Change to the default security policy for Distributed Switch distributed port groups
Article ID: 337913
Updated On:
Products
Issue/Introduction
To prevent an untrusted virtual machine from changing its MAC address or sending packets on behalf of other virtual machines, the default settings for the security policy have changed for distributed virtual switch port groups in distributed virtual switches created by using versions later than vSphere 5.0.
With the new settings, if the MAC address changes, the virtual machine driver is not notified of the new MAC address. This policy change can cause virtual applications and virtual machines that rely on the MAC address (or on a forged transmit) to fail if the MAC address is changed for a virtual machine NIC.
Environment
VMware vSphere ESXi 5.1
Resolution
If this new default policy has caused ports to be blocked, edit the distributed virtual switch security policy manually for that distributed virtual port group, allowing MAC address change and forged transmit. Use the following table to see the changes in default settings.
| Default Setting | vSphere v5.0 and earlier | vSphere v5.1 and later |
| Promiscuous Mode | Reject | Reject |
| MAC Address Changes | Accept | Reject |
| Forged Transmit | Accept | Reject |
See also
Feedback
