VLAN configuration on ESXi trips people up more than it should, mostly because there are three different tagging modes and choosing the wrong one causes silent connectivity failures that are annoying to debug. This post breaks down all three modes (EST, VST, and VGT) with real configuration examples so you know exactly what to set and why.
The Three VLAN Modes
ESXi supports IEEE 802.1Q VLAN tagging and handles it in three different ways depending on where the tagging happens.
EST – External Switch Tagging (VLAN ID 0)
With External Switch Tagging, the physical switch does all the VLAN work. The physical NIC on the ESXi host plugs into an access port on the physical switch, already assigned to a specific VLAN. Frames arriving at the ESXi host are already untagged. On the port group, you set VLAN ID to 0. ESXi passes traffic straight through without touching VLAN tags.
When to use it: Simple flat networks, environments where the network team controls VLAN assignment at the physical switch. The downside is you need a separate physical NIC and switch port per VLAN.
VST – Virtual Switch Tagging (VLAN ID 1–4094)
This is the most common mode in production environments. The physical switch port is configured as a trunk port, passing tagged frames for multiple VLANs. The ESXi vSwitch handles the tagging and untagging before traffic reaches VMs.
On the port group, you set the VLAN ID to the specific VLAN you want (e.g., VLAN 100 for production). When a VM sends a frame, the vSwitch tags it before sending it out the uplink. The VM never sees VLAN tags.
# Set port group to VLAN 100 (VST mode)
esxcli network vswitch standard portgroup set --portgroup-name="Production" --vlan-id=100
# For a VDS port group, use PowerCLI:
Get-VDPortgroup "Production" | Set-VDPortgroup -VlanId 100Physical switch side (Cisco example):
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 100,200,300
switchport trunk native vlan 1VGT – Virtual Guest Tagging (VLAN ID 4095)
With VGT, the VM itself handles VLAN tagging. Set the port group to VLAN ID 4095, this tells the vSwitch to pass 802.1Q tagged frames straight through to the VM without stripping or adding tags. The VM needs an 802.1Q-capable NIC driver (vmxnet3 supports this) and must be configured with sub-interfaces at the OS level.
When to use it: Network appliances, firewalls, vRouter VMs, IDS/IPS appliances that need to handle multiple VLANs themselves.
# Linux example inside a VGT VM
modprobe 8021q
ip link add link eth0 name eth0.100 type vlan id 100
ip addr add 192.168.100.10/24 dev eth0.100
ip link set eth0.100 upHow to Choose the Right Mode
| Scenario | Mode | VLAN ID on Port Group |
|---|---|---|
| One VLAN per physical NIC, physical switch does all tagging | EST | 0 |
| Multiple VLANs on trunk, VMs are VLAN-unaware (most common) | VST | 1–4094 |
| VM itself needs to handle VLAN tagging (firewall VMs, etc.) | VGT | 4095 |
PVLANs on VDS
If you need isolation within the same VLAN, for example, separating tenant VMs that share the same IP subnet but must not talk directly. Private VLANs (PVLANs) on the Distributed Switch are the answer. Configure PVLANs by navigating to your VDS → Settings → Edit Private VLAN. Create the primary VLAN first, then add secondary VLANs (Isolated or Community types). Assign distributed port groups to the appropriate secondary VLANs.
Troubleshooting VLAN Issues
VM has no connectivity after VLAN change. Check that the physical switch port is actually a trunk and that your VLAN is in the allowed VLAN list. A common mistake is setting VST on ESXi but leaving the physical port as an access port.
VM can reach some hosts on the VLAN but not others. Check the native VLAN on the trunk. Be careful with VLAN 0 on trunk ports. VLAN ID 0 means EST mode (untagged), which is designed for access ports, not trunks. On a trunk, the physical switch may drop those untagged frames rather than place them on its native VLAN, depending on configuration, which may not be what you want.
VMs on different hosts can’t reach each other despite same VLAN. Verify the VLAN ID is consistent across all port groups on all hosts. With standard switches this has to be set manually per host.
# Quick check from ESXi shell
esxcli network vswitch standard portgroup list
esxcli network ip interface listNative VLAN Considerations
When using VST mode, be highly deliberate about your native trunk configuration. Setting a port group to VLAN ID 0 is strictly for EST mode on physical access ports, not trunks. If your VMs must communicate with the physical switch’s native VLAN across an active trunk link, explicitly map the port group’s VST VLAN ID to match that native VLAN number (e.g., VLAN 1) rather than leaving it at 0. Relying on VLAN 0 across a trunk can cause silent drops depending on how the physical switch handles untagged ingress frames on a non-native trunk config. When in doubt, tag everything explicitly and leave VLAN 1 empty on the physical switch.