6.5.1

If the teaming and failover policy of the port group contains more active uplinks, the BPDU traffic is moved
to the adapter for the next active uplink. The new physical switch port becomes disabled, and more
workloads become unable to exchange packets with the network. Eventually, almost all entities on the
ESXi host might become unreachable.
If the virtual machine runs on a host that is a part of a vSphere HA cluster, and the host becomes
network-isolated because most of the physical switch ports connected to it are disabled, the active master
host in the cluster moves the BPDU sender virtual machine to another host. The virtual machine starts
disabling the physical switch ports connected to the new host. The migration across the vSphere HA
cluster eventually leads to accumulated DoS across the entire cluster.
Solution
n
If the VPN software must continue its work on the virtual machine, allow the traffic out of the virtual
machine and configure the physical switch port individually to pass the BPDU frames.
Network
Device Configuration
Distributed or
standard switch
Set the Forged Transmit security property on the port group to Accept to allow BPDU frames to leave the
host and reach the physical switch port.
You can isolate the settings and the physical adapter for the VPN traffic by placing the virtual machine in a
separate port group and assigning the physical adapter to the group.
Caution Setting the Forged Transmit security property to Accept to enable a host to send BPDU frames
carries a security risk because a compromised virtual machine can perform spoofing attacks.
Physical switch
n
Keep the Port Fast enabled.
n
Enable the BPDU filter on the individual port. When a BPDU frame arrives at the port, it is filtered out.
Note Do not enable the BPDU filter globally. If the BPDU filter is enabled globally, the Port Fast mode
becomes disabled and all physical switch ports perform the full set of STP functions.
n
To deploy a bridge device between two virtual machine NICs connected to the same Layer 2 network,
allow the BPDU traffic out of the virtual machines and deactivate Port Fast and BPDU loop prevention
features.
Network Device Configuration
Distributed or
standard switch
Set the Forged Transmit property of the security policy on the port groups to Accept to allow BPDU
frames to leave the host and reach the physical switch port.
You can isolate the settings and one or more physical adapters for the bridge traffic by placing the virtual
machine in a separate port group and assigning the physical adapters to the group.
Caution Setting the Forged Transmit security property to Accept to enable bridge deployment carries a
security risk because a compromised virtual machine can perform spoofing attacks.
Physical switch
n
Disable Port Fast on the ports to the virtual bridge device to run STP on them.
n
Disable BPDU guard and filter on the ports facing the bridge device.
vSphere Troubleshooting
VMware, Inc. 96