Managing Networking for a Virtual Machine

Lesson purpose

A virtual machine has no cable of its own. Everything it sends or receives, including user traffic, management traffic, live-migration traffic, and often its storage, passes through a virtual NIC, a virtual switch, and eventually a shared physical NIC. The book compares networking to the circulatory system: if the pathways are too small or poorly organized, every application on the host suffers. Students should leave able to trace a packet out of a VM, explain internal and external virtual switches, choose between bridged, NAT, and host-only connections, and describe how consolidation, segmentation, and newer tools (network I/O control, distributed switches, software-defined networking) shape virtual network design.

Learning objectives

By the end of the lesson, students should be able to:

Explain how a virtual machine connects to the physical network and to other VMs on the same host.
Compare the VMware and Xen/Hyper-V virtual networking models.
Describe internal, external, and storage virtual switches and why traffic is segmented.
Identify a VM’s IP address and virtual NIC from inside the guest and from the host.
Configure and distinguish bridged, NAT, and host-only connections and the VMnet0, VMnet8, and VMnet1 networks.
Explain bandwidth planning, converged adapters, network I/O control, distributed switches, and software-defined networking.

1. Networking is the VM’s only connection to the world

Networking is everywhere: phones, cars, TVs, and home computers all depend on it, and bandwidth controls how fast the data arrives. Data centers have well-established network practices, and like storage practices, they translate directly to virtual environments.

The basic path out of a VM:

The application sends a network request to the guest OS.
The guest OS passes it to its virtual NIC driver.
The hypervisor receives the request from its network emulator (the device the guest thinks is a real NIC).
The hypervisor sends it through the host’s physical NIC onto the network.
The response follows the reverse path back to the application.

Talking point: from inside the guest, nothing looks virtual. The OS loads an ordinary network driver for what appears to be an ordinary adapter.

2. Virtual switches and internal networks

A virtual network must also let VMs on the same host reach each other. Just as a physical switch creates a network among computers, a virtual switch (vSwitch) creates a network inside the host. The hypervisor creates and manages these switches.

Walk through the book’s VMware vSphere example (Figure 10.2):

External virtual switch: connected to a physical NIC and therefore to the outside network.
Internal virtual switch: connected to no physical NIC. Traffic on it can reach only other VMs attached to the same switch.
VM 1 has two virtual NICs, one on each switch. It can reach the outside world and the internal network.
VM 2 is connected only to the internal switch. It cannot be seen, much less attacked, from outside. VM 1 acts as its firewall.

This design is a common way to protect sensitive servers such as a database behind a web or application server.

Two consequences of internal switching:

Speed: VM-to-VM traffic on the same host never leaves the host; it moves in memory and is much faster than crossing the physical network. Chatty application tiers are often placed on the same host for this reason.
Visibility: because that traffic never touches the physical network, traditional network monitoring tools cannot see it. Virtualization-aware tools are needed (performance monitoring returns in Lesson 14).

Segmentation with multiple external switches

Physical networks use switches to separate production from test, or payroll from customer service, for performance and security. The same works virtually: add a second physical NIC, create a second external vSwitch tied to it, and attach a new VM only to that switch. Even though it shares the host, that VM has no internal path to the others and could reach them only if the physical network routes between the segments.

3. VMware model vs. Xen/Hyper-V model

VMware (ESXi): the hypervisor owns the virtual switches and manages network I/O directly.
Xen / Hyper-V: all traffic from user guests (DomU or child partitions) flows through Dom0 or the parent partition, where the virtual switch lives. The parent partition controls the physical NIC, so the hypervisor itself does not manage network I/O.

Either model can create external and internal-only switches. This mirrors the storage path from Lesson 9: the hypervisor handles I/O in the VMware model, and a privileged guest handles it in the Xen/Hyper-V model.

Lesson 9 showed that storage can be reached over TCP/IP through ordinary NICs (iSCSI, NFS, SMB). That storage traffic then competes with user traffic on the same physical and virtual paths. Plan bandwidth for it, and ideally give it its own path:

Each VM gets a dedicated virtual NIC for storage.
Those NICs connect to a storage virtual switch.
The storage switch uses its own physical NIC to reach the storage device.

Internal, external, and storage switches are built the same way; the names describe their purpose. Multiple storage switches on separate NICs can separate different storage resources just as network segments separate users.

Live migration (VMware calls it vMotion) moves a running VM from one host to another without interrupting users. It works by rapidly copying the VM’s memory to the destination host and then switching its network connections. It is bandwidth intensive and should have a dedicated path. Other vendors have similar features, covered in Lesson 13.

