Solved

Understand Network Security Policies of VMware (Mac Address Change and Forged Transmits)

Posted on 2014-12-29
10
277 Views
Last Modified: 2015-03-03
Both the security Policies (Mac Address change and Forged Transmits) are concerned with allowing or denying differences between the initial MAC Address in the configuration file (.vmx file) and the effective MAC address in the guest operating system. I would like to understand why these security policies MAC address change and Forged transmits is set to Accept in VMware standard switches where as these policies are set to Reject on distributed switch?
Can anyone help me to understand why these settings are set different in Standard and  Distributed switch?
Thanks
0
Comment
Question by:jmohan0302
  • 6
  • 4
10 Comments
 
LVL 61

Assisted Solution

by:gheist
gheist earned 500 total points
ID: 40522776
Because somebody disabled it, check logs if they reach that far back. MAC change is generally not necessary as you can change one in VMs settings. Forged transmits are if you run software network switch, but not othrewise.
It is best to reject all of them but allow per-port override "just in case"
Given that finding port number takes 10 minutes or so you can also enable global switch down the road.
0
 

Author Comment

by:jmohan0302
ID: 40523110
Thanks Gheist. Irrespective of the virtual switches either standard or distributed, the underlying concept of MAC address change and Forged transmits remains same. However, why the default settings of those settings are set to be different (Accept in case of Standard switches and Reject in case of Distributed switches) and I just like to understand this? Thanks
0
 
LVL 61

Expert Comment

by:gheist
ID: 40523342
Somebody was thinking about security and configured distributed switches properly. Their default is same as you see in local switches.
0
 

Author Comment

by:jmohan0302
ID: 40525117
Thanks. I couldn't understand what do you mean? Could you please explain? Thanks again
0
 
LVL 61

Assisted Solution

by:gheist
gheist earned 500 total points
ID: 40525179
Default is to enable 2 settings. Your distributed switches were manually configured to be more secure.
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:jmohan0302
ID: 40525212
Fine. I would like to understand why these settings are set to accept in standard virtual switches and set to reject in distributed switches when it comes to default settings
0
 
LVL 61

Expert Comment

by:gheist
ID: 40525217
i crated distributed switch yesterday and it cam up with 2 settings enabled. so your distributed switch is non-default.
0
 

Author Comment

by:jmohan0302
ID: 40527190
ok... Let me check
0
 

Accepted Solution

by:
jmohan0302 earned 0 total points
ID: 40625920
Thanks Gheist.  Hope your version of vSphere is 5.0 or earlier.

I found that in order to prevent an untrusted virtual machine from changing its MAC address or sending Packets on behalf of other virtual machines  the default settings for the security policy have changed for distributed virtual switch port groups in distributed virtual switches created by using versions later than vSphere 5.0.


 So the default security policy for a distributed port group from vSphere5.1 and later is REJECT, REJECT and REJECT.

Below link provides better understanding of the same:

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2030982

Thanks
0
 

Author Closing Comment

by:jmohan0302
ID: 40641569
Resolved
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Suggested Solutions

HOW TO: Upload an ISO image to a VMware datastore for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5) using the vSphere Host Client, and checking its MD5 checksum signature is correct.  It's a good idea to compare checksums, because many installat…
Veeam Backup & Replication has added a new integration – Veeam Backup for Microsoft Office 365.  In this blog, we will discuss how you can benefit from Office 365 email backup with the Veeam’s new product and try to shed some light on the needs and …
Teach the user how to rename, unmount, delete and upgrade VMFS datastores. Open vSphere Web Client: Rename VMFS and NFS datastores: Upgrade VMFS-3 volume to VMFS-5: Unmount VMFS datastore: Delete a VMFS datastore:
Teach the user how to install log collectors and how to configure ESXi 5.5 for remote logging Open console session and mount vCenter Server installer: Install vSphere Core Dump Collector: Install vSphere Syslog Collector: Open vSphere Client: Config…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now