19.1 Virtual Switches

The Idea of a Virtual Switch

In a virtualized environment, multiple virtual machines share the same physical host. Each virtual machine usually needs network connectivity, both to other virtual machines and to external networks. A virtual switch is the software component that provides this connectivity.

A virtual switch behaves like a basic Ethernet switch, but it exists entirely in software inside a hypervisor or operating system. It forwards Ethernet frames between virtual network interfaces that belong to virtual machines, and between those virtual interfaces and physical network interfaces on the host. To the virtual machines, the virtual switch looks like a normal layer 2 switch. To the outside network, the host and its virtual switch can look like one or many devices, depending on how the virtual networking is configured.

Key Components Around a Virtual Switch

A virtual switch connects several types of interfaces. Understanding these connections helps you visualize what the virtual switch actually does.

Inside a virtualized host you typically find:

Virtual network interface cards. Each virtual machine has one or more virtual NICs. These appear inside the guest operating system just like a physical NIC. Each virtual NIC plugs into a port on the virtual switch.

Uplink or physical NICs. These are the real network interface cards on the host. The virtual switch uses one or more of these as uplinks to reach the external network. Traffic from virtual machines that must leave the host goes out through these uplinks.

Virtual switch ports. Each attachment to the virtual switch uses a logical switch port. A virtual NIC of a virtual machine consumes a port. A physical NIC uplink consumes a port. Depending on the platform, other services such as virtual routers, firewalls, or load balancers may also connect to ports on the same virtual switch.

From a logical point of view, the virtual switch has a port for each virtual NIC and a port for each uplink, just like a physical switch has ports for each cable.

How a Virtual Switch Forwards Traffic

When a virtual machine sends a frame, the frame leaves its virtual NIC and enters the virtual switch. The virtual switch then decides where to forward the frame.

In a simple case, if the frame is destined for another virtual machine on the same host, the virtual switch delivers the frame directly to the destination virtual NIC. This is an internal forwarding decision, and the frame never leaves the physical server. If the frame belongs on an external network, the virtual switch sends it through one of its uplink ports, which then uses the host's physical NIC to put the frame on the wire.

Just like a physical Ethernet switch, a virtual switch usually maintains a table that links MAC addresses to ports. When a frame with a given source MAC address arrives on a port, the switch learns that this MAC address is reachable via that port. When a frame is sent to a known destination MAC address, the virtual switch forwards it only to the specific port associated with that MAC address. If the destination MAC is not known, the virtual switch floods the frame to all ports in the same broadcast domain, except the port on which the frame arrived.

Virtual switches also handle broadcast and multicast frames. Broadcasts, such as ARP requests, get sent to all ports in the same logical network or VLAN on that virtual switch. This behavior mirrors traditional Ethernet and allows virtual machines to participate in the same type of local network protocols.

Internal vs External Connectivity

A virtual switch can provide connectivity purely inside a host, or it can bridge traffic out to physical networks. These two roles have different effects on how networks are designed.

Internal-only connectivity occurs when the virtual switch has no uplink to any physical NIC. In this case, all connected virtual machines can communicate only with each other and with other virtual elements on the same host. The outside world cannot see this traffic. This design is useful for isolated test environments, back-end application tiers, or security zones that must not be reachable directly from the physical network.

Bridged or external connectivity occurs when the virtual switch uses one or more physical NICs as uplinks. In this configuration, the virtual switch extends the physical network into the host. Virtual machines can gain IP addresses in the same subnet as devices on the physical network. Frames destined for nonlocal devices exit through the uplinks and get forwarded by physical infrastructure.

Some platforms also allow a virtual switch to connect to logical network services such as virtual routers or software gateways. In those cases, the virtual switch can be part of a larger overlay network, but the detailed behavior of overlays belongs in a later chapter.

Basic Virtual Switch Types Across Platforms

Different virtualization platforms implement virtual switches in slightly different ways, but the underlying concepts are similar. It is useful to compare hosts that offer basic software switches with more advanced virtual switching solutions.

In a desktop type hypervisor, such as those used on personal computers, the virtual switch is often a simple component that offers basic modes. It can connect virtual machines to the host network adapter, which is typical for a bridged mode. It can provide NAT mode, where virtual machine traffic is translated behind the host's IP address. It can also offer a host-only mode, where virtual machines communicate only with each other and with the host.

In server virtualization platforms, such as those used in data centers, the virtual switch is richer. It can support multiple VLANs, port groups, and integration with storage or management networks. It can offer features like port mirroring for analysis, basic security settings for each port, and in some cases support for advanced switching functions that resemble those of enterprise physical switches.

Some platforms use a standard virtual switch built into the hypervisor and also offer a distributed or central virtual switch that spans multiple hosts. In a distributed virtual switch, ports for a given logical network can exist on several physical hypervisors, but the configuration is managed from a central controller. Details about distributed or overlay concepts are specific to later chapters, so here you only need to remember that virtual switches can be either local to a host or logically extended across many hosts.

