One of my colleagues today asked me if it was possible to use VLAN ID 4095 for the “management” network of ESXi. This VLAN ID is however reserved for a very specific purpose.
This particular VLAN ID is only to be used for “Virtual Guest Tagging” (VGT). It basically means that the VLAN ID is stripped off at the Guest OS layer and not at the portgroup layer. In other words the VLAN trunk(multiple VLANs on a single wire) is extended to the virtual machine and the virtual machine will need to deal with it.
When will you use this? To be honest there aren’t many use cases any more. In the past it was used to increase the number of VLANs for a VM. The limit of 4 NICs for VI3 meant a maximum of 4 portgroups / VLANs per VM. However with vSphere the maximum amount of NICs went up to 10 and as such the amount of VLANs for a single VM also went up to 10.
Before people start to get excited about Virtual Guest Tagging, I personally prefer to stay away it. It heavily complicates the configuration of the VM and the vSwitch/dvSwitch and adds additional unneeded “stress” on your VMs vCPU.
Arjantim says
Hi Duncan,
Thanks for sharing this! It was a question a few weeks ago from a costumer which i at the time couldn’t reply on.
With this explanation i most certainly can.
BTW. Do you have any indication of the “stress” factor of VGT?
One note (i think you’ve forgotten the word “from” in between away and it). Stay away from it. FYI.
Again thanks for the information!
Arjan Timmerman
Virtual_JTW says
That’s somewhat odd – hopefully he meant management “port” as on a physical switch (not the management network in ESXi). Either case, is there a better way to get a management port than using 4095 in combination with promiscuous mode for the port group?
KyleMcM says
It is also probably worth noting that the IEEE 802.1Q standard states that VLAN ID 4095 is reserved and should not be used for VLAN assignments. This is why VMware utilised ID 4095 to provide VGT.
duncan says
@arjan, well that depends on the amount of network IO doesn’t it? But probably a couple %. It would not be a lot, but with 30 VMs running on a host it might result in something unexpected for something that is unneeded.
@virtual_jtw no ESXi management network. not sure what the reason was.
@KyleMcM good comment, should have mentioned that.
Saad OUACHE says
Hi Duncan,
actually, i have already used this Vlan ID in a special configuration (when virtualizing ESX4) so that the v(vSwitch) can unTag the vlans on its own vPortgroups, in that configuration i VMotioned a VM from a pESX to a vESX and also a vESX with running vVMs from one pESX to another.
Saad OUACHE.
Roman Hochuli says
Guys
Be aware that there are network-equipment vendors out there which use that vlan for certain internal management functions and will thus not transport this vlan. So better stay away from VLAN-ids >4090…
Cheers
Roman
Carl Skow says
There are some use cases for this. When you want to see whether a VLAN is working properly to the ESX host, you can set up a Linux VM with 4095 that has access to all VLANs to see if you can hit layer 3 on them. It’s more for a network checkup VM, not an everyday sort of thing.
AJ Ciampa says
Doesn’t AppSpeed use 4095 to grab traffic off the vSwitch for analysis?
Duncan Epping says
@CarlSkow, definitely a good usecase for it.
Gael BUFFET says
We have two use cases for that in production :
the first one is for doing some traffic inspection with WireShark or other software.
the second one is an inter-VLANs router under Vyatta, we have dozens of VLANs routed through a few gigabit LAN interfaces with ‘trunking VM Network’
invisible says
One use case for guest VLAN trunking when 10 vNICs are not enough:
We have >300 VMs in 65 landscapes (VLANs), we plan to double both numbers. So we have 65 portgroups in vDS on ESX cluster and each VLAN obviously has its own network segment.
I’m right now in the middle of VDI PoC which will utilize Citrix DDC/PVS to provision/deliver virtual desktops and ESX/VI as VD hosting infrastructure.
DDC/PVS needs to communicate to every VLAN/virtual desktop it is going to manage. So there are only two options left: setup inter-VLAN routing or have an option for DDC/PVS server have a leg (interface) in every VLAN where desktops are going to reside.
Because we have a requirement for fenced networks (devices in VLANs should not be able to communicate with devices in other VLANs) the second option is the only acceptable option for us. And Guest OS VLAN tagging in the only way to have it done in Vmware.
