STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2024:

The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).

DISA Rule

SV-256336r885619_rule

Vulnerability Number

V-256336

Group Title

SRG-APP-000247

Rule Version

VCSA-70-000110

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

From the vSphere Client, go to Networking.

Select a distributed switch >> Configure >> Settings >> Properties.

In the "Properties" pane, click "Edit". Change "Network I/O Control" to "Enabled". Click "OK".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

(Get-VDSwitch "VDSwitch Name" | Get-View).EnableNetworkResourceManagement($true)

Check Contents

If distributed switches are not used, this is not applicable.

From the vSphere Client, go to Networking.

Select a distributed switch >> Configure >> Settings >> Properties.

View the "Properties" pane and verify "Network I/O Control" is "Enabled".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-VDSwitch | select Name,@{N="NIOC Enabled";E={$_.ExtensionData.config.NetworkResourceManagementEnabled}}

If "Network I/O Control" is disabled, this is a finding.

Vulnerability Number

V-256336

Documentable

False

Rule Version

VCSA-70-000110

Severity Override Guidance

If distributed switches are not used, this is not applicable.

From the vSphere Client, go to Networking.

Select a distributed switch >> Configure >> Settings >> Properties.

View the "Properties" pane and verify "Network I/O Control" is "Enabled".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-VDSwitch | select Name,@{N="NIOC Enabled";E={$_.ExtensionData.config.NetworkResourceManagementEnabled}}

If "Network I/O Control" is disabled, this is a finding.

Check Content Reference

M

Target Key

5517