The security policies behave the same on both switch types. The vSphere Distributed Switch allows for an additional level of granularity by making the same settings configurable at the dvPort level. For this to work, the dvPortGroup should be configured to allow dvPort level policy overrides. With a vSphere Standard Switch, security settings can only be applied at the port group level.

There are three security settings that can be either set to Accept/Reject:

• Promiscuous mode
• MAC address changes
• Forged transmits

All three settings are set to Reject by default and we will learn why.