VDS Port Security policies not pushed to ESXi host

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

• Promiscuous mode and forged transmits are set to 'Accept' on VDS portgroup, however, these security policies are not pushed to the VM switchports that are connected to the portgroup.
• In the net-dvs -l output on host CLI, below details are observed for the VM switchport ID:
  
  port 123456:
com.vmware.vswitch.port.security = deny promiscuous; allow mac change; deny forged frames
  
  
• Along with the security policies, Mac Learning is also set to enabled on the VDS portgroup.

Environment

VMware vSphere ESXi

VMware vCenter Server

Cause

Enabling Mac Learning with promiscuous mode on a VDS portgroup is an unsupported configuration.

Below logs will be observed in hostd:

2026-08-03T18:10:50.283Z -WARNING Hostd 2102016 [esx@4413 sub="Hostsvc.NetworkProvider" opID="#######-#######" sid="52670185" user="vpxuser:VSPHERE.LOCAL\nsxt_#######-####-####-####-#######"] Enabling mac learning with promiscuous mode on is not supported

2026-08-04T09:53:04.037Z -WARNING Hostd 2102013 [esx@4413 sub="Hostsvc.NetworkProvider" opID="#######-#######:#######-#######" sid="52670185" user="vpxuser:NETWORK.EXAMPLE.COM\adm"] Enabling mac learning with forged transmits off is not supported

Resolution

Mac learning and Promiscuous mode cannot be enabled together on a VDS portgroup, while Mac learning and Forged Transmits must be enabled together.