Change to the default security policy for Distributed Switch distributed port groups
search cancel

Change to the default security policy for Distributed Switch distributed port groups

book

Article ID: 337913

calendar_today

Updated On:

Products

VMware vSphere ESXi

Issue/Introduction

To prevent an untrusted virtual machine from changing its MAC address or sending packets on behalf of other virtual machines, the default settings for the security policy have changed for distributed virtual switch port groups in distributed virtual switches created by using versions later than vSphere 5.0.

With the new settings, if the MAC address changes, the virtual machine driver is not notified of the new MAC address. This policy change can cause virtual applications and virtual machines that rely on the MAC address (or on a forged transmit) to fail if the MAC address is changed for a virtual machine NIC.


Environment

VMware vSphere ESXi 5.0
VMware vSphere ESXi 5.1

Resolution

If this new default policy has caused ports to be blocked, edit the distributed virtual switch security policy manually for that distributed virtual port group, allowing MAC address change and forged transmit. Use the following table to see the changes in default settings.

Default Setting
vSphere v5.0 and earliervSphere v5.1 and later
Promiscuous Mode RejectReject
MAC Address ChangesAcceptReject
Forged TransmitAcceptReject




See also