VMware ESXi and vSphere Cluster Management

VMware ESXi Virtual Switch Security Policies

Learn how Promiscuous Mode, MAC Address Changes, and Forged Transmits secure ESXi virtual switches, including scope, precedence, configuration, and troubleshooting.

VMware ESXi virtual-switch security policies control how virtual machines receive and send Ethernet frames. They reduce the risk of traffic interception and virtual-machine network identity impersonation. These controls operate in ESXi virtual networking; they are not replacements for guest operating-system firewalls.

This lesson covers the three standard security policies: Promiscuous Mode, MAC Address Changes, and Forged Transmits. The settings can be applied to a standard virtual switch, or overridden for an individual port group.

Key terms

vSwitch: An ESXi standard virtual switch that connects virtual machines and physical uplinks.
Port group: A logical network attachment configuration for virtual machines. It can inherit policies from a virtual switch or override them.
Virtual NIC: The virtual network adapter assigned to a virtual machine, including its configured MAC address.
Accept: Permits the behavior controlled by a policy.
Reject: Blocks the behavior controlled by a policy.

Security policy comparison

Policy	Traffic direction or visibility	Behavior when rejected	When Accept may be needed	Security consideration
Promiscuous Mode	Inbound visibility beyond the VM's own destination MAC address	The guest cannot passively observe frames traversing the virtual switch	A dedicated packet sniffer, packet-capture tool, or intrusion detection system	Broad acceptance can expose traffic from other workloads
MAC Address Changes	Inbound delivery after the guest changes the MAC associated with its virtual NIC	The VM cannot receive traffic for the changed guest-side MAC address	Supported clustering, failover, or appliance designs that intentionally change MAC addresses	Limits virtual-machine network identity changes
Forged Transmits	Outbound frames sent by the VM	Frames with a source MAC different from the assigned virtual-NIC MAC are dropped	A workload that must transmit using an alternate source MAC address	Limits source-MAC spoofing from the guest

Promiscuous Mode

Normally, a guest virtual NIC receives frames addressed to its own MAC address, along with traffic that the virtual switch must deliver for normal network operation. Promiscuous Mode allows a guest virtual NIC to receive traffic beyond frames specifically addressed to that NIC.

With Reject, a guest cannot passively observe unrelated traffic traversing the virtual switch. This is the appropriate setting for most application, database, and infrastructure VMs.

With Accept, a monitoring workload may inspect broader traffic. Examples include an in-guest packet capture utility, network sensor, or intrusion detection system. Use this setting only when the workload has a documented requirement.

Enabling Promiscuous Mode broadly increases exposure: a compromised or misconfigured VM may gain visibility into traffic belonging to other workloads on the affected virtual network. A dedicated monitoring port group is safer than enabling the policy across every port group.

MAC Address Changes

MAC Address Changes controls whether a VM can continue receiving traffic after software inside the guest changes the MAC address presented by its virtual NIC.

When the policy is Reject, changing the guest-side MAC address prevents the VM from receiving traffic for that changed address. This helps prevent a guest from assuming another network identity.

Some supported designs intentionally alter MAC addresses. Examples can include certain clustering, failover, virtual-appliance, or network-identity designs. In those cases, evaluate the design and enable Accept only at the narrowest required scope.

The historically stated default for MAC Address Changes is Accept. Do not treat a default as a security recommendation; verify the effective setting in the environment and apply the organization's baseline.

Forged Transmits

The canonical VMware term is Forged Transmits. Older material may call this policy Forget Transmits; the terms refer to the same policy concept.

This policy examines outbound frames from a VM. With Reject, ESXi drops an outbound frame when its source MAC address differs from the MAC assigned to the virtual NIC.

With Accept, the guest may send frames using an alternate source MAC address. This can be required by some virtual appliances, clustered workloads, or failover designs, but it also permits source-MAC impersonation by a guest.

The historically stated default for Forged Transmits is Accept. Review and harden this setting rather than assuming the default is suitable.

MAC Address Changes versus Forged Transmits

These policies are related but control opposite traffic directions:

MAC Address Changes concerns inbound traffic delivered to a VM after the guest changes the MAC address associated with its virtual NIC.
Forged Transmits concerns outbound frames sent by a VM with a source MAC that differs from the assigned virtual-NIC MAC.

