In a VMware ESXi server, WFilter can work both in "Pass-by" and "Pass-through" modes. For more details about these two modes, please check: WFilter deployment modes
The virtual switch connected to the WFilter virtual machine shall be configured to accept "Promiscuous Mode":
If you want to deploy WFilter to filter other virtual machines in pass-through mode, please check below steps.
To deploy WFilter in pass-through mode on a VMware ESXi server, following conditions are required:
As in below figure, the wfilter server "94-wfilter-server" is connected between "vSwitch0" and "vSwitch1". In this topology, all virtual computers in vSwitch1 will be monitored and filtered by the WFilter server "94-wfilter-server".
Please check below steps:
As in below figure, a new virtual switch with no physical adapter is created.
To bridge the virtual switches, two adapters of the WFilter server shall be connected to different virtual switches.
The virtual switches connected to the wfilter server shall be configured to accept "Promiscuous Mode".