STIGQter: STIG Summary: VMware NSX-T Manager NDM Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 26 Jul 2023:

The NSX-T Manager must integrate with either VMware Identity Manager (vIDM) or VMware Workspace ONE Access.

DISA Rule

SV-251789r916111_rule

Vulnerability Number

V-251789

Group Title

SRG-APP-000516-NDM-000336

Rule Version

TNDM-3X-000092

Severity

CAT I

CCI(s)

• CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-000366 - Implement the security configuration settings.
• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.

Weight

10

Fix Recommendation

To configure NSX-T to integrate with VMware Identity Manager or Workspace ONE Access as the authentication source, do the following:

From the NSX-T Manager web interface, go to System >> Users and Roles >> VMware Identity Manager and click "Edit".

If using an external load balancer for the NSX-T Management cluster, enable "External Load Balancer Integration". If using a cluster VIP, leave this disabled.

Click the toggle button to enable "VMware Identity Manager Integration".

Enter the VMware Identity Manager or Workspace ONE Access appliance name, OAuth Client ID, OAuth Client Secret, and certificate thumbprint as provided by the administrators.

Enter the NSX Appliance FQDN. For a cluster, enter the load balancer FQDN or cluster VIP FQDN.

Click "Save", import users and groups, and then assign them roles.

Ensure the VMware Identity Manager administrators have configured the certificate authentication adapter to provide two-factor authentication.

Check Contents

From the NSX-T Manager web interface, go to System >> Users and Roles >> VMware Identity Manager.

If the VMware Identity Manager integration is not enabled, this is a finding.

If the user is not redirected to VMware Identity Manager or Workspace ONE Access when attempting to log in to the NSX-T Manager web interface and prompted to select a certificate and enter a PIN, this is a finding.

Vulnerability Number

V-251789

Documentable

False

Rule Version

TNDM-3X-000092

Severity Override Guidance

From the NSX-T Manager web interface, go to System >> Users and Roles >> VMware Identity Manager.

If the VMware Identity Manager integration is not enabled, this is a finding.

If the user is not redirected to VMware Identity Manager or Workspace ONE Access when attempting to log in to the NSX-T Manager web interface and prompted to select a certificate and enter a PIN, this is a finding.

Check Content Reference

M

Target Key

5449