6.5.1

8 Specify the kind of traffic that the rule is applicable to.
To determine if a data flow is in the scope of a rule for marking or filtering, the vSphere distributed
switch examines the direction of the traffic, and properties like source and destination, VLAN, next
level protocol, infrastructure traffic type, and so on.
a From the Traffic direction drop-down menu, select whether the traffic must be ingress, egress,
or both so that the rule recognizes it as matching.
The direction also influences how you are going to identify the traffic source and destination.
b By using qualifiers for system data type, Layer 2 packet attributes, and Layer 3 packet attributes
set the properties that packets must have to match the rule.
A qualifier represents a set of matching criteria related to a networking layer. You can match
traffic to system data type, Layer 2 traffic properties, and Layer 3 traffic properties. You can use
the qualifier for a specific networking layer or can combine qualifiers to match packets more
precisely.
n
Use the system traffic qualifier to match packets to the type of virtual infrastructure data that
is flowing through the ports of the group . For example, you can select NFS for data transfers
to network storage.
n
Use the MAC traffic qualifier to match packets by MAC address, VLAN ID, and next level
protocol.
Locating traffic with a VLAN ID on a distributed port group works with Virtual Guest Tagging
(VGT). To match traffic to VLAN ID if Virtual Switch Tagging (VST) is active, use a rule on an
uplink port group or uplink port.
n
Use the IP traffic qualifier to match packets by IP version, IP address, and next level protocol
and port.
9 In the rule dialog box, click OK to save the rule.
Filter Trac on a Distributed Port or Uplink Port
By using a rule, permit or stop traffic for securing data flows through a virtual machine, a VMkernel
adapter, or a physical adapter.
Prerequisites
To override a policy on distributed port level, enable the port-level override option for this policy. See
Configure Overriding Networking Policies on Port Level.
Procedure
1 Navigate to a distributed switch and then navigate to a distributed port or an uplink port.
n
To navigate to the distributed ports of the switch, click Networks > Distributed Port Groups,
double-click a distributed port group from the list, and click the Ports tab.
n
To navigate to the uplink ports of an uplink port group, click Networks > Uplink Port Groups,
double-click an uplink port group from the list, and click the Ports tab.
vSphere Networking
VMware, Inc. 129