Why should I enable promiscuous mode?

Afshin

5/13/23, 10:35 AM

I'm currently using an environment lab for testing ESXi so I run nested ESX(two ESX are installed on ESX)

The problem is I was trying to install vCenter on both of my lab ESX and at the end of stage 1 of deploying vCenter, I got an error that says :

The installer is unable to connect to vcenter server management interface

After this, although it says I can start stage 2 with the port 5480 of the IP address that I entered, I couldn't connect or even ping the Center!

The interesting part is after a long time of research and trying so many ways, I couldn't still connect to Center, I've tried different versions of VCenter and ESX but the problem still existed.

So I check the Vswitch settings of my main ESX and after I enabled promiscuous mode for one of the main ESX Vswitch, the problem was solved!!

Can anyone explain why?! what am I missing?

0 + 0

security

virtualization

vmware-vcenter

vmware-vsphere

vswitch

Score:3

Server

Zac67

5/13/23, 1:19 PM

A vSwitch is different from a pSwitch in that it knows which MAC addresses are allowed to attach - MAC addresses that are spoofed by a guest or trying to use promicuous mode on the vNIC for packet capturing simply don't work.

In your case, the inner ESXi hands out MAC addresses to its guests on its own. The outer ESXi needs to allow promiscuous mode for the ESXi VM's vSwitch/port group for that to work.

In a nutshell, promiscuous mode allows a VM to use arbitrary MAC addresses and to listen to all traffic on the vSwitch (still depending on VLAN ID).

0 + 0

Afshin

5/14/23, 6:49 AM

thanks for your answer. So if I don't use nested ESX or capturing packet, there is no need to use promiscuous mode ? And in this scenario, the promiscuous mode wouldn't cause congestion or high load on the interfaces?

Zac67

5/14/23, 7:13 AM

There may be other reasons, but for normal guest use you don't need to allow promiscuous mode, it *is* required for the inner vSwitch to work though. No, it doesn't cause more load on the virtual and physical interfaces than necessary. (Allowing promiscuous mode and actually activating on the vNIC does cause unnecessary load when it's not required.)

Afshin

5/14/23, 1:15 PM

thanks for your time