VM series promiscuous issue?

Not applicable

VM series promiscuous issue?


Just messing about with a VM-100 and three other VM's on vSphere 5.5...All setup for layer 3.

Ubuntu1 <> VM100 <> Vyatta <> Ubuntu2

Three vSwitches, promiscuous mode on reject

Ubuntu1 to VM100 10.x.x.x/24 network

VM100 to Vyatta 172.16.x.x/24 network

Vyatta to Ubuntu2 192.168.x.x/24 network

Policy all setup, default routes on all four VM's pointing in the right directions.

I can't ping from one ubuntu to the other ubuntu.  My pings only go as far as the closest router.

The problem area seems to be the vSwitch between the VM100 and Vyatta, this vSwitch is the only one without a physical NIC bound to it.

I have seen the tech note about disabling promiscuous mode for L3 so I may try that tomorrow.

Any other ideas?



L4 Transporter

Hi Richard,

Yes, you need to enable promiscuous mode on the vSwitches. Change it from Reject to Accept.



L3 Networker

Hello Richard,

If the firewall is deployed in layer 3 mode, make sure the VM NIC settings in firewall VM matches to the firewall determined interface Mac address . You will have to shutdown the firewall VM in vsphere and manually edit the MAC address for each vmNIC in vSphere to match what is assigned on the VM-Series firewall

If you are deploying the VM-Series firewall using layer 2, virtual wire, or tap interfaces you must enable promiscuous mode on the port group of the virtual switch to which the data interfaces on the firewall are attached. If promiscuous mode is not enabled, the firewall will not receive any traffic because the destination MAC addresses assigned by PAN-OS will be different from the vmNIC MAC addresses assigned by vSphere.

L4 Transporter


The VM-Series Deployment Guide provides an alternative to enabling promiscuous mode for layer3 deployments.

VM-Series Deployment Guide 6.0 (English)

Virtualization_Admin_Guide_6.0 page 11(section Requirements):

"If you are deploying the VM-Series firewall using layer 3 interfaces, you can instead set the vmNIC MAC

address to match the PAN-OS MAC address by manually editing the MAC address for each vmNIC in

vSphere to match what is assigned on the VM-Series firewall. This change must be done while the VM-Series

is powered off; it allows the firewall to receive frames that are meant for it."



Not applicable

Thanks everyone, working with the changes suggested here:


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!