Skip to content
Study CCNP

2.1.c Virtual switching

3 min read ENCOR 350-401 v1.2

Aligned to Cisco's 350-401 ENCOR v1.2 exam topics.

On this page

A virtual switch is a software switch inside a hypervisor. It connects VM virtual NICs to each other and to physical NICs on the host.

The important CCNP idea is this: a virtual switch is part of the network path. It can be the place where frames are forwarded, VLAN-tagged, filtered, or dropped.

The basic model

VM-A vNIC
VM-B vNIC
vSwitch / port group
Host uplink NIC
Physical switch

VMs connect to the virtual switch through port groups or virtual networks. The host uplink connects the virtual switch to the physical network.

A port group is not just a label. It usually controls VLAN membership and may also control security settings, teaming behavior, traffic shaping, or policy.

VLAN tagging models

There are three common ways VLANs show up around a virtual switch.

Access-style VM connection

The VM sends and receives untagged frames. The port group applies the VLAN.

VM sends untagged frame
Port group maps it to VLAN 20
Host uplink sends tagged VLAN 20 frame over trunk

This is common and easy to troubleshoot.

Trunk to a VM

The VM receives tagged frames and handles VLAN subinterfaces itself.

VM firewall/router uses VLAN tags
Virtual switch allows trunking
Physical uplink allows those VLANs

This is common for virtual routers and firewalls.

Host-only or internal switching

VMs talk to each other inside the host and do not leave through a physical uplink.

This is useful for labs and isolated networks.

Physical switch config: host uplink trunk

interface GigabitEthernet1/0/20
 description Hypervisor host uplink
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 spanning-tree portfast trunk

Use spanning-tree portfast trunk carefully. It is common on a hypervisor host uplink because the connected device is an end host, not another switch. Do not use it blindly on links that could create switching loops.

Virtual switch mapping example

Port group: SERVERS-VLAN10
VLAN: 10
Connected VMs: web-01, app-01
Host uplinks: vmnic0, vmnic1
Physical switch allowed VLANs: 10,20,30

If web-01 cannot reach its gateway, verify both sides.

On the physical switch:

show interfaces trunk
show mac address-table interface gi1/0/20
show spanning-tree vlan 10 interface gi1/0/20 detail

In the hypervisor:

  1. web-01 vNIC connected: yes
  2. web-01 port group: SERVERS-VLAN10
  3. SERVERS-VLAN10 VLAN: 10
  4. Host uplink active: vmnic0 or vmnic1

Inside the VM:

ip addr
ip route
ping <gateway>
arp -n

Lab: wrong VLAN on the port group

Goal

See how a virtual switch setting can break a network even when router and physical switch configs look correct.

Topology

Linux VM -> Port group USERS -> vSwitch -> SW1 Gi1/0/20 -> R1 gateway

Intended design

USERS VLAN: 20
Gateway: 10.20.20.1/24
Linux-VM: 10.20.20.10/24

Physical switch

vlan 20 -> name USERS -> interface GigabitEthernet1/0/20 -> description Hypervisor host uplink -> switchport mode trunk -> switchport trunk allowed vlan 20 -> spanning-tree portfast trunk

Gateway

interface Vlan20
 description USERS gateway
 ip address 10.20.20.1 255.255.255.0
 no shutdown

Break

Set the virtual port group to VLAN 30 instead of VLAN 20.

Expected result

Linux-VM cannot ping 10.20.20.1. -> SW1 trunk still allows VLAN 20. -> R1/SVI config still looks correct. -> The broken setting is the virtual port group VLAN.

Fix

Change the port group back to VLAN 20.

Verify

Linux-VM$ ping -c 3 10.20.20.1
SW1# show mac address-table vlan 20 interface gi1/0/20
SW1# show interfaces trunk

Security and loop notes

Virtual switching can introduce surprises:

  • A VM may send frames with an unexpected source MAC.
  • A virtual switch may block promiscuous mode or forged transmits.
  • A virtual router/firewall may require trunking to carry multiple VLANs.
  • A host with multiple uplinks needs a teaming policy that matches the physical network design.
  • Nested virtual switches can create loops in labs if you bridge carelessly.

Exam traps

  • A virtual switch does not replace the physical switch. It extends the switching path into the host.
  • The port group VLAN and the physical trunk allowed VLANs must agree.
  • A VM firewall/router may need a trunk, not an access-style port group.
  • Host-only networks are intentionally isolated from the physical network.
  • Do not troubleshoot only IOS config when the VM is attached to the wrong virtual network.

Quick check

  1. What is the purpose of a virtual switch uplink?
  2. What is a port group commonly used to define?
  3. Why might a virtual router need a trunk to the virtual switch?
  4. Which physical switch command confirms VLANs allowed on the host uplink?
  5. What should you check if the physical switch is correct but the VM still cannot reach its gateway?