Data VLANs lost connectivity after migrating a virtual firewall to a vSphere Distributed Switch (VDS).
search cancel

Data VLANs lost connectivity after migrating a virtual firewall to a vSphere Distributed Switch (VDS).

book

Article ID: 442243

calendar_today

Updated On:

Products

VMware vCenter Server VMware vSphere ESXi

Issue/Introduction

  • A virtual firewall appliance (e.g., Palo Alto, Fortinet, Zscaler) was recently migrated from a Standard vSwitch (VSS) to a vSphere Distributed Switch (VDS).

  • Traffic passing through the firewall's data VLANs (configured as a trunk) is dropping or failing entirely.

  • The management VLAN of the virtual firewall remains fully accessible and unaffected.

Environment

  • VMware ESXi 7.x
  • VMware ESXi 8.x

Cause

By default, vSphere Distributed Switch (VDS) port groups are configured with strict security policies that drop traffic if the MAC address of the transmitting or receiving frame does not match the assigned MAC address of the virtual machine's vNIC.

Virtual firewalls process and route traffic on behalf of many external endpoints, meaning they frequently send and receive packets utilizing MAC addresses other than their own. If the VDS port group is not explicitly configured to allow this behavior, the ESXi host will drop the transit traffic, resulting in a loss of connectivity for the data VLANs.

Resolution

To resolve this issue, the VDS port group backing the firewall's data interfaces must be configured to allow multiple MAC addresses. This can be achieved using either MAC Learning (Preferred) or modifying the Security Policies.

Option 1: Enable MAC Learning (Preferred for Modern vSphere Environments)

MAC Learning provides better performance and lowers CPU overhead compared to Promiscuous Mode.

  1. Log in to the vSphere Client.

  2. Navigate to the Networking inventory view.

  3. Right-click the VDS port group connected to the virtual firewall's data interfaces and select Edit Settings.

  4. Navigate to the MAC Learning section.

  5. Enable MAC Learning.

  6. Click OK to save the changes. Note: Depending on your vSphere version, MAC Learning may need to be enabled via the vSphere API if not exposed in the UI.

Option 2: Modify Port Group Security Policies (Legacy/Alternative)

If MAC Learning is unsupported in your specific configuration, update the traditional security policies.

  1. Log in to the vSphere Client.

  2. Navigate to the Networking inventory view.

  3. Right-click the VDS port group connected to the virtual firewall's data interfaces and select Edit Settings.

  4. Select the Security tab.

  5. Change the following policies from Reject to Accept:

    • Promiscuous Mode: Accept

    • MAC Address Changes: Accept

    • Forged Transmits: Accept

  6. Click OK to save the changes.

Additional Information

Applying the MAC Learning configuration or updating the security policies immediately restores connectivity for all data VLANs. This is a standard prerequisite for virtual firewalls to ensure proper traffic flow and High Availability (HA) failover.

For more details, refer to the following vendor documentation:

Powered by Wolken Software