vDS ports go into blocked state for security violations even when the security policy is enabled

Products

• VMware vSphere ESXi

Issue/Introduction

• A VM is experiencing network connectivity loss when attached to a distributed portgroup that has "MAC address changes", "Promiscuous mode" or "Forged transmits" set to "Accept".
• The VM, or an application on the VM, is intentionally operating in a way that would require one or more of the security policies to be enabled, such as a MAC address requesting to be changed from within the guest OS for CARP/VIP failover.
• The logs show the VM's port is blocked due to a L2 security violation - despite the configuration in the vCenter UI showing the policy for such changes is set to "Accept."

• Example logs in the vmkernel.log file:
  
  cpu#:cccc)etherswitch: L2Sec_EnforcePortCompliance: client <vmname> requested mac address change to <mac> on port 0x# #######, disallowed by vswitch policy
  cpu#:cccc)etherswitch: L2Sec_EnforcePortCompliance: client <vmname> has policy violations on port 0x#######. Port is blocked

• "net-dvs -l " command output shows the effective parameters: deny mac change and Allow Mac Change = False

    com.vmware.vswitch.port.security = deny promiscuous; deny mac change; deny forged frames
            propType = POLICY
    com.vmware.vswitch.port.macManagement:
            Allow MAC Change = False
            MAC Learning = False
            Unknown Unicast Flooding = False
            MAC Limit = 4096
            MAC Limit Policy = ALLOW
            propType = CONFIG

Environment

VMware ESXi 8.0

Cause

• This situation was introduced in vCenter 8.0 with the feature "MAC Learning configuration."
• Although the setting appears to have applied successfully in the vSphere UI, the setting is not propagated properly to the host itself so the setting is effectively set to "Deny". Therefore when a guest OS or application in a VM acts in a way related to the policy, such as requesting a MAC address change, it is detected as a violation and the VM's port is consequently blocked.

Resolution

This is resolved in ESXi 8.0 Update 2b - Build 23305546 Release Notes

Workaround: Use a virtual standard switch (vSS).

Additional Information

Impact/Risks: It only impacts distributed portgroups created or modified after the upgrade to (or on a fresh install of) vCenter 8.0 prior to 8.0 Update 2b - Build 23305546, when MAC Learning is set to Disabled.
Configuring promiscuous mode on a virtual switch or on specific port group