Short answer: VMware Fusion asks for your macOS administrator password when a VM’s network adapter tries to enter promiscuous mode, and a nested ESXi VM does that on every boot. To stop the prompt, create the file /Library/Preferences/VMware Fusion/promiscAuthorized with sudo touch and restart Fusion. You can also add ethernetX.promptForPromisc = "FALSE" to the VM’s .vmx. Both are undocumented tweaks for a lab Mac, not a supported configuration.
Why Fusion prompts about network traffic monitoring
An adapter in promiscuous mode receives every frame on the virtual network, not only frames addressed to its own MAC. Broadcom’s promiscuous mode documentation calls this an insecure mode, because a root user in the guest can see traffic meant for other VMs or the host. For that reason Fusion Pro can require confirmation before an adapter switches to promiscuous mode. The Fusion Pro custom networks documentation describes this confirmation.
Nested ESXi needs promiscuous mode. Its virtual switch forwards frames for the MAC addresses of the inner VMs and VMkernel ports, and those MACs differ from the MAC of the outer VM’s adapter. Without promiscuous mode on the Fusion side, inner VMs have no network. So the prompt appears every time you power on a nested ESXi host, which gets tedious when you start a multi-host lab.
Option 1: authorize promiscuous mode for all VMs on the Mac
Create an empty marker file in Fusion’s global preferences folder, then quit and restart Fusion:
sudo touch "/Library/Preferences/VMware Fusion/promiscAuthorized"This is host-wide. Any VM on this Mac can then enter promiscuous mode without asking. To undo it, delete the file and restart Fusion:
sudo rm "/Library/Preferences/VMware Fusion/promiscAuthorized"In Fusion Pro you can check the same behaviour in Settings > Network. Unlock the pane with your admin password and look for the option that requires authentication for promiscuous mode. The exact wording differs between Fusion releases.
Option 2: suppress the prompt for one VM
With the VM powered off, open its bundle in Finder (right-click the .vmwarevm > Show Package Contents), edit the .vmx file, and add one line per adapter that needs it:
ethernet0.promptForPromisc = "FALSE"
ethernet1.promptForPromisc = "FALSE"William Lam, who documented this (linked below), notes that the VMX setting alone is not enough for inner-VM networking. You still need the promiscAuthorized file from Option 1. In practice, Option 1 is what makes nested ESXi networking work without the prompt, and Option 2 is an extra per-VM switch.
Security and support notes
- Neither the
promiscAuthorizedfile norpromptForPromiscappears in Broadcom’s Fusion documentation. Treat both as unsupported tweaks that can change in any Fusion release. - Use them on a dedicated lab Mac. With the prompt gone, any VM, including an untrusted one, can sniff traffic on the shared vmnet networks without you noticing.
- On the nested ESXi side, keep the vSwitch security settings that your lab design needs. The Fusion prompt only controls the outer, host-level adapter.
For a nested lab design that benefits from this, see Deploying a minimal VCF 9.0 lab.
Further reading
- William Lam: Quick Tip – Disable network traffic monitoring (promiscuous) UI prompt in VMware Fusion (original post)
- Broadcom TechDocs: Fusion Pro: Creating Custom Networks
- Broadcom TechDocs: Promiscuous Mode Operation
