Configuring MAC Learning and Port-Level Security Overrides on Distributed switch

Products

• VMware vCenter Server

Issue/Introduction

This article addresses how MAC Learning policies are handled at the Distributed Virtual Port (DVPort) level within Distributed Virtual Switch (DVS) and clarifies the behavior of these policies during a vMotion operation, specifically concerning the DVPort ID persistence.

Resolution

The DVPort ID is an attribute of the Distributed Virtual Switch and is assigned to the VM's virtual network adapter. When a VM is migrated to a new host (vMotion), the DVPort ID remains the same. Consequently, any network policy, including the MAC Learning configuration, that was applied directly to that specific DVPort will persist after the VM migration.

Port-Level Policy Configuration (Security Override)

This approach involves overriding the inherited network policy on a specific DVPort to set the MAC Learning policy.

Enabling Per-Port Policy Overrides (Pre-requisite)

Before overriding a specific port, you must first enable the override capability on the Distributed Port Group:

• In the vCenter, navigate to Networking (or the relevant Distributed Switch view).
• Select the Distributed Switch, then click the Networks tab.
• Click Distributed Port Groups.
• Right-click the target distributed port group and select Edit Settings.
• On the Edit Distributed Port Group window, select the Advanced page.
• Under Override port policies, ensure the Security policy box is checked to allow per-port policy overrides.
• Click OK.

Applying the MAC Learning Override

Once override is allowed on the Port Group, you can apply the custom MAC Learning setting to the individual port:

• Locate the specific distributed port (connected to the target VM) in the vCenter.
• Right-click the port and select Edit Distributed Port Settings.
• Navigate to the Security policy section.
• Override the inherited MAC Learning setting and explicitly set it to Accept.

Note: We strongly do not recommend using port-level overrides for long-term configuration management. This custom setting can easily be forgotten and if the VM's port group is changed or virtual NIC is disconnected/reconnected, the VM will likely be assigned a new DVPort ID.

Recommended Best Practice (Port Group Configuration)

For robust and easily manageable network policies, apply MAC Learning settings at the Port Group level:

• Create a dedicated Distributed Port Group for VMs that require a non-default MAC Learning policy.
• Configure the MAC Learning policy on the new Port Group.
• Assign the specific VM to this new Port Group.

This ensures the policy is consistently applied and persists, regardless of vMotion or administrative changes to the VM's network adapter connection.

Additional Information

 

• MAC Learning Policy

• Configure Overriding Networking Policies on Port Level