6.7

Table Of Contents
Solution
n
If the VPN software must continue its work on the virtual machine, allow the traffic out of the virtual
machine and configure the physical switch port individually to pass the BPDU frames.
Network
Device Configuration
Distributed or
standard switch
Set the Forged Transmit security property on the port group to Accept to allow BPDU frames to leave the
host and reach the physical switch port.
You can isolate the settings and the physical adapter for the VPN traffic by placing the virtual machine in a
separate port group and assigning the physical adapter to the group.
Caution Setting the Forged Transmit security property to Accept to enable a host to send BPDU frames
carries a security risk because a compromised virtual machine can perform spoofing attacks.
Physical switch
n
Keep the Port Fast enabled.
n
Enable the BPDU filter on the individual port. When a BPDU frame arrives at the port, it is filtered out.
Note Do not enable the BPDU filter globally. If the BPDU filter is enabled globally, the Port Fast mode
becomes disabled and all physical switch ports perform the full set of STP functions.
n
To deploy a bridge device between two virtual machine NICs connected to the same Layer 2 network,
allow the BPDU traffic out of the virtual machines and deactivate Port Fast and BPDU loop prevention
features.
Network Device Configuration
Distributed or
standard switch
Set the Forged Transmit property of the security policy on the port groups to Accept to allow BPDU
frames to leave the host and reach the physical switch port.
You can isolate the settings and one or more physical adapters for the bridge traffic by placing the virtual
machine in a separate port group and assigning the physical adapters to the group.
Caution Setting the Forged Transmit security property to Accept to enable bridge deployment carries a
security risk because a compromised virtual machine can perform spoofing attacks.
Physical switch
n
Disable Port Fast on the ports to the virtual bridge device to run STP on them.
n
Disable BPDU guard and filter on the ports facing the bridge device.
n
Protect the environment from DoS attacks in any case by activating the BPDU filter on the ESXi host
or on the physical switch.
u
On a host that does not have the Guest BPDU filter implemented enable the BPDU filter on the
physical switch port to the virtual bridge device.
Network Device Configuration
Distributed or
standard switch
Set the Forged Transmit property of the security policy on the port group to Reject.
Physical switch
n
Keep the Port Fast configuration.
n
Enable the BPDU filter on the individual physical switch port. When a BPDU frame arrives at
the physical port, it is filtered out.
Note Do not enable the BPDU filter globally. If the BPDU filter is enabled globally, the Port Fast
mode becomes disabled and all physical switch ports perform the full set of STP functions.
vSphere Networking
VMware, Inc. 266