Virtual switch configuration

Virtual switches differ from physical ones in useful ways: you can change the number of ports without replacing hardware, and policies control security, availability (such as NIC teaming and failover), and performance behavior. Type 2 products like VMware Workstation expose only a small part of this.

5. IP addresses and the virtual NIC

Every network device, virtual or physical, needs a unique address, and a VM with several NICs needs one address per NIC. Addresses can be:

Static: assigned by an administrator for the life of the server.
Dynamic (DHCP): leased from a DHCP server for a period of time. Most Wi-Fi devices get their addresses this way.

An IPv4 address is a 32-bit number written as four decimal octets separated by periods (for example, 192.168.1.10).

Lab: find the VM’s address. In the Windows VM, search for cmd, open Command Prompt, and run:

C:\> ipconfig

Ethernet adapter Ethernet0:

   IPv4 Address. . . . . . . . . . . : 192.168.80.128
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.80.2

Ethernet adapter Ethernet0: one entry per virtual NIC. A second NIC adds a second entry.
IPv4 Address: the VM’s address on its network. Your value will differ.
Subnet Mask: which part of the address identifies the network.
Default Gateway: where traffic for other networks is sent. On a VMware NAT network, this is the virtual NAT device.

Lab: view the virtual NIC from both sides.

Inside the VM: open Device Manager, expand Network adapters, right-click the adapter, and choose Properties > Driver. The guest sees a standard Intel adapter with a standard Microsoft driver, identical to a physical card.
On the host: open Device Manager on the host (not in the VM). Alongside the physical wired and wireless adapters are VMware Virtual Ethernet Adapters (VMnet1 and VMnet8). These are software constructs; in a Type 2 hypervisor they play the role that virtual switches play in a Type 1 hypervisor.

6. Connection types: bridged, NAT, and host-only

In the VM’s settings, select the Network Adapter to see the connection choices. Focus on three:

Connection	Virtual network	IP address	Reachable from outside the host?	Can reach outside?
Bridged	VMnet0	Its own address on the physical LAN	Yes	Yes
NAT	VMnet8	Private address, translated to the host’s address	No (unless ports are forwarded)	Yes
Host-only	VMnet1	Private address on an isolated network	No	No (only the host and other host-only VMs)

Also in the list, but outside this lesson’s scope:

LAN Segment: a private network shared only among selected VMs, with no host connection.
Custom: attaches the adapter to a specific VMnet. Avoid reusing VMnets that are preconfigured for bridged, NAT, or host-only duty.

The Virtual Network Editor

VMware Workstation Player’s interface hides some networking features. The Virtual Network Editor (vmnetcfg.exe) was removed from Player after release 12 but remains in Workstation Pro. Because Player has since been replaced by Workstation Pro, now free for personal and educational use, students can open it from Edit > Virtual Network Editor (select Change Settings to get administrator rights). It shows all three networks, including VMnet0, which does not appear in Device Manager because bridging is a protocol binding on the physical adapter rather than a separate host adapter.

Bridged (VMnet0)

A bridged VM appears on the physical network as its own computer with its own IP address, visible to other systems on the LAN. VMnet0 acts as a switch: outbound traffic goes to the associated physical NIC; inbound traffic is directed to the correct VM. By default it uses automatic bridging, binding to whichever adapter has a live connection. You can pin it to a specific wired or wireless adapter instead.

Use it when other machines must reach the VM directly, such as a lab server that classmates connect to. Caution: a bridged VM is exposed to the network like any other computer, and some campus or workplace networks restrict extra devices.

Host-only (VMnet1)

An internal-only network. VMs can talk to each other and to the host, but the physical network has no awareness of them. Settings include the Subnet IP for the isolated network and Use local DHCP service so the host hands out addresses automatically (the DHCP Settings button shows the address range and lease times).

Use it for isolated labs, such as testing malware-analysis tools or practicing server roles without touching the real network.

NAT (VMnet8)

A blend of host-only and bridged. Each VM has a private address that other VMs on the NAT network recognize, but the outside world sees only the host’s IP address. When a VM sends traffic out, the hypervisor records the translation in a table; when the reply arrives, it translates it back and delivers it to the correct VM. Like host-only, the subnet and DHCP service are configurable.

NAT is VMware Workstation’s default for new VMs because:

It protects a fresh OS from the network until security updates and antivirus are in place.
It hides the number and role of the VMs behind one address.

Check for understanding: A classmate needs to browse to a web server running in your VM from their laptop. Which connection type do you choose, and why? (Bridged, because NAT and host-only VMs are not reachable from outside the host.)

7. Tuning virtual networks

Physical best practices still apply. Switches that isolate traffic for performance and security on physical networks do the same job virtually, and a virtual network can be just as sophisticated. A bonus: far less cabling.

