Skip to content
Study CCNP

2.1.c Virtual switching

4 min read ENCOR 350-401 v1.2 Updated

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

What this objective tests

This is a describe objective. The exam wants you to explain how a virtual switch fits into the packet path. It also wants you to connect port group settings to physical switch settings.

A virtual switch is a software switch inside a hypervisor. It connects VM virtual NICs to each other and to the physical NICs on the host. It can forward, tag, filter, or drop frames.

The basic model

VM-A vNIC
VM-B vNIC
-> vSwitch / port group
-> host uplink NIC
-> physical switch

VMs connect to the virtual switch through port groups or virtual networks. The host uplink connects the virtual switch to the physical network.

A port group is not only a label. It usually controls VLAN membership. It can also control security settings, teaming behavior, and traffic policy. The port group is the control point for what a VM can send and receive.

VLAN tagging models

There are three common ways VLANs appear around a virtual switch.

ModelWho applies the VLAN tagCommon use
Access-style port groupThe port group tags VM framesNormal VMs, servers
Trunk to the VMThe VM guest handles tagsVirtual routers and firewalls
Host-only networkNo tag, no uplinkIsolated labs

Access-style is the common model:

VM sends untagged frame
-> port group maps it to VLAN 20
-> host uplink sends tagged VLAN 20 frame over the trunk

A virtual router or firewall often needs a trunk instead. The guest uses VLAN subinterfaces and receives tagged frames.

Scenario: a hypervisor host connects to SW1 port Gi1/0/20. VMs web-01 and app-01 use VLAN 10. The port group is SERVERS-VLAN10.

Physical switch config:

interface GigabitEthernet1/0/20
 description Hypervisor host uplink
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 spanning-tree portfast trunk

Virtual switch mapping:

Port group: SERVERS-VLAN10
VLAN: 10
Connected VMs: web-01, app-01
Host uplinks: vmnic0, vmnic1
Physical switch allowed VLANs: 10,20,30

Both sides agree on VLAN 10. Traffic flows.

Warning: Use spanning-tree portfast trunk only on host uplinks. A host is an end device, not a switch. Do not use it on links that can create loops.

Expected verification output on SW1:

SW1# show interfaces trunk
Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/20    on               802.1q         trunking      1
Port        Vlans allowed on trunk
Gi1/0/20    10,20,30

SW1# show mac address-table interface gi1/0/20
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0050.56a1.0101    DYNAMIC     Gi1/0/20
  10    0050.56a1.0102    DYNAMIC     Gi1/0/20

Two MAC addresses on VLAN 10 prove that web-01 and app-01 frames reach the physical switch.

Lab: wrong VLAN on the port group

Goal

Show how a virtual switch setting can break the network while every IOS config looks correct.

Topology

Linux-VM 10.20.20.10/24 -> port group USERS -> vSwitch -> SW1 Gi1/0/20 -> gateway 10.20.20.1 (SVI Vlan20)

Intended design

  • Port group USERS maps to VLAN 20.
  • Gateway SVI Vlan20 is 10.20.20.1/24.
  • Linux-VM has 10.20.20.10/24 with gateway 10.20.20.1.

Gateway config on the Layer 3 switch:

interface Vlan20
 description USERS gateway
 ip address 10.20.20.1 255.255.255.0
 no shutdown

Do these steps:

  1. Verify the Linux VM pings 10.20.20.1 with success.
  2. In the hypervisor, change the USERS port group VLAN from 20 to 30.
  3. Ping 10.20.20.1 from the Linux VM again.
  4. Run show interfaces trunk on SW1.
  5. Run show mac address-table vlan 20 on SW1.
  6. Change the port group back to VLAN 20 and ping again.

Expected results:

  • After step 3, the ping fails.
  • After step 4, the trunk still allows VLAN 20. The IOS config is correct.
  • After step 5, the VM MAC address no longer appears in VLAN 20.
  • After step 6, the ping succeeds again.

The lesson: check the port group VLAN before you change any IOS config.

Security and loop notes

  • A VM can send frames with an unexpected source MAC. Virtual switch security policy can block this.
  • Virtual switches can block promiscuous mode and forged transmits by default.
  • A host with multiple uplinks needs a teaming policy that matches the physical design.
  • Bridging between virtual switches in a lab can create loops.

Exam traps

  • A virtual switch does not replace the physical switch. It extends switching into the host.
  • The port group VLAN and the trunk allowed VLANs must agree.
  • A virtual router may need a trunk, not an access-style port group.
  • Host-only networks are isolated from the physical network on purpose.
  • Do not troubleshoot only IOS config when the VM attaches to the wrong virtual network.

Pass check

You are ready for this objective when you can do these things:

  • Explain the role of a port group in the packet path.
  • Describe the three VLAN tagging models.
  • Read show interfaces trunk and confirm the allowed VLANs.
  • Explain why a VM MAC address in the physical MAC table proves the path.
  • Localize a failure to the port group when all IOS configs are correct.

Related objectives