With external switch tagging, it will be the physical switch that the ESXi host is connected to that does the tagging or untagging of the Ethernet frames. The physical switch ports, in this case, are access ports. Therefore, there is no need to configure VLANs on the port groups of the virtual switch. Frames enter and leave the virtual switch untagged.

One of the major drawbacks of this type of implementation is that the entire virtual switch (all of the port groups on it) will only handle traffic from a single layer-2 subnet. This is because an access port on a physical switch cannot be configured to carry traffic from more than one VLAN. The following diagram illustrates the Frame Flow in EST Mode.