It is possible to change the Promiscuous mode settings via vRO on a port group.
This code snippet will change Promiscuous mode on a selected port group to enabled
var spec = new VcDVPortgroupConfigSpec(); spec.configVersion = counter; spec.defaultPortConfig = new VcVMwareDVSPortSetting(); spec.defaultPortConfig.securityPolicy = new VcDVSSecurityPolicy(); spec.defaultPortConfig.securityPolicy.inherited = false; spec.defaultPortConfig.securityPolicy.allowPromiscuous = new VcBoolPolicy(); spec.defaultPortConfig.securityPolicy.allowPromiscuous.inherited = false; spec.defaultPortConfig.securityPolicy.allowPromiscuous.value = true; selectedPortGroup.reconfigureDVPortgroup_Task(spec);
- the counter variable is a unique number from 0 onwards, each time you change the configuration you have to increment the spec.configVersion number otherwise vCenter thinks you are trying to continue a previous update
- the selectedPortGroup variable is the port group you want to make the change on, this is of type VC:DistributedVirtualPortgroup. If you want to find this programatically you will need some additional code, the methods listed in the Returned By section of this page will give you some ideas on how you could search for the port group(s) you want vRO API Explorer by Dr Ruurd and Flores of ITQ
To check if the value is set to true before changing it you can check the value of the following setting, if it is set to true then Promiscuous mode is already enabled.
Thank you for your reply this is good info to have. This info looks like it would work for changing the port group setting, but I was asking about changing this for a particular port ID. I want to have more fine grained control over the promiscuous setting. Rather than just allow it on the whole port group, I have the port group set to allow overrides for security settings, which allows me to set promiscuous mode per port on the switch. Please see my original screenshot to see this in the GUI.
Any advice on how to do this one level deeper for a specific port ID?
Hi darrenoid sorry about that, I must have misread the original post. To set it for an individual port you can do the following
var port = new Array(); port = new VcDVPortConfigSpec(); port.operation = "edit"; port.key = portName; port.setting = new VcVMwareDVSPortSetting(); port.setting.securityPolicy = new VcDVSSecurityPolicy(); port.setting.securityPolicy.inherited = false; port.setting.securityPolicy.allowPromiscuous = new VcBoolPolicy(); port.setting.securityPolicy.allowPromiscuous.inherited = false; port.setting.securityPolicy.allowPromiscuous.value = false; port.configVersion = counter; selectedVDS.reconfigureDVPort_Task(port);
where selectedVDS is the vDS the port belongs to and is of type VC:vmwareDistributedSwitch, counter is again a unique number from 0 upwards and portName is the name of the port as shown in vCenter as a string.
If you need to set the Allow override of port policies on the port group you can do this using code like this
var spec = new VcDVPortgroupConfigSpec(); spec.configVersion = counter; spec.policy.securityPolicyOverrideAllowed = true; selectedPortGroup.reconfigureDVPortgroup_Task(spec);
hope that helps.