Interaction with VLANs and Segmentation

Although full coverage of VLANs appears elsewhere, it is important to notice how virtual switches use them. A single virtual switch can carry traffic for multiple logical networks separated by VLAN identifiers. Each virtual NIC can be assigned to a particular VLAN through a port group or similar configuration concept. That assignment tells the virtual switch how to tag or interpret frames coming from that virtual machine.

Frames that belong to different VLANs remain separate from each other even though they share the same virtual switch and possibly the same physical uplinks. In practical terms, this allows the administrator to use a single virtual switch and a small number of physical NICs to carry many isolated networks for different application tiers, departments, or tenants.

If the physical network is also configured with VLANs, then the virtual switch typically sends and receives tagged frames on its uplink ports. The tags ensure that the separation defined inside the host matches the separation on the external switches. This alignment creates a consistent segmentation model that covers both physical and virtual infrastructure.

Security and Policy on Virtual Switches

A virtual switch is a central point where policies can be enforced between virtual machines and between virtual machines and the outside network. While advanced security topics are covered in separate chapters, you should understand that basic access control often begins directly on the virtual switch.

Common controls include simple filtering of frames, such as blocking spoofed MAC addresses, or rejecting frames that claim to belong to VLANs that are not allowed on a given port. Some virtual switches support security groups or port-level policies that resemble ACLs. These can restrict which virtual machines can talk to each other, even if they share the same VLAN or subnet.

Because forwarding is in software, the virtual switch can also integrate with specialized security functions like virtual firewalls or intrusion prevention systems. In such designs, all traffic leaving a given port group might be forced through a virtual security appliance, so that inspection and policy enforcement occur within the hypervisor itself. These integrations rely on the flexible, programmable nature of the virtual switch to steer traffic through the right paths without physically rewiring anything.

Performance and Resource Considerations

A virtual switch uses CPU and memory resources of the host to forward traffic. Unlike a physical switch that uses dedicated hardware for packet switching, a virtual switch shares compute resources with the virtual machines it serves. For most workloads this is not a problem, but in busy environments the load from virtual switching becomes one of the performance considerations in overall host design.

Traffic between two virtual machines on the same host often has better latency and higher throughput than traffic that must leave the host. This is because the frames never traverse the physical network and stay internal to the server. The virtual switch can pass frames directly between virtual NICs, which avoids external bottlenecks. When traffic leaves the host through physical uplinks, it must contend with the bandwidth of those physical interfaces as well as congestion on the external network.

Network teams may also use multiple physical NICs as uplinks to a virtual switch to improve throughput and resilience. The virtual switch can distribute outgoing traffic across these uplinks according to various rules and can handle failover if one of the physical NICs fails. The details of link aggregation and redundancy strategies involve broader network design topics that appear later, but you should recognize that the virtual switch is where these uplinks are logically bound together for virtual machines.

Comparing Virtual and Physical Switches

A virtual switch and a physical switch aim to solve the same basic problem. Both need to transport Ethernet frames between endpoints while keeping different networks and broadcasts properly separated. They both learn MAC addresses and forward frames based on that learning. They both can implement VLAN-based segmentation.

The key difference is where and how they operate. A physical switch connects separate devices through cables. A virtual switch connects virtual interfaces that may reside on the same physical machine. It does not require physical cabling between the endpoints, only software configuration. It can be instantiated, modified, or deleted without touching any hardware.

Because of this software nature, virtual switches are more tightly integrated with the hypervisor and sometimes with orchestration tools. When a new virtual machine is created, a virtual NIC can be automatically attached to the correct port group or network on the virtual switch. When a virtual machine is migrated to another host, the orchestration system can automatically connect its virtual NIC to the appropriate virtual switch on the destination host with consistent configuration.

Despite these differences, the troubleshooting mindset remains similar. Issues such as incorrect VLAN assignment, wrong port group, or misconfigured uplink can cause connectivity problems just like wrong port or VLAN settings on a physical switch would. Understanding how virtual switches parallel physical switches helps when diagnosing network issues in a virtualized environment.

Role of Virtual Switches in Modern Architectures

Virtual switches are an essential building block for modern data centers and cloud networks. They provide the basic layer 2 fabric that supports higher level constructs, including overlays and software defined networking. When you learn about SDN and overlay networks later, you will see that many of those technologies depend on having a flexible and programmable switching layer inside each host.

At a basic level, every hypervisor that hosts virtual machines relies on at least one virtual switch to provide connectivity. As environments grow and become more complex, administrators can design multiple virtual switches, separate them by function, or integrate them into larger distributed switches that span the environment. Regardless of scale, the central idea remains the same. A virtual switch is the software switching point where virtual machines, physical networks, and network policies meet.

By grasping how virtual switches connect virtual interfaces and how they relate to physical infrastructure, you form the foundation for understanding more advanced virtual networking concepts that follow in later chapters.