STIGQter STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2024:

The vCenter Server must protect the confidentiality and integrity of transmitted information by isolating Internet Protocol (IP)-based storage traffic.

DISA Rule

SV-256359r885688_rule

Vulnerability Number

V-256359