6.5.1

Securing Standard Switch Ports with Security Policies
The VMkernel port group or virtual machine port group on a standard switch has a configurable security
policy. The security policy determines how strongly you enforce protection against impersonation and
interception attacks on VMs.
Just like physical network adapters, virtual machine network adapters can impersonate another VM.
Impersonation is a security risk.
n
A VM can send frames that appear to be from a different machine so that it can receive network
frames that are intended for that machine.
n
A virtual machine network adapter can be configured so that it receives frames targeted for other
machines
When you add a VMkernel port group or virtual machine port group to a standard switch, ESXi configures
a security policy for the ports in the group. You can use this security policy to ensure that the host
prevents the guest operating systems of its VMs from impersonating other machines on the network. The
guest operating system that might attempt impersonation does not detect that the impersonation was
prevented.
The security policy determines how strongly you enforce protection against impersonation and
interception attacks on VMs. To correctly use the settings in the security profile, see the Security Policy
section in the vSphere Networking publication. This section explains:
n
How VM network adapters control transmissions.
n
How attacks are staged at this level
Securing vSphere Standard Switches
You can secure standard switch traffic against Layer 2 attacks by restricting some of the MAC address
modes of the VM network adapters.
Each VM network adapter has an initial MAC address and an effective MAC address.
Initial MAC address The initial MAC address is assigned when the adapter is created. Although
the initial MAC address can be reconfigured from outside the guest
operating system, it cannot be changed by the guest operating system.
Effective MAC address Each adapter has an effective MAC address that filters out incoming
network traffic with a destination MAC address that is different from the
effective MAC address. The guest operating system is responsible for
setting the effective MAC address and typically matches the effective MAC
address to the initial MAC address.
Upon creating a VM network adapter, the effective MAC address and initial MAC address are the same.
The guest operating system can alter the effective MAC address to another value at any time. If an
operating system changes the effective MAC address, its network adapter receives network traffic that is
destined for the new MAC address.
vSphere Security
VMware, Inc. 181