ESXI5-VMNET-000002 - All dvSwitch Private VLAN IDs must be fully documented.


dvSwitch Private VLANs (PVLANs) require primary and secondary VLAN IDs. The IDs must correspond to the IDs on external PVLAN-aware upstream switches, if any. If VLAN IDs are not tracked completely, mistaken re-use of IDs could allow for traffic to be allowed between inappropriate physical and virtual machines. Similarly, wrong or missing PVLAN IDs may lead to traffic not passing between appropriate physical and virtual machines.

NOTE: Please review the benchmark to ensure target compliance.


From the vSphere Client connect to the vCenter Server and as administrator go to 'Home>> Inventory>> Hosts and Clusters'. Select each ESXi host with virtual switches connected to active VMs requiring securing. Go to 'Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> [Portgroup Name]>> VLAN ID'. Record all configured VLAN IDs in an organization defined tracking system.

Supportive Information

The following resource is also helpful.

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.