Details
If using VLAN tagging on a dvPortgroup, tags must correspond to the IDs on external VLAN-aware upstream switches if any. If VLAN IDs are not tracked completely, mistaken re-use of IDs could allow for traffic to be allowed between inappropriate physical and virtual machines. Similarly, wrong or missing VLAN IDs may lead to traffic not passing between appropriate physical and virtual machines.
NOTE: Please review the benchmark to ensure target compliance.
Solution
From the vSphere Client log into vCS. Home >> Inventory >> Networking. Select dvSwitch and dvPortgroup and Edit Settings >> Policies >> VLAN >> VLAN ID. Record all VLAN IDs in an organization defined tracking system.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.
References
- 800-53|CM-6b.
- CAT|III
- CCI|CCI-000366
- Group-ID|V-39356
- Rule-ID|SV-250543r798628_rule
- STIG-ID|ESXI5-VMNET-000001
- STIG-Legacy|SV-51214
- STIG-Legacy|V-39356
- Vuln-ID|V-250543
Comments
Please sign in to leave a comment.