Plan for aggregate throughput. Consolidating ten servers onto one host means that host must carry all ten servers’ traffic. Early virtualization hosts often had eight or more NICs, both for bandwidth and to keep traffic types physically separate.

“Don’t cross the streams.” The book borrows the Ghostbusters line to describe the old rule against mixing traffic types on one NIC. Today, high-bandwidth converged network adapters (CNAs) and 10/25/100 GbE NICs carry several traffic types and sometimes several protocols, so fewer cards are needed. Contention still exists, so bandwidth must be controlled:

Network I/O control flags traffic types (VM data, storage, migration, management) and assigns priorities or shares when contention occurs, down to a single VM, a group of VMs, or a set of addresses. The book says VMware ESXi is the only hypervisor offering this; that describes the release it covers. Hyper-V now provides minimum and maximum bandwidth settings on its virtual switch, and some CNAs offer similar controls in hardware.

Visibility for the network team. Because in-host traffic is invisible to physical tools, network teams historically handed virtual networking to the virtualization team. Vendors responded with third-party virtual switches that run the same operating system and tools as physical switches (the book’s example is the Cisco Nexus 1000V, since retired for vSphere), plus virtualization-aware monitoring.

Distributed switches. Standard vSwitches are configured host by host, which becomes slow and error-prone across hundreds of hosts. Every switch performs two kinds of work:

Data plane: actually forwards the traffic.
Management (control) plane: defines how the data plane should behave.

A virtual distributed switch keeps the data plane on each host but centralizes management, so one change propagates to every host. Examples: VMware vSphere Distributed Switch, Hyper-V virtual switch managed centrally, and Open vSwitch (common with KVM and Xen).

Software-defined networking (SDN). Just as hypervisors abstracted servers from hardware, SDN moves switching, routing, firewalls, load balancing, and VPNs into software, often as virtual appliances (prebuilt VMs with a single job; see Lesson 14). SDN is a building block of the software-defined data center, where compute, storage, and network are all defined in software and deployed repeatedly on generic hardware. It is also how public clouds deliver virtual networks on demand.

Classroom application

Lab: explore connection types.

Run ipconfig in the Windows VM and record the IPv4 address, subnet mask, and default gateway on the default NAT connection.
Compare the virtual adapter’s driver in the guest’s Device Manager with the VMware adapters in the host’s Device Manager.
Switch the adapter to Host-only, renew the address (ipconfig /renew), and note what changes. Try browsing the internet and explain the result.
Switch to Bridged, renew, and compare the new address with the host’s own address.

Extension (from the book): add a second network adapter using Bridged, reboot, and run ipconfig. There should be two Ethernet adapters, each with its own IP address. Ping both addresses from the host. If both are bridged on the host’s subnet, both should reply. (Windows Firewall may block ping by default; students may need to allow ICMP echo on the guest.)

Design discussion: Sketch a host with a public web server, an application server, and a database server. Which VMs need external switches, which should be internal-only, and where should storage traffic go?

Checks for understanding:

What does the guest OS see when it looks at its network adapter?
Why is VM-to-VM traffic on the same host fast, and why is it hard to monitor?
In the Xen/Hyper-V model, where does the virtual switch live?
Why does live migration deserve a dedicated network path?
Which VMware network is used by bridged, NAT, and host-only connections?
Why is NAT the default for a new VM?

Common misconceptions

“A VM needs its own physical NIC.” Many VMs share physical NICs through virtual switches.
“Internal networks can be seen by network monitoring tools.” Traffic on an internal vSwitch never reaches the physical network.
“NAT VMs can’t use the internet.” They can reach out; outside systems just can’t initiate connections to them.
“Host-only means the VM is completely isolated.” It can still reach the host and other VMs on the same host-only network.
“Consolidation reduces network load.” The host must carry the combined traffic of every VM, plus storage and migration traffic.
“Mixing traffic types is always bad.” Modern adapters and I/O controls make it workable when bandwidth is planned and prioritized.

Lesson summary

Networking is a VM’s only link to the outside world. The guest sends traffic through a virtual NIC to a virtual switch, managed by the hypervisor (VMware) or by the parent partition (Xen/Hyper-V), and out a shared physical NIC. Internal switches keep traffic in memory for speed and isolation; external switches connect to the physical network; dedicated switches can carry storage and migration traffic. In VMware Workstation, bridged (VMnet0), NAT (VMnet8), and host-only (VMnet1) connections determine who can reach the VM. Because consolidation concentrates traffic, bandwidth planning, segmentation, and network I/O control are essential, and distributed switches and software-defined networking are moving network management into software just as hypervisors did for servers.