Communication between the VMWare Host and VMWare Workstation Virtual Machine with bridged network adapter fails when Endpoint Security client E80.51 and above is installed

Support Center > Search Results > SecureKnowledge Details

Solution ID	sk104622
Product	Endpoint Security Client
Version	E80.51, E80.60, E80.61, E80.62, E80.64, E80.65, E80.70, E80.71, E80.72, E80.80, E80.81, E80.82, E80.83
OS	Windows
Platform / Model	Intel/PC
Date Created	02-Mar-2015
Last Modified	22-May-2018

Symptoms

Communication between the VMWare Host and VMWare Workstation Virtual Machine with bridged network adapter fails (in both directions) when Endpoint Security client E80.51 and above is installed either on the Host, or on the Virtual Machine.

Clarification about the topology:
- Host computer with VMWare Workstation installed
- Virtual Machine in VMWare Workstation with bridged network adapter
- Endpoint Security client is installed either on the Host, or on the Virtual Machine
This issue may also interrupt traffic capture by software such as WireShark without the presence of VMWare software.

Cause

Extensive tests in Check Point lab have shown that this issue is NOT caused by the Check Point software (issue is replicated even without Check Point software):

Install VMWare Workstation.
Install WireShark on the Host machine.
Enable the IPv4 checksum validation in the WireShark ('Edit' menu - 'Preferences...' - open 'Protocols' - click on 'IPv4' - check the box 'Validate the IPv4 checksum if possible' - click on 'Apply' - click on 'OK').
In WireShark, start traffic capture on the involved network adapter.
Ping the VM from the Host.
You will see that outgoing pings have checksum mismatch.

Starting in E80.51, Endpoint Security client performs improved "TCP Checksum Offload" check on the packets. If packet checksum is incorrect, then this packet will be blocked.

In this specific case, the packets that are being blocked due to checksum mismatch are sent on UDP port 5355, which is used by the Link-Local Multicast Name Resolution (LLMNR) protocol. This protocol is used for communication between the VMWare Host and VMWare Workstation Virtual Machine when packets go to two different adapters (one of VM, another for real machine) through the same wire.

Solution

Note: To view this solution you need to Sign In .