“Running hypervisors inside hypervisors requires passing hardware CPU flags (VT-x/EPT) through to the guest VM and enabling MAC Address Changes on physical vDS portgroups.”

During IBM Cloud SDDC lab architecture at IBM, nested ESXi guest VMs failed to power on 64-bit nested workload VMs, returning the error: Virtualized Intel VT-x/EPT is not supported on this platform.

Root Cause: Nested CPU Passthrough & Promiscuous vDS Settings

To run nested ESXi hosts, two critical configuration parameters must be explicitly enabled at the parent physical ESXi layer:

1. Hardware CPU Virtualization: vhv.enable = "TRUE" exposed in the nested VM’s .vmx configuration file.
2. Promiscuous Mode Security Policy: Enabling Promiscuous Mode and Forged Transmits on the parent vDS portgroup so nested VMs can negotiate MAC addresses across the physical NIC.

[!TIP] Use Ansible or PowerCLI scripts to set nestedHVEnabled: true automatically during VM creation.

# # Ansible PowerCLI Task: Enabling Hardware HV Passthrough
- name: "Enable Hardware Virtualization (VT-x) on Nested ESXi VM"
  community.vmware.vmware_guest:
    hostname: "{{ physical_esxi }}"
    username: "{{ user }}"
    password: "{{ pass }}"
    name: "Pod1-ESXi-Node01"
    hardware:
      nested_virt: true
    customvalues:
      - key: "vhv.enable"
        value: "TRUE"

The Verdict

Key Takeaway

Enable Hardware Virtualization Passthrough on All Nested Hypervisor Footprints.

Always set nestedHVEnabled and enable Promiscuous Mode on parent vDS switches before attempting to run nested ESXi hypervisors.