Month: July 2024

How to Disable the Promiscuous Mode (Network Traffic Monitoring) Prompt in VMware Fusion for Nested ESXi

Stop VMware Fusion asking for your password when nested ESXi enables promiscuous mode: promiscAuthorized file and promptForPromisc. Lab tweak.

Short answer: VMware Fusion asks for your macOS administrator password when a VM’s network adapter tries to enter promiscuous mode, and a nested ESXi VM does that on every boot. To stop the prompt, create the file /Library/Preferences/VMware Fusion/promiscAuthorized with sudo touch and restart Fusion. You can also add ethernetX.promptForPromisc = "FALSE" to the VM’s .vmx. Both are undocumented tweaks for a lab Mac, not a supported configuration.

Why Fusion prompts about network traffic monitoring

An adapter in promiscuous mode receives every frame on the virtual network, not only frames addressed to its own MAC. Broadcom’s promiscuous mode documentation calls this an insecure mode, because a root user in the guest can see traffic meant for other VMs or the host. For that reason Fusion Pro can require confirmation before an adapter switches to promiscuous mode. The Fusion Pro custom networks documentation describes this confirmation.

Nested ESXi needs promiscuous mode. Its virtual switch forwards frames for the MAC addresses of the inner VMs and VMkernel ports, and those MACs differ from the MAC of the outer VM’s adapter. Without promiscuous mode on the Fusion side, inner VMs have no network. So the prompt appears every time you power on a nested ESXi host, which gets tedious when you start a multi-host lab.

Option 1: authorize promiscuous mode for all VMs on the Mac

Create an empty marker file in Fusion’s global preferences folder, then quit and restart Fusion:

sudo touch "/Library/Preferences/VMware Fusion/promiscAuthorized"

This is host-wide. Any VM on this Mac can then enter promiscuous mode without asking. To undo it, delete the file and restart Fusion:

sudo rm "/Library/Preferences/VMware Fusion/promiscAuthorized"

In Fusion Pro you can check the same behaviour in Settings > Network. Unlock the pane with your admin password and look for the option that requires authentication for promiscuous mode. The exact wording differs between Fusion releases.

Option 2: suppress the prompt for one VM

With the VM powered off, open its bundle in Finder (right-click the .vmwarevm > Show Package Contents), edit the .vmx file, and add one line per adapter that needs it:

ethernet0.promptForPromisc = "FALSE"
ethernet1.promptForPromisc = "FALSE"

William Lam, who documented this (linked below), notes that the VMX setting alone is not enough for inner-VM networking. You still need the promiscAuthorized file from Option 1. In practice, Option 1 is what makes nested ESXi networking work without the prompt, and Option 2 is an extra per-VM switch.

Security and support notes

  • Neither the promiscAuthorized file nor promptForPromisc appears in Broadcom’s Fusion documentation. Treat both as unsupported tweaks that can change in any Fusion release.
  • Use them on a dedicated lab Mac. With the prompt gone, any VM, including an untrusted one, can sniff traffic on the shared vmnet networks without you noticing.
  • On the nested ESXi side, keep the vSwitch security settings that your lab design needs. The Fusion prompt only controls the outer, host-level adapter.

For a nested lab design that benefits from this, see Deploying a minimal VCF 9.0 lab.

Further reading

Useful vSphere Automation techniques for…

Useful vSphere Automation techniques for assisting with CrowdStrike remediation

Useful vSphere Automation techniques for…

By now, you have probably heard about or have directly been impacted by the recent CrowdStrike software update to Microsoft Windows system causing an unprecedented global outage. I know IT administrators are working around the clock to remediate thousands if not tens of thousands of Windows systems, the current recommended remediation process from CrowdStrike is […]

Broadcom Social Media Advocacy

Don’t Miss Early-Bird Pricing for VMware Explore 2024 Barcelona Until July 29!

VMware Explore 2024 Barcelona early-bird pricing ran until July 29, 2024. What the event offered and why it was worth attending.

Are you ready to dive into the future of technology? VMware Explore 2024 EU is just around the corner, and you won’t want to miss this incredible opportunity. From cutting-edge innovations to industry-leading experts, this event promises to be a highlight for IT professionals, developers, and tech enthusiasts alike.

The best part? Early-bird pricing is available until July 29! By registering now, you can take advantage of significant savings and secure your spot at one of the most anticipated tech events of the year.

What to Expect at VMware Explore 2024 EU:

  • Innovative Sessions: Learn from the best in the industry through a variety of sessions that cover the latest trends and technologies. What is new in vSphere/VSAN 8U3.
  • Hands-On Workshops: Gain practical experience with hands-on labs and workshops designed to enhance your skills VSAN, VCF, VVols.
  • Networking Opportunities: Connect with peers, industry leaders, and VMware experts to share knowledge and expand your professional network.
  • Exclusive Insights: Get a first look at new products and solutions that will shape the future of IT.

Don’t wait – register today and take advantage of early-bird pricing before it’s too late. Secure your place at VMware Explore 2024 EU and be part of the conversation that drives innovation forward.

Mark your calendar and get ready to explore the future with VMware!

VMware Explore Registration Barcelona | VMware Explore | 4 – 7 Nov. 2024

VMware NVMeoF Virtual Volumes (vVols) on Pure…

VMware NVMeoF Virtual Volumes (vVols) on Pure…

Business Critical Oracle Workloads have stringent IO requirements and enabling, sustaining, and ensuring the highest possible performance along with continued application availability is a major goal for all mission critical Oracle applications to meet the demanding business SLAs on VMware […]

Broadcom Social Media Advocacy