributed switch features: LACP, health check, port mirroring, NetFlow, private VLANs, MAC learning.
Traps
IP hash requires a matching EtherChannel/LACP on the physical switch. LBT is a distributed switch-only policy. Beacon probing with two NICs will not behave as a candidate expects. Changing MTU requires updating the vSwitch, port group, VMkernel adapter and physical switch. Security policies (promiscuous, MAC address changes, forged transmits) are frequently tested in combination.
Rule of thumb
Keep vMotion and vSAN on dedicated VMkernel adapters with jumbo frames, and prefer LBT on a vDS over IP hash unless the physical team is already configured for a port channel.