7.3 Ensure the vSwitch Promiscuous Mode policy is set to reject


Ensure the Promiscuous Mode Policy within the vSwitch is set to reject. Promiscuous mode can be set at the vSwitch and/or the Portgroup level. You can override switch-level settings at the Portgroup level.


When promiscuous mode is enabled for a virtual switch, all virtual machines connected to the dvPortgroup have the potential of reading all packets crossing that network. This could enable unauthorized access to the contents of those packets.


There might be a legitimate reason to enable promiscuous mode for debugging, monitoring, or troubleshooting reasons. Security devices might require the ability to see all packets on a vSwitch. An exception should be made for the dvPortgroups that these applications are connected to in order to allow for full-time visibility to the traffic on that dvPortgroup.


To set the policy to reject, perform the following:

From the vSphere Web Client, select the host.

Click Configure then expand Networking.

Select Virtual switches then click Edit.

Click on Security.

Set Promiscuous mode to Reject in the dropdown.

Click on OK.

Alternately, perform the following via the ESXi shell:

# esxcli network vswitch standard policy security set -v vSwitch2 -p false

Default Value:


See Also