Limits of VLAN ID 0 and Promiscuous Mode Settings on vSphere Distributed Switch Port Groups for Preventing Public Exposure

Goal: Ensure that virtual machines connected to a vSphere Distributed Switch port group cannot reach the public Internet through an uplink that is attached to a physical network without VLAN segmentation.

Constraints: The port group may be left with VLAN ID 0 (untagged), which passes traffic unchanged; its security policies for Promiscuous Mode, MAC Address Changes, and Forged Transmits default to Reject but can be overridden; and the Teaming and Failover configuration can bind active uplinks to physical NICs that face an untrusted zone.

Uncertainty: It is unclear whether relying on the default Reject settings and physical switch isolation is sufficient, or whether explicit VLAN tagging and stricter policy enforcement are required to guarantee isolation in converged data‑center designs.

Is it sufficient to leave the port group VLAN ID at 0 when the uplink connects to a production network that lacks VLAN segmentation? Should the Promiscuous Mode and Forged Transmits policies remain at their default Reject state even in environments that require legacy monitoring tools? Does binding an active uplink to a physical NIC that faces an untrusted zone create a bridging path that bypasses the port group's security policies?