Security clarification for default VLAN trunking on vSphere Distributed Switch uplinks VMware vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

This article clarifies the default security posture and functional design of vSphere Distributed Switch (vDS) Uplink Port Groups. Administrators often observe that default uplink port groups are configured for VLAN trunking with a range of 0–4094. This configuration is a standard architectural requirement for traffic transport between physical network infrastructure and the virtualized switch environment. Understanding the isolation mechanisms at the Distributed Port Group level ensures that this default wide-range trunking does not compromise virtual machine security or data integrity.

Symptoms:

• Security audits flag vDS Uplink Port Groups for allowing all VLANs (0–4094).
• Administrators request clarification on why the default uplink port type is set to VLAN trunking.
• Concerns regarding potential cross-VLAN traffic leakage through default uplink containers.

Environment

VMware vCenter Server 8.0.x
VMware vSphere ESXi 8.0.x
vSphere Distributed Switch (vDS)

Cause

This configuration is by-design. The Uplink Port Group serves as a transparent 802.1Q trunk pipe between the physical switch and the vDS. Security enforcement occurs at the individual Distributed Port Group level, not the Uplink level.

Resolution

The default configuration is technically secure and does not constitute a security risk based on these architectural principles:

1. Uplink as a Transport Pipe: The Uplink Port Group acts strictly as an 802.1Q trunk to pass tagged traffic between the physical switch infrastructure and the vDS. It does not provide access to the data stream itself.
2. Port Group Enforcement: Security boundaries and isolation are enforced at the individual Distributed Port Group level where Virtual Machines (VMs) are connected.
3. VLAN Isolation: The vDS immediately drops any packet arriving at the host for a VLAN that is not explicitly assigned to a Port Group on that specific host. A VM cannot see or access traffic from any VLAN other than the one assigned to its specific Port Group.

Additional Information

For further details on vDS architecture, see Basic Networking with vSphere Distributed Switches.