Bumping this thread because I just ran into this and still don't entirely understand why promiscuous mode is needed.
I read about it in the Cisco Virtual WLC Deployment Guide and thought I didn't need it (and was unsure of the impact since the guide implies configuring it on the entire vSwitch instead of just a new port-group).. .therefore ignored that part.
Promiscuous mode is a security policy which can be defined at the virtual switch or portgroup level in vSphere ESX/ESXi. A virtual machine, Service Console, or VMkernel network interface in a portgroup which allows the use of promiscuous mode can see all network traffic traversing the virtual switch.
By default, a guest operating system's virtual network adapter only receives frames that are meant for it. Placing the guest's network adapter in promiscuous mode causes it to receive all frames passed on the virtual switch that are allowed under the VLAN policy for the associated portgroup. This can be useful for intrusion detection monitoring or if a sniffer needs to analyze all traffic on the network segment.
The vWLC Data Port requires the assigned vSwitch to accept Promiscuous mode for proper operations.
So without promiscuous mode configured, I could ping and login just fine to the mgmt interface. So ARP and therefore broadcasts must be making it through to the WLC. But the AP's wouldn't join the vWLC. Debugs on the vWLC showed discovery requests received from the AP's, then discovery responses going back out to the AP, but the vWLC would never see a join from the AP. Indeed, enabling promiscuous mode fixes everything.
So a few questions:
q1. Why would ARP and therefore broadcasts work without promiscuous mode enabled, yet not AP Joins? Aren't joins just broadcasts? (in my case the AP and vWLC are in the same subnet/vlan). If I put wireshark on any existing VM I have (not using promiscuous mode) of course I see broadcasts, multicasts, etc. What is so special about a join?
q2. I'm also trying to understand vmware's definition of what Promiscuous mode = "accept" means. If I have 100 VM's hanging off a vswitch, does "accept" mean (1) "only if a VM requests promiscuous mode, send that 1 VM everything" or (2) "send everything through that vSwitch to all 100VM's"
(1) would be what I hope would happen
(2) would be what I'm afraid would happen — and is more like port mirroring (and really suck if we don't have enough physical ports to make a new vSwitch)
q3. Depending on the answer to q2, I would imagine most people aren't really going to add an entirely new vSwitch for wireless. So is adding a new portgroup to an existing vSwitch the better way to go (even if the vlan is the same as an existing portgroup in the existing vSwitch)? And then just making that new portgroup accept promiscuous mode instead of the entire existing vSwitch?
Thoughts?
