VMWare ESX Virtual Switch Security

One of the things I like about VMWare ESX is the security in their Layer 2 Virtual Swicthes. They will not permit them be joined together so loops is not an issue and they let you apply 3 policy settings to secure the vSwitches this are:

This settings will prevent the virtual machines that use the switch from acting as a sniffer, changing their mac address or forging traffic with fake mac address thous protecting the rest of the virtual machines in the case of a compromise of a VM from it being used to conduct Man In the Middle Attacks, ARP Poison Attacks or being used to sniff traffic. To set the Policy on Reject on a virtual switch it can be done both from the Service Console or thru the VI Client. On the VI Client:

  1. Log into the VMware VI Client and select the server from the inventory panel.The hardware configuration page for this server appears.
  2. Click the Configuration tab, and click Networking.
  3. Click Properties for the vSwitch whose Layer 2 Security policy you want to edit.
  4. In the Properties dialog box for the vSwitch, click the Ports tab.
  5. Select the vSwitch item and click Edit.
  6. In the Properties dialog box for the vSwitch, click the Security tab.
  7. Select reject on the drpdown boxes for all 3 Policy Exceptions.
  8. Click OK
From the CLI just SSH into the Server and su to have root privilege and run

  • vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-macchange=false
  • vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-forgedxmit=false
Promiscuous is already set to reject by default.