Note to self: also according to this post, there is a kind of bug in ESXi when a linux bridge interface is made with a vNIC than resides in a vSwitch with more than one uplink. The second uplink replays some of the arp broadcast back to the bridge interface in a weird way confusing the arp table: this stops some protocol from traversing the bridge from outside the ESXi inbound.
Workaround: set the aging time to 0. This turns the bridge into a kind of "hub" mode where all the broadcast traffic is replayed to all the promisquous interfaces regardless of the arp table.
In my case, it was stopping dhcp from a phisical dhcp server and later ping replies from VM's in another vSwitch