VMware ESXi

Configuring the virtual switch provided with VMware ESXi for monitoring uses a port group set for promiscuous mode. Only attach VMs to this port group that will be used to monitor the traffic. Any VM using this port group has the ability to monitor all traffic.

These steps apply to VMware ESXi 8 and use the VMware Host Client.

Configure the ESXi Host

Perform the following steps in the VMware Host Client.

  1. Log in to the VMware Host Client for the ESXi host.
  2. In the Navigator pane, click Networking.
  3. Click the Port groups tab.
  4. Click Add port group.
  5. In the Name box, type a descriptive name for the new port group.
  6. In the VLAN ID box, type a VLAN ID, if desired. Setting the VLAN ID to 4095 uses the special VMware VLAN to monitor all other VLANs.
  7. From the Virtual switch drop-down box, select the virtual switch for the port group.
  8. Expand the Security section.
  9. Set Promiscuous mode to Accept.
  10. Click Add.

Configure the Tenable Network Monitor VM

Perform the following steps in the VMware Host Client. For further guidance on configuring Tenable Network Monitor, see the Tenable Network Monitor User Guide.

  1. In the Navigator pane, click Virtual Machines, and then select the Tenable Network Monitor VM.
  2. Click Actions > Edit settings.
  3. On the Virtual Hardware tab, from the Network Adapter drop-down box, select the port group you created.
  4. Click Save.
  5. Start the Tenable Network Monitor VM and configure Tenable Network Monitor to use the promiscuous network adapter for monitoring.
  6. Start (or restart) the Tenable Network Monitor service with the new settings. Network traffic on the virtual switch is now collected by Tenable Network Monitor.