Security policies
The default rule ladder per fabric type, and where your own rules sit in it.
Security policy is enforced in the virtual switching layer, on every host, at the port a VM is attached to. Traffic is filtered before it reaches another VM — there is no appliance to route through.
Defaults depend on the fabric type
The platform installs a default posture described as “maximum for its type”, and the phrasing is deliberate: it does not claim to enforce what it cannot see.
A VLAN fabric
North-south traffic in a VLAN fabric never passes anything the platform controls — it goes straight out to your switches, and your firewall is the policy point.
So a VLAN fabric gets anti-spoofing and established-connection handling, and no default drop. A default-deny here would create a false sense of security: the platform cannot enforce policy on traffic that does not traverse it.
An overlay fabric
An overlay fabric routes through the platform, so it gets the full ladder, including default-deny.
The ladder
Rules are evaluated by priority, highest first:
| Priority | Rule | Applies to |
|---|---|---|
| 2000 | Allow established and related replies | Both |
| 1900 | Allow DHCP from the platform to guests | Both |
| 1850 | Allow DHCP from guests to the platform | Both |
| 1800 | Anti-spoofing | Both |
| 1000 | Your rules | Both |
| 500 | Allow egress | Overlay only |
| 400 | Allow east-west within the network | Overlay only |
| 100 | Default drop | Overlay only |
Two things about this ordering matter:
Established replies sit above the drop. Without that, a guest could send a request and the answer would be discarded — connections would appear to hang rather than fail, which is worse.
DHCP from guests sits above anti-spoofing. A guest asking for an address does not have one yet, so its request looks exactly like spoofing. Ordering these the other way breaks address assignment for every new VM.
These are the rules that make a default drop survivable. They are why the posture can be on at all rather than switched off to get a working network.
Your rules
Your rules go in at priority 1000 — above the defaults that permit things, below the ones that keep the fabric functional.
A rule specifies direction, addresses, protocol and ports, and whether to allow or drop.
Because the defaults below yours include the default drop, in an overlay fabric you are writing an allow-list: anything you do not permit is denied. In a VLAN fabric you are writing exceptions, and the real policy is on your firewall.
The defaults are read-only
Default rules are marked as generated by the system and shown read-only, controlled by a single per-fabric toggle rather than being individually editable.
That is a considered choice. Defaults that can be edited rule by rule get edited until they no longer work, and the feature then gets switched off wholesale — which is how you end up with no policy at all.
Turn the posture off for a fabric if you must. Do not dismantle it one rule at a time.
Anti-spoofing
Anti-spoofing at priority 1800 is defence in depth over port-level address security, which already restricts a port to its assigned addresses. The rule exists because two independent mechanisms fail independently.
A VM that has been given an address by the platform and tries to send from another one is dropped. This is worth knowing if you run something that legitimately sends from addresses it was not assigned — a router in a VM, or a NAT gateway. Such a workload needs explicit rules, or port security relaxed.
What this is not
Security policy filters traffic between and into VMs. It is not:
- a replacement for your perimeter firewall,
- a filter on host management traffic,
- inspection above layer 4.
Checking
A guest that cannot reach something is usually one of:
| Symptom | Likely cause |
|---|---|
| Nothing works, guest has no address | DHCP blocked — check the ladder is intact |
| Guest reaches its own network, nothing else | Overlay default drop with no matching allow rule |
| Connections hang rather than refuse | Established replies not permitted |
| Some sources work, others do not | Anti-spoofing dropping a workload sending from unassigned addresses |