Q
Manage Learn to apply best practices and optimize your operations.

Network security features available in a virtual switch

Virtual switch security is achieved through a number of features. Virtualization admins can create and enforce policies, lock down MAC addresses and block forged traffic from VMs.

Virtual switches, such as those created by VMware platforms, provide a number of useful network security featu...

res.

Create and enforce policies

One of the network security features virtualization admins might not know about is that it's possible to employ policies with virtual switch ports. Where physical switch ports have no insight into the configuration of the physical network interface card ports attached to them, virtual switches can detect the configuration of virtual network ports connected to them. This makes it possible for administrators to create and enforce policies that help maintain a secure posture.

For example, a virtual switch can prevent a guest VM from changing its media access control (MAC) address -- a common sign of malicious activity.

The security policy for promiscuous mode is set at the virtual switch or the port group level.

Promiscuous mode for VMs is disabled by default. When enabled, promiscuous mode enables VMs to see all unicast network traffic traversing a virtual switch. Since this isn't desirable behavior from a security standpoint, promiscuous mode is disabled, so a VM only sees the data it is intended to see. The security policy for promiscuous mode is set at the virtual switch or the port group level.

Lock down MAC addresses

Another one of the valuable network security features associated with virtual switches is that MAC addresses are locked down. A MAC address represents the permanent physical identifier for every network device -- it's a bit like a physical home address.

VM networking explained

The difference between physical, virtual and virtual distributed switches; the difference between physical, virtual, uplink and group ports; how NIC teaming works in a VM network environment; and the best practices for configuring a VM network.

VMs are assigned MAC addresses as part of their network configuration, but MAC addresses can be changed fairly easily in VMs. Unfortunately, this is undesirable from a security perspective and can be a sign of malicious activity. Locking down the MAC address prevents this vulnerability.

Block forged traffic from VMs

Finally, virtual switches block forged traffic from VMs. Normally, a network device -- such as a virtual switch -- doesn't compare MAC addresses in IP packets with the MAC address of the sending device to make sure they match. This could enable malicious traffic to be sent using tactics such as MAC spoofing. When the virtual switch compares MAC addresses, it's able to block forged -- or spoofed -- traffic.

This was last published in February 2018

Dig Deeper on Network virtualization

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Join the conversation

1 comment

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

What additional network security features does your organization use?
Cancel

-ADS BY GOOGLE

SearchVMware

SearchWindowsServer

SearchCloudComputing

SearchVirtualDesktop

SearchDataCenter

Close