Replicating vSwitch NIC status to a NGFW VM (ESXi)

[Josh_Levine]

Greetings all,

I wanted to see if anyone has successfully replicated the status of a host NIC attached to a vSwitch to a Palo Alto NGFW VM in ESXi 8? 

Right now, all ports always remain up because the virtual switch they are attached to remain up. It seems like this should be a trivial configuration, but I can't figure it out for the life of me. 

[lisa52smith]

It sounds like you're trying to get the Palo Alto NGFW VM to reflect the true status of the physical NICs on your ESXi host, which can be a bit tricky. Here are a few steps you can try:

Promiscuous Mode: Ensure that Promiscuous Mode is enabled on the vSwitch. This allows the VM to see all network traffic.

MAC Address Changes: Enable MAC Address Changes on the vSwitch. This allows the VM to change its MAC address, which is often necessary for proper operation.

Forged Transmits: Enable Forged Transmits on the vSwitch. This allows the VM to send packets with a different source MAC address than its own.

Direct NIC Assignment: Assign the physical NICs directly to the VM-Series Firewall instead of using a vSwitch. This might help in reflecting the true status of the NICs.

[Josh_Levine · Accepted solution]

Thanks for the response, Lisa! 

I actually just managed to get it working. I think the issue I was running into was due to the specific ESXi compatibility level set on the OVA out of the box. I upgraded the hardware compatibility on the OVA to ESXi 8.0, and now the interface status replicates properly when the NIC is in passthrough mode.