The disclosure relates to a method and apparatus for detecting and blocking unauthorized MAC addresses used by virtual machines. In one embodiment, the disclosure provides automated and consistent verification of VM traffic against values assigned to each VM by network administrator. In another embodiment, the disclosure provides for validating a newly discovered VM by comparing its attributes with the corresponding description of the known VMs stored at a database. A re-validation check may also be implemented. If the VM is validated, the VM will be processed according to network policy to support features including VMReady. If the VM fails validation, other actions can be taken.