This controls whether this virtual circuit permits frames with a source MAC address different from the vNIC's assigned MAC, i.e., forged transmit, to pass - a dynamic port-security setting. An admin needs this allowed for use cases like NLB clustering or nested hypervisors that legitimately send frames with different source MACs than the vNIC's assigned address, but would want it denied by default to prevent MAC spoofing on a compromised VM. A value of 'allow' here would be necessary to support a Windows NLB cluster running on this vNIC, whereas deny is the safer default for a typical single-purpose server.