diff --git a/cmd/vic-machine/common/target.go b/cmd/vic-machine/common/target.go
index e96e5e5fe5..0fe4157e58 100644
--- a/cmd/vic-machine/common/target.go
+++ b/cmd/vic-machine/common/target.go
@@ -33,6 +33,8 @@ type Target struct {
 	Password    *string
 	CloneTicket string
 	Thumbprint  string `cmd:"thumbprint"`
+
+	MaxConcurrentConnections *int `cmd:"max-concurrent-connections"`
 }
 
 func NewTarget() *Target {
@@ -67,11 +69,30 @@ func (t *Target) TargetFlags() []cli.Flag {
 			Usage:       "ESX or vCenter host certificate thumbprint",
 			EnvVar:      "VIC_MACHINE_THUMBPRINT",
 		},
+		cli.GenericFlag{
+			Name:   "max-concurrent-connections, mcc",
+			Value:  flags.NewOptionalInt(&t.MaxConcurrentConnections),
+			Usage:  "Determines maximum number of connections (not sessions) to vCenter. Integer value, greater than 0",
+			EnvVar: "VIC_MACHINE_MAX_CONCURRENT_CONNECTIONS",
+			Hidden: true,
+		},
+		/*
+			cli.IntFlag{
+				Name:        "max-concurrent-connections, mcc",
+				Value:       constants.DefaultMaxConcurrentRequests,
+				Destination: &t.MaxConcurrentConnections,
+				Usage:       "Determines maximum number of connections (not sessions) to vCenter. Integer value, greater than 0",
+				EnvVar:      "VIC_MACHINE_MAX_CONCURRENT_CONNECTIONS",
+				Hidden:      true,
+			},
+		*/
 	}
 }
 
 // HasCredentials check that the credentials have been supplied by any of the permitted mechanisms
 func (t *Target) HasCredentials(op trace.Operation) error {
+	defer trace.End(trace.Begin("", op))
+
 	if t.URL == nil {
 		return cli.NewExitError("--target argument must be specified", 1)
 	}
diff --git a/cmd/vic-machine/configure/configure.go b/cmd/vic-machine/configure/configure.go
index 23f55ada2c..18b73bc07a 100644
--- a/cmd/vic-machine/configure/configure.go
+++ b/cmd/vic-machine/configure/configure.go
@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -214,6 +215,11 @@ func (c *Configure) copyChangedConf(o *config.VirtualContainerHostConfigSpec, n
 		updateSessionEnv(portlayerSession, config.PortLayerDCPath, v.Session().Datacenter.Name())
 	}
 
+	// if mcc is explicitly set, apply it
+	if c.Data.MaxConcurrentConnections != nil {
+		updateSessionEnv(portlayerSession, config.PortLayerMaxConcurrentConnections, strconv.Itoa(*c.Data.MaxConcurrentConnections))
+	}
+
 	if c.Debug.Debug != nil {
 		o.SetDebug(n.Diagnostics.DebugLevel)
 	}
diff --git a/cmd/vic-machine/create/create.go b/cmd/vic-machine/create/create.go
index 03915f4968..df9e986fa7 100644
--- a/cmd/vic-machine/create/create.go
+++ b/cmd/vic-machine/create/create.go
@@ -719,6 +719,8 @@ func (c *Create) Run(clic *cli.Context) (err error) {
 
 	vConfig.Timeout = c.Data.Timeout
 
+	vConfig.MaxConcurrentConnections = c.MaxConcurrentConnections
+
 	// separate initial validation from dispatch of creation task
 	op.Info("")
 
diff --git a/lib/config/executor/container_vm.go b/lib/config/executor/container_vm.go
index b616e08e66..b9ed6ec6c5 100644
--- a/lib/config/executor/container_vm.go
+++ b/lib/config/executor/container_vm.go
@@ -119,7 +119,8 @@ type ExitLog struct {
 // MountSpec details a mount that must be executed within the executor
 // A mount is a URI -> path mapping with a credential of some kind
 // In the case of a labeled disk:
-// 	label://<label name> => </mnt/path>
+//
+//	label://<label name> => </mnt/path>
 type MountSpec struct {
 	// A URI->path mapping, e.g.
 	// May contain credentials
@@ -283,6 +284,40 @@ type SessionConfig struct {
 	Detail `vic:"0.1" scope:"read-write" key:"detail"`
 }
 
