Limits of VLAN ID 0 and Promiscuous Mode Settings on vSphere Distributed Switch Port Groups for Preventing Public Exposure
Goal: Ensure that virtual machines connected to a vSphere Distributed Switch port group cannot reach the public Internet through an uplink that is attached to a physical network without VLAN segmentation. Constraints: The port group may be left with VLAN ID 0 (untagged), which passes traffic unchanged; its security policies for Promiscuous Mode, MAC Address
vsphere