6.0.1

Solution
n
If the VPN software must continue its work on the virtual machine, allow the traffic out of the virtual
machine and configure the physical switch port individually to pass the BPDU frames.
Network Device Configuration
Distributed or
standard switch
Set the Forged Transmit security property on the port group to Accept to allow BPDU frames to
leave the host and reach the physical switch port.
You can isolate the settings and the physical adapter for the VPN traffic by placing the virtual
machine in a separate port group and assigning the physical adapter to the group.
CAUTION Setting the Forged Transmit security property to Accept to enable a host to send BPDU
frames carries a security risk because a compromised virtual machine can perform spoofing
attacks.
Physical switch
n
Keep the Port Fast enabled.
n
Enable the BPDU filter on the individual port. When a BPDU frame arrives at the port, it is
filtered out.
NOTE Do not enable the BPDU filter globally. If the BPDU filter is enabled globally, the Port Fast
mode becomes disabled and all physical switch ports perform the full set of STP functions.
n
To deploy a bridge device between two virtual machine NICs connected to the same Layer 2 network,
allow the BPDU traffic out of the virtual machines and deactivate Port Fast and BPDU loop prevention
features.
Network Device Configuration
Distributed or
standard switch
Set the Forged Transmit property of the security policy on the port groups to Accept to allow
BPDU frames to leave the host and reach the physical switch port.
You can isolate the settings and one or more physical adapters for the bridge traffic by placing
the virtual machine in a separate port group and assigning the physical adapters to the group.
CAUTION Setting the Forged Transmit security property to Accept to enable bridge deployment
carries a security risk because a compromised virtual machine can perform spoofing attacks.
Physical switch
n
Disable Port Fast on the ports to the virtual bridge device to run STP on them.
n
Disable BPDU guard and filter on the ports facing the bridge device.
n
Protect the environment from DoS attacks in any case by activating the BPDU filter on the ESXi host or
on the physical switch.
n
On a host running ESXi 4.1 Update 3, ESXi 5.0 Patch 04 and later 5.0 releases, and ESXi 5.1 Patch 01
and later, enable the Guest BPDU filter in one of the following ways and reboot the host:
n
In the Advanced System Settings table on the Manage tab for the host in the
vSphere Web Client, set the Net.BlockGuestBPDU property to 1.
n
In an ESXi Shell to the host, type the following vCLI command:
esxcli system settings advanced set -o /Net/BlockGuestBPDU -i 1
n
On a host that does not have the Guest BPDU filter implemented enable the BPDU filter on the
physical switch port to the virtual bridge device.
Network Device Configuration
Distributed or
standard switch
Set the Forged Transmit property of the security policy on the port group to Reject.
Physical switch
n
Keep the Port Fast configuration.
n
Enable the BPDU filter on the individual physical switch port. When a BPDU frame
arrives at the physical port, it is filtered out.
NOTE Do not enable the BPDU filter globally. If the BPDU filter is enabled globally, the
Port Fast mode becomes disabled and all physical switch ports perform the full set of
STP functions.
vSphere Troubleshooting
90 VMware, Inc.