Interested says
Coincidentally i have a business case for the use of 4095 which we will be implementing soon. I’d be interested to see if what i am going to do is incorrect!
I have 4 ESXi hosts in a cluster and each host has only one pNIC left (1Gb). I have assigned this vmnic to a vSwitch and created three port groups within this vSwitch; Zone1, Zone2, Zone3. All the port groups have been assigned VLAN ID 4095; displayed as ‘All’.
We will be hosting several VMs within these port groups with VMs being in Zone1 the closest to our corporate LAN and the VMs within Zone3 being the closest to the outside world. We will be using our corporate LAN and WAN hardware to VLAN the traffic between the zones in a type of serial (Zone 1 to Zone2 to Zone3) to ensure traffic stays within certain boundaries.
I can’t see this being a problem. Does anyone disagree?
Thanks
Simon
Michael says
@Interested,
From experience, if you have a single vmnic with a port-group set to ‘All(4095)’ then it will see every vlan that is trunked on the physical side of the vSwitch. So all your machines, regardless of zone will see traffic from all the other zones. AFAIK the only way to workaround this limitation is to use multiple pNic’s and vSwitches and have one vSwitch per zone. Alternatively, dvSwitches would allow you to the functionality to do this within a single switch. You can confirm this by running tcpdump on the base interface of one of the connected machines and you should see traffic tagged in multiple vlans. HTH
bobbydamercer says
Good read for those interested
Vlan Tagging and use cases of VLAN ID 4095
[http://vmnomad.blogspot.com/2011/07/vlan-tagging-and-use-cases-of-vlan-id.html]
Mike Bravo says
Hi Duncan,
I am new to vmWare networking and had some questions related to VLAN 4095.
1. Promiscuous Mode [ receive path ] : VGT enabled vNic in port group with VLAN 4095. Do we need the vNic and the vSwitch to be separately configured in Promiscuous Mode, for the vNic to receive packets on all VLANs. How do this work in vSwitch vs dVS
2. vSwitch Behavior [ transmit path ] : For tagged packets originating from the VGT vNIC, how do the vSwitch forward the packets ? Does it forward all the tagged packets to the uplink ports or it looks at the destination mac-address and perform local forwarding to another vNic [ matching VLAN ] in the same vSwitch
Thanks
Mike Bravo
Ibrahim Quraishi says
Hi Duncan.
My esx was unable to see the disk both host is 5.1.0 . .. on some research found that I gave the default Paravirtual scsi driver – I changed to LSI Logic SAS and the disk showed up for the installer not sure if anyone else had this issue?
Ibrahim
vikrant says
Dear all ,
I have some doubts related to my network we are using one uplink on esxi host(10.20.1…) and on esxi 5.5 standard switch we are running two diffrent types of ip class network VMs one is class b ip add and another is class c ip add and i want to pass both diffrent class ip VM( 192.168.15… and 10.20.1..) from one uplink (10.20.1…).My esxi host ip add is 10.20.1… and on this esxi host we are running diffrent ip class VM .
what will be steps i need to follow so that our purpose can be resolved and we can run both diffrent ip VMS from one uplink and our vmotion ,HA ,DRS can run properly and all vm can be ping properly .
and my another question is i have done some setting on my v standard switch and phisical switch . The setting are as follows :-
configuration of Virtual Switch (vSwitch) VLAN Tagging (VST) on an ESXi/ESX host:
1 I have Assigned a VLAN to a portgroup(s)is 4095
2.Set the switch NIC teaming policy to Route based on originating virtual port ID (this is set by default).
configuration of physical switch settings:
1.Define ESXi 5.5 VLANs(4095) on the physical switch.
2.Allow the proper range to the ESXi/ESX host.ip 192.168.15… and 10.20.1 …
3.Set the physical port connection between the ESXi host and the physical switch to TRUNK mode. ESXi/ESX only supports IEEE 802.1Q (dot1q) trunking.
◦Physical switch is set to TRUNK mode
◦dot1q encapsulation is enabled
◦Spanning-tree is set to portfast trunk (for example, port forwarding, skips other modes)
◦Define VLAN interface
◦Assign IP Range 192.168.15… and 10.20.1… to VLAN interface 4095
◦VLAN Routing – and VLAN Isolation
our all vm is linux based so there is any need of VGT – Virtual Guest Tagging for linux