Unicast traffic drops on VMXNET3 adapters unless Promiscuous Mode is enabled in Guest OS

Products

• VMware vSphere ESXi

Issue/Introduction

Unicast traffic is dropped for virtual machines (e.g., OPNsense, OpenSUSE) utilizing VMXNET3 adapters.

Traffic only passes successfully if Promiscuous Mode is manually enabled within the Guest operating system.

vSwitch or Portgroup Promiscuous Mode settings are already enabled but do not resolve the issue without the Guest OS change.

Network traces reveal asymmetric traffic flows (e.g., requests arrive on one vmnic, but replies attempt to egress a different vmnic).

Environment

• VMware vSphere ESXi 8.0 Update 3 and higher

Cause

A load balancing teaming policy mismatch exists between the ESXi vSwitch/portgroup and the upstream physical switch. When the physical switch is configured for Static Etherchannel but the ESXi host is set to the default "Route based on originating virtual port," return traffic may arrive on an uplink not expected by the ESXi MAC table. Enabling Promiscuous Mode in the Guest OS forces the interface to accept these frames, masking the underlying configuration error.

Resolution

To resolve this issue, align the ESXi teaming policy with the physical switch configuration:

1. Log in to vCenter Server.
2. Navigate to the impacted ESXi Host > Configure > Virtual Switches.
3. Select the impacted vSwitch or Distributed Port Group and click Edit.
4. Select the Teaming and Failover tab.
5. Change the Load Balancing policy to Route based on IP hash.
6. Ensure all physical adapters in the Teaming&Failover policy are set to  Active/Active.
7. Click OK.
8. Disable Promiscuous Mode within the Guest OS and verify that unicast traffic now flows correctly.

Additional Information

For more information on NIC teaming requirements, see Link Aggregation Requirements for ESXi (EtherChannel, Port Channel, LACP)