STIGQter: STIG Summary: VMware NSX-T Manager NDM Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 26 Jul 2023:

The NSX-T Manager must be configured to protect against known types of denial-of-service (DoS) attacks by employing organization-defined security safeguards.

DISA Rule

SV-251785r879806_rule

Vulnerability Number

V-251785

Group Title

SRG-APP-000435-NDM-000315

Rule Version

TNDM-3X-000080

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

From an NSX-T Manager shell, run the following command(s):

> set service http client-api-rate-limit 100
> set service http client-api-concurrency-limit 40
> set service http global-api-concurrency-limit 199

Check Contents

From an NSX-T Manager shell, run the following command(s):

> get service http | find limit

Expected result:
Client API rate limit: 100 requests/sec
Client API concurrency limit: 40 connections
Global API concurrency limit: 199 connections

If the output does not match the expected result, this is a finding.

Vulnerability Number

V-251785

Documentable

False

Rule Version

TNDM-3X-000080

Severity Override Guidance

From an NSX-T Manager shell, run the following command(s):

> get service http | find limit

Expected result:
Client API rate limit: 100 requests/sec
Client API concurrency limit: 40 connections
Global API concurrency limit: 199 connections

If the output does not match the expected result, this is a finding.

Check Content Reference

M

Target Key

5449