A workload using an alternate MAC may need one, both, or neither policy changed. If it must receive traffic for the alternate address, evaluate MAC Address Changes. If it must send frames using that address, evaluate Forged Transmits. Test both directions rather than enabling both automatically.

Policy scope and precedence

Security policies can be configured at the standard virtual-switch level or at the port-group level. A switch-level setting provides the baseline for port groups that inherit it.

Configuration scope	Affected workloads	Relationship to parent setting	Recommended use
Standard virtual switch	Port groups and VMs that inherit the switch policy	Provides the baseline	Set restrictive defaults for the general workload population
Port group	VMs connected to that port group	Overrides the corresponding inherited switch setting	Use for a narrowly scoped monitoring or alternate-MAC exception

A port-group policy takes precedence over the corresponding setting inherited from the standard virtual switch. This makes it practical to use restrictive switch-wide defaults and create narrowly scoped port-group exceptions.

Historical default settings stated for this lesson

Policy	Stated default
Promiscuous Mode	Reject
MAC Address Changes	Accept
Forged Transmits	Accept

Defaults can vary by product version, configuration workflow, or organizational baseline. Confirm the effective value instead of relying only on a remembered default.

Configure the policies in the vSphere web interface

Open the ESXi host management view.
Open Manage, then select Networking.
Select the applicable standard virtual switch or port group.
Choose Edit settings.
Open the Security section.
Set Promiscuous Mode, MAC Address Changes, and Forged Transmits to Accept or Reject as required.
Confirm whether the values are being applied at switch scope or as a port-group override.
Save the configuration and test the workload from both the required and prohibited traffic perspectives.

ESXi host > Manage > Networking > select virtual switch or port group > Edit settings > Security

Promiscuous Mode: Accept or Reject
MAC Address Changes: Accept or Reject
Forged Transmits: Accept or Reject

Secure configuration guidance

Use Reject when a workload has no documented requirement for an exception.
Keep Promiscuous Mode disabled for ordinary application workloads.
Place packet-capture and IDS workloads on a dedicated port group where possible.
Enable Accept only for the specific policy and port group required by a supported workload.
Document the workload, owner, policy exception, business or technical justification, and review date.
Reassess exceptions after migrations, redesigns, software changes, and workload decommissioning.

Practical configuration examples

Standard application VM

For an ordinary application VM, use Promiscuous Mode Reject. Use MAC Address Changes and Forged Transmits Reject unless the application has a documented requirement to receive or send using an alternate MAC address.

Packet-capture or IDS VM

Enable Promiscuous Mode on the monitoring VM's dedicated port group after confirming the monitoring requirement and exposure. Keep MAC Address Changes and Forged Transmits restrictive unless the monitoring software separately requires those behaviors.

Virtual appliance or clustered workload

Keep Promiscuous Mode Reject unless traffic monitoring is required. Evaluate MAC Address Changes for inbound connectivity and Forged Transmits for outbound frames using the alternate source MAC. Enable each setting only when the supported design requires it.

Switch baseline with a targeted exception

Configure restrictive policies on the standard vSwitch. Create a port-group override only for the exceptional workload, and change only the policy or policies it needs.

Troubleshooting

Inbound connectivity stops after a guest MAC change

Likely cause: MAC Address Changes is set to Reject.

Check: Confirm the guest's configured MAC behavior and determine whether the change is required by the workload design. If it is required, apply Accept at the appropriate port-group scope and test inbound traffic.

Outbound frames with an alternate source MAC fail

Likely cause: Forged Transmits is set to Reject.

Check: Verify the source MAC on outbound frames. Permit Forged Transmits only for the required port group when the alternate-MAC design is supported and documented.

A packet-capture or IDS VM sees only its own traffic

Likely cause: Promiscuous Mode is set to Reject.

Check: Confirm that the monitoring workload genuinely requires broader visibility, then enable Promiscuous Mode on its dedicated port group and reassess the exposure.

A switch-level change appears ineffective for one VM

Likely cause: The VM's port group has an overriding security policy.

Check: Inspect the port-group security configuration and inheritance state. Align the override with the intended policy or remove the override so the VM inherits the switch baseline.

Exam-relevant notes

Promiscuous Mode is primarily about what traffic a guest can receive or observe.
MAC Address Changes concerns inbound delivery after a guest-side MAC change.
Forged Transmits concerns outbound source-MAC validation.
A port-group setting takes precedence over the corresponding standard vSwitch setting.
Use restrictive defaults and narrowly scoped exceptions.