6.5.1

Solution
u
In the guest operating system, reset the interface to cause the passthrough network adapter to regain
its valid MAC address. If the interface is configured to use DHCP for address assignment, the
interface acquires an IP address automatically.
For example, on a Linux virtual machine run the ifconfig console command.
ifconfig ethX down
ifconfig ethX up
where X in ethX represents the sequence number of the virtual machine network adapter in the guest
operating system.
A Virtual Machine that Runs a VPN Client Causes Denial of
Service for Virtual Machines on the Host or Across a
vSphere HA Cluster
A virtual machine sending Bridge Protocol Data Unit (BPDU) frames, for example, a VPN client, causes
some virtual machines connected to the same port group to lose connectivity. The transmission of BPDU
frames might also break the connection of the host or of the parent vSphere HA cluster.
Problem
A virtual machine that is expected to send BPDU frames causes the traffic to the external network of the
virtual machines in the same port group to be blocked.
If the virtual machine runs on a host that is a part of a vSphere HA cluster, and the host becomes
network-isolated under certain conditions, you observe Denial of Service (DoS) on the hosts in the
cluster.
Cause
As a best practice, a physical switch port that is connected to an ESXi host has the Port Fast and BPDU
guard enabled to enforce the boundary of the Spanning Tree Protocol (STP). A standard or distributed
switch does not support STP, and it does not send any BPDU frames to the switch port. However, if any
BPDU frame from a compromised virtual machine arrives at a physical switch port facing an ESXi host ,
the BPDU guard feature disables the port to stop the frames from affecting the Spanning Tree Topology of
the network.
In certain cases a virtual machine is expected to send BPDU frames, for example, when deploying VPN
that is connected through a Windows bridge device or through a bridge function. If the physical switch
port paired with the physical adapter that handles the traffic from this virtual machine has the BPDU guard
on, the port is error-disabled, and the virtual machines and VMkernel adapters using the host physical
adapter cannot communicate with the external network anymore.
vSphere Troubleshooting
VMware, Inc. 95