This is the actual anti-spoofing decision for this MAC entry: whether frames leaving the associated vNIC with a source MAC other than this one are allowed through or dropped. It represents one specific MAC address that UCS Manager has learned or pinned on a particular vNIC/vHBA or adapter port, and it's the record UCS Manager checks before letting that interface send a frame with a different source MAC than the one assigned to it. A value of 'allow' lets that interface send traffic under a different source MAC (needed for nested hypervisors or clustering software that spoof MACs); 'deny' blocks it and is the setting that would explain a VM's traffic silently disappearing after it fails over to a backup MAC.