+// GetEnv returns
+// * the value of the specified environment variable if present
+// * nil if not present
+func (sc *SessionConfig) GetEnv(name string) *string {
+	if sc == nil {
+		return nil
+	}
+
+	for _, env := range sc.Cmd.Env {
+		if strings.HasPrefix(env, name+"=") {
+			val := strings.TrimPrefix(env, name+"=")
+			return &val
+		}
+	}
+
+	return nil
+}
+
+// SetEnv sets the value of the specified environment variable, returning:
+// * the old value if present
+// * nil if not present
+func (sc *SessionConfig) SetEnv(name, value string) *string {
+	for i, env := range sc.Cmd.Env {
+		if strings.HasPrefix(env, name+"=") {
+			sc.Cmd.Env[i] = name + "=" + value
+			val := strings.TrimPrefix(env, name+"=")
+			return &val
+		}
+	}
+
+	sc.Cmd.Env = append(sc.Cmd.Env, name+"="+value)
+	return nil
+}
+
 type Detail struct {
 
 	// creation, started & stopped timestamps
diff --git a/lib/config/executor/container_vm_test.go b/lib/config/executor/container_vm_test.go
new file mode 100644
index 0000000000..1927eec68e
--- /dev/null
+++ b/lib/config/executor/container_vm_test.go
@@ -0,0 +1,113 @@
+// Copyright 2016-2018 VMware, Inc. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package executor
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetEnv(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	assert.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	assert.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+	assert.Nil(t, sess.GetEnv("nope"), "Get on an unset variable should return nil")
+}
+
+func TestSetEnvUpdateValue(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	require.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	require.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+
+	newVal := "sapients"
+	old := *sess.SetEnv("hello", newVal)
+
+	assert.Equal(t, "world", old, "Expected old value to be return on update")
+	assert.Equal(t, newVal, *sess.GetEnv("hello"), "Expected new value to be updated value")
+
+	assert.Equal(t, "", *sess.GetEnv("goodbye"), "Expected unmodified value not to have changed")
+}
+
+func TestSetEnvEmptyValue(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	require.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	require.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+
+	newVal := "sapients"
+	old := *sess.SetEnv("goodbye", newVal)
+
+	assert.Equal(t, "", old, "Expected old value to be return on update")
+	assert.Equal(t, newVal, *sess.GetEnv("goodbye"), "Expected new value to be updated value")
+
+	assert.Equal(t, "world", *sess.GetEnv("hello"), "Expected unmodified value not to have changed")
+}
+
+func TestSetEnvNewEnv(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	require.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	require.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+
+	newKey := "solo"
+	require.Nil(t, sess.GetEnv(newKey), "Expected nil return for unset value")
+
+	// checking we can set a new env with value of empty string
+	newVal := ""
+	_ = sess.SetEnv(newKey, newVal)
+	assert.Equal(t, newVal, *sess.GetEnv(newKey), "Expected new value to be updated value")
+
+	// checking we can set a new env with value specified
+	newKey = "absence"
+	newVal = "fonder"
+
+	_ = sess.SetEnv(newKey, newVal)
+	assert.Equal(t, newVal, *sess.GetEnv(newKey), "Expected new value to be updated value")
+
+	assert.Equal(t, "world", *sess.GetEnv("hello"), "Expected unmodified value not to have changed")
+	assert.Equal(t, "", *sess.GetEnv("goodbye"), "Expected unmodified value not to have changed")
+}
diff --git a/lib/config/virtual_container_host.go b/lib/config/virtual_container_host.go
index 3933ba5446..5eec348441 100644
--- a/lib/config/virtual_container_host.go
+++ b/lib/config/virtual_container_host.go
@@ -54,18 +54,19 @@ const (
 	PortLayerService = "port-layer"
 	VicAdminService  = "vicadmin"
 
-	GeneralHTTPProxy   = "HTTP_PROXY"
-	GeneralHTTPSProxy  = "HTTPS_PROXY"
-	GeneralNoProxy     = "NO_PROXY"
-	VICAdminHTTPProxy  = "VICADMIN_HTTP_PROXY"
-	VICAdminHTTPSProxy = "VICADMIN_HTTPS_PROXY"
-	VICAdminNoProxy    = "NO_PROXY"
-	VICAdminCSPath     = "--cluster"
-	VICAdminPoolPath   = "--pool"
-	VICAdminDCPath     = "--dc"
-	PortLayerCSPath    = "CS_PATH"
-	PortLayerPoolPath  = "POOL_PATH"
-	PortLayerDCPath    = "DC_PATH"
+	GeneralHTTPProxy                  = "HTTP_PROXY"
+	GeneralHTTPSProxy                 = "HTTPS_PROXY"
+	GeneralNoProxy                    = "NO_PROXY"
+	VICAdminHTTPProxy                 = "VICADMIN_HTTP_PROXY"
+	VICAdminHTTPSProxy                = "VICADMIN_HTTPS_PROXY"
+	VICAdminNoProxy                   = "NO_PROXY"
+	VICAdminCSPath                    = "--cluster"
+	VICAdminPoolPath                  = "--pool"
+	VICAdminDCPath                    = "--dc"
+	PortLayerCSPath                   = "CS_PATH"
+	PortLayerPoolPath                 = "POOL_PATH"
+	PortLayerDCPath                   = "DC_PATH"
+	PortLayerMaxConcurrentConnections = "VIC_MAX_IN_FLIGHT"
 
