Security Implications of Enabling Promiscuous Mode, MAC Changes, and Forged Transmits on vSphere Switches

Products

• VMware vSphere ESXi

Issue/Introduction

Understand the security implications and potential vulnerabilities associated with enabling Promiscuous Mode, MAC Address Changes, and Forged Transmits on VMware vSphere port groups

Environment

VMware vSphere

Resolution

When you configure port group security policies, the default and recommended setting for production environments is typically "Reject". Changing these to "Accept" introduces specific vulnerabilities to your virtual environment.

 Promiscuous Mode
  Function: This setting instructs the virtual switch to forward all observed network traffic to the guest virtual machine, regardless of the destination MAC address.

  Security Risk: A compromised or malicious virtual machine can run packet sniffing tools (such as Wireshark or tcpdump) to capture and analyze network traffic intended for other virtual machines on the same port group or VLAN. This exposes sensitive plaintext data across the broadcast domain.

MAC Address Changes
  Function: This allows the guest operating system to change its effective inbound MAC address to a value different from the Initial MAC Address assigned in the virtual machine's  configuration file.

  Security Risk: A malicious virtual machine can spoof the MAC address of a legitimate virtual machine or network appliance. This enables an attacker to hijack inbound traffic intended for the legitimate device, leading to a Denial of Service (DoS) for the victim or unauthorized data access for the attacker.

Forged Transmits
Function: This allows the guest operating system to transmit outbound frames with a source MAC address that differs from the Initial MAC Address assigned in the configuration file.

Security Risk: This enables an attacker to send malicious frames onto the network, facilitating ARP poisoning, MAC flooding, and Man-in-the-Middle (MitM) attacks. The malicious VM can impersonate critical network infrastructure, such as the default gateway or adjacent virtual machines.

Note: There is no network disruption or temporary disconnection to the vSwitch or the virtual machines when you change these security policies from Reject to Accept. However, doing so reduces your overall network security posture.

Additional Information

Related Information
For more details on securing your environment, see the Securing vSphere Standard Switches