6.0.3

Securing Standard Switch Ports With Security Policies
As with physical network adapters, a virtual machine network adapter can send frames that appear to be
from a dierent machine or impersonate another machine so that it can receive network frames that are
intended for that machine. Also, like physical network adapters, a virtual machine network adapter can be
congured so that it receives frames targeted for other machines. Both scenarios present a security risk.
When you create a standard switch for your network, you add port groups in the vSphere Web Client to
impose a policy for the virtual machines and VMkernel adapters for system trac aached to the switch.
As part of adding a VMkernel port group or virtual machine port group to a standard switch, ESXi
congures a security policy for the ports in the group. You can use this security policy to ensure that the
host prevents the guest operating systems of its virtual machines from impersonating other machines on the
network. This security feature is implemented so that the guest operating system responsible for the
impersonation does not detect that the impersonation was prevented.
The security policy determines how strongly you enforce protection against impersonation and interception
aacks on virtual machines. To correctly use the seings in the security prole, you must understand how
virtual machine network adapters control transmissions and how aacks are staged at this level. See the
Security Policy section in the vSphere Networking publication.
.
Securing vSphere Standard Switches
You can secure standard switch trac against Layer 2 aacks by restricting some of the MAC address
modes by using the security seings of the switches.
Each virtual machine network adapter has an initial MAC address and an eective MAC address.
Initial MAC address
The initial MAC address is assigned when the adapter is created. Although
the initial MAC address can be recongured from outside the guest
operating system, it cannot be changed by the guest operating system.
Effective MAC address
Each adapter has an eective MAC address that lters out incoming network
trac with a destination MAC address that is dierent from the eective
MAC address. The guest operating system is responsible for seing the
eective MAC address and typically matches the eective MAC address to
the initial MAC address.
Upon creating a virtual machine network adapter, the eective MAC address and initial MAC address are
the same. The guest operating system can alter the eective MAC address to another value at any time. If an
operating system changes the eective MAC address, its network adapter receives network trac that is
destined for the new MAC address.
When sending packets through a network adapter, the guest operating system typically places its own
adapter eective MAC address in the source MAC address eld of the Ethernet frames. It places the MAC
address for the receiving network adapter in the destination MAC address eld. The receiving adapter
accepts packets only if the destination MAC address in the packet matches its own eective MAC address.
An operating system can send frames with an impersonated source MAC address. This means an operating
system can stage malicious aacks on the devices in a network by impersonating a network adapter that the
receiving network authorizes.
Protect virtual trac against impersonation and interception Layer 2 aacks by conguring a security policy
on port groups or ports.
The security policy on distributed port groups and ports includes the following options:
n
Promiscuous mode (see “Promiscuous Mode Operation,” on page 233)
vSphere Security
232 VMware, Inc.