 	AddPerms = "ADD"
 )
diff --git a/lib/constants/constants.go b/lib/constants/constants.go
index b050342f85..d95dc4fb17 100644
--- a/lib/constants/constants.go
+++ b/lib/constants/constants.go
@@ -84,6 +84,15 @@ const (
 	TaskCreatedState = "created"
 	TaskFailedState  = "failed"
 	TaskUnknownState = "unknown"
+
+	// DefaultMaxConcurrentRequests limits the maximum number of SOAP operations in flight
+	// This has the effect of modifying the MaxIdleConnsPerHost field of the soap transport
+	DefaultMaxConcurrentRequests = 32
+	// MaximumMaxConcurrentRequests limits the upper bound that can be specified for concurrent connections
+	MaximumMaxConcurrentRequests = 255
+	// MinMaxConcurrentRequests is necessary because testing shows the port layer doesn't fully initialize if
+	// lower than this
+	MinMaxConcurrentRequests = 2
 )
 
 func DefaultAltVCHGuestName() string {
diff --git a/lib/install/data/data.go b/lib/install/data/data.go
index 57670a8062..d3ecaa18cb 100644
--- a/lib/install/data/data.go
+++ b/lib/install/data/data.go
@@ -127,6 +127,8 @@ type InstallerData struct {
 	ResourcePoolPath       string
 	ApplianceInventoryPath string
 
+	MaxConcurrentConnections *int
+
 	Datacenter types.ManagedObjectReference
 	Cluster    types.ManagedObjectReference
 
@@ -377,5 +379,7 @@ func (d *Data) CopyNonEmpty(src *Data) error {
 
 	d.ContainerConfig.ContainerNameConvention = src.ContainerConfig.ContainerNameConvention
 
+	d.MaxConcurrentConnections = src.MaxConcurrentConnections
+
 	return nil
 }
diff --git a/lib/install/management/appliance.go b/lib/install/management/appliance.go
index bec409b888..57230881bf 100644
--- a/lib/install/management/appliance.go
+++ b/lib/install/management/appliance.go
@@ -693,6 +693,11 @@ func (d *Dispatcher) createAppliance(conf *config.VirtualContainerHostConfigSpec
 		Active:  true,
 	}
 
+	if settings.MaxConcurrentConnections != nil {
+		d.op.Debugf("Setting max concurrent connections in portlayer environment to %d", *settings.MaxConcurrentConnections)
+		cfg.Cmd.Env = append(cfg.Cmd.Env, fmt.Sprintf("%s=%s", config.PortLayerMaxConcurrentConnections, strconv.Itoa(*settings.MaxConcurrentConnections)))
+	}
+
 	conf.AddComponent(config.PortLayerService, cfg)
 
 	// fix up those parts of the config that depend on the final applianceVM folder name
diff --git a/lib/install/validate/config_to_data.go b/lib/install/validate/config_to_data.go
index 814faa6468..35fa6e38f2 100644
--- a/lib/install/validate/config_to_data.go
+++ b/lib/install/validate/config_to_data.go
@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"net/url"
 	"path"
+	"strconv"
 	"strings"
 
 	"github.com/docker/go-units"
@@ -162,6 +163,16 @@ func NewDataFromConfig(ctx context.Context, finder Finder, conf *config.VirtualC
 	d.OpsCredentials.OpsPassword = &conf.Connection.Token
 	d.Thumbprint = conf.Connection.TargetThumbprint
 
