Solved

Understand Network Security Policies of VMware (Mac Address Change and Forged Transmits)

Posted on 2014-12-29
10
283 Views
Last Modified: 2015-03-03
Both the security Policies (Mac Address change and Forged Transmits) are concerned with allowing or denying differences between the initial MAC Address in the configuration file (.vmx file) and the effective MAC address in the guest operating system. I would like to understand why these security policies MAC address change and Forged transmits is set to Accept in VMware standard switches where as these policies are set to Reject on distributed switch?
Can anyone help me to understand why these settings are set different in Standard and  Distributed switch?
Thanks
0
Comment
Question by:jmohan0302
  • 6
  • 4
10 Comments
 
LVL 61

Assisted Solution

by:gheist
gheist earned 500 total points
ID: 40522776
Because somebody disabled it, check logs if they reach that far back. MAC change is generally not necessary as you can change one in VMs settings. Forged transmits are if you run software network switch, but not othrewise.
It is best to reject all of them but allow per-port override "just in case"
Given that finding port number takes 10 minutes or so you can also enable global switch down the road.
0
 

Author Comment

by:jmohan0302
ID: 40523110
Thanks Gheist. Irrespective of the virtual switches either standard or distributed, the underlying concept of MAC address change and Forged transmits remains same. However, why the default settings of those settings are set to be different (Accept in case of Standard switches and Reject in case of Distributed switches) and I just like to understand this? Thanks
0
 
LVL 61

Expert Comment

by:gheist
ID: 40523342
Somebody was thinking about security and configured distributed switches properly. Their default is same as you see in local switches.
0
 

Author Comment

by:jmohan0302
ID: 40525117
Thanks. I couldn't understand what do you mean? Could you please explain? Thanks again
0
 
LVL 61

Assisted Solution

by:gheist
gheist earned 500 total points
ID: 40525179
Default is to enable 2 settings. Your distributed switches were manually configured to be more secure.
0
Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

 

Author Comment

by:jmohan0302
ID: 40525212
Fine. I would like to understand why these settings are set to accept in standard virtual switches and set to reject in distributed switches when it comes to default settings
0
 
LVL 61

Expert Comment

by:gheist
ID: 40525217
i crated distributed switch yesterday and it cam up with 2 settings enabled. so your distributed switch is non-default.
0
 

Author Comment

by:jmohan0302
ID: 40527190
ok... Let me check
0
 

Accepted Solution

by:
jmohan0302 earned 0 total points
ID: 40625920
Thanks Gheist.  Hope your version of vSphere is 5.0 or earlier.

I found that in order to prevent an untrusted virtual machine from changing its MAC address or sending Packets on behalf of other virtual machines  the default settings for the security policy have changed for distributed virtual switch port groups in distributed virtual switches created by using versions later than vSphere 5.0.


 So the default security policy for a distributed port group from vSphere5.1 and later is REJECT, REJECT and REJECT.

Below link provides better understanding of the same:

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2030982

Thanks
0
 

Author Closing Comment

by:jmohan0302
ID: 40641569
Resolved
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If we need to check who deleted a Virtual Machine from our vCenter. Looking this task in logs can be painful and spend lot of time, so the best way to check this is in the vCenter DB. Just connect to vCenter DB(default DB should be VCDB and using…
Last article we focus in how to VMware: How to create and use VMs TAGs – Part 1 so before follow this article and perform the next tasks, you should read the first article how to create the TAG before using them in Veeam Backup Jobs.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This Micro Tutorial walks you through using a remote console to access a server and install ESXi 5.1. This example is showing remote access and installation using a Dell server. The hypervisor is the very first component of your virtual infrastructu…

929 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now