Information
Enable BPDU filter on the ESXi host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.
BPDU Guard and Portfast are commonly enabled on the physical switch to which the ESXi host is directly connected to reduce the STP convergence delay. If a BPDU packet is sent from a virtual machine on the ESXi host to the physical switch so configured, a cascading lockout of all the uplink interfaces from the ESXi host can occur. To prevent this type of lockout, BPDU Filter can be enabled on the ESXi host to drop any BPDU packets being sent to the physical switch. The caveat is that certain SSL VPN which use Windows bridging capability can legitimately generate BPDU packets. The administrator should verify that there are no legitimate BPDU packets generated by virtual machines on the ESXi host prior to enabling BPDU Filter. If BPDU Filter is enabled in this situation, enabling Reject Forged Transmits on the virtual switch port group adds protection against Spanning Tree loops.
http://kb.vmware.com/kb/2017193
http://kb.vmware.com/kb/2047822
http://pubs.vmware.com/vsphere-65/topic/com.vmware.vsphere.security.doc/GUID-FA661AE0-C0B5-4522-951D-A3790DBE70B4.html
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
From vSphere Web cClient, select the host and then click "Manage" -> "Settings" -> "System" -> "Advanced System settings". Filter for Net.BlockGuestBPDU to see the configured value. Click edit and set it to the desired value.