+	maxConcurrent := conf.ExecutorConfig.Sessions[config.PortLayerService].GetEnv(config.PortLayerMaxConcurrentConnections)
+	if maxConcurrent != nil {
+		var max int
+		max, err = strconv.Atoi(*maxConcurrent)
+		if err != nil {
+			return
+		}
+		d.MaxConcurrentConnections = &max
+	}
+
 	d.AsymmetricRouting = conf.AsymmetricRouting
 
 	if err = setBridgeNetwork(op, finder, d, conf); err != nil {
diff --git a/lib/install/validate/validator.go b/lib/install/validate/validator.go
index 7d56006fb3..ec8babdb93 100644
--- a/lib/install/validate/validator.go
+++ b/lib/install/validate/validator.go
@@ -490,22 +490,25 @@ func (v *Validator) sessionValid(op trace.Operation, errMsg string) bool {
 		v.NoteIssue(errors.New(errMsg))
 		return false
 	}
+
 	return true
 }
 
 func (v *Validator) target(op trace.Operation, input *data.Data, conf *config.VirtualContainerHostConfigSpec) {
 	defer trace.End(trace.Begin("", op))
 
-	// check if host is managed by VC
 	v.managedbyVC(op)
+	v.connectionManagement(op, input, conf)
 }
 
+// managedbyVC checks if host is managed by VC and is blocked from direct interaction
 func (v *Validator) managedbyVC(op trace.Operation) {
 	defer trace.End(trace.Begin("", op))
 
 	if v.isVC() {
 		return
 	}
+
 	host, err := v.session.Finder.DefaultHostSystem(op)
 	if err != nil {
 		v.NoteIssue(fmt.Errorf("Failed to get host system: %s", err))
@@ -522,6 +525,26 @@ func (v *Validator) managedbyVC(op trace.Operation) {
 	if ip := mh.Summary.ManagementServerIp; ip != "" {
 		v.NoteIssue(fmt.Errorf("Target is managed by vCenter server %q, please change --target to vCenter server address or select a standalone ESXi", ip))
 	}
+
+	return
+}
+
+func (v *Validator) connectionManagement(op trace.Operation, input *data.Data, conf *config.VirtualContainerHostConfigSpec) {
+	defer trace.End(trace.Begin("", op))
+
+	if input.MaxConcurrentConnections == nil {
+		return
+	}
+
+	// unsure if we need to set a maximum bound as well. Adding something sane, but above the
+	// default that's been in force since 2017
+	if *input.MaxConcurrentConnections < constants.MinMaxConcurrentRequests || *input.MaxConcurrentConnections > constants.MaximumMaxConcurrentRequests {
+		op.Debugf("Validating max connection failed")
+
+		v.NoteIssue(fmt.Errorf("Maximum concurrent connections must be between %d - %d inclusive", constants.MinMaxConcurrentRequests, constants.MaximumMaxConcurrentRequests))
+		return
+	}
+
 	return
 }
 
diff --git a/pkg/vsphere/session/session.go b/pkg/vsphere/session/session.go
index 9f3107f759..e4cfe2f4a4 100644
--- a/pkg/vsphere/session/session.go
+++ b/pkg/vsphere/session/session.go
@@ -21,7 +21,6 @@
 // each corresponding value in Config. The Session is returned and
 // the user can use the cached govmomi objects in the exported fields of
 // Session instead of directly using a govmomi Client.
-//
 package session
 
 import (
@@ -45,13 +44,13 @@ import (
 	"github.com/vmware/govmomi/vim25/soap"
 	"github.com/vmware/govmomi/vim25/types"
 	"github.com/vmware/vic/lib/config"
+	"github.com/vmware/vic/lib/constants"
 	"github.com/vmware/vic/pkg/errors"
 	"github.com/vmware/vic/pkg/trace"
 	"github.com/vmware/vic/pkg/vsphere/extraconfig"
 )
 
 const (
-	defaultMaxInFlight  = 32
 	tlsHandshakeTimeout = 30 * time.Second
 )
 
@@ -69,6 +68,7 @@ type Config struct {
 	Thumbprint string
 	// Keep alive duration
 	Keepalive time.Duration
+	// Maximum
 	// User-Agent to identify login sessions (see: govc session.ls)
 	UserAgent string
 
@@ -232,9 +232,9 @@ func (s *Session) Connect(ctx context.Context) (*Session, error) {
 
 	soapClient.SetThumbprint(soapURL.Host, s.Thumbprint)
 
-	maxInFlight := defaultMaxInFlight
+	maxInFlight := constants.DefaultMaxConcurrentRequests
 	if e := os.Getenv("VIC_MAX_IN_FLIGHT"); e != "" {
-		if i, err := strconv.Atoi(e); err == nil {
+		if i, err := strconv.Atoi(e); err == nil && i > 0 {
 			maxInFlight = i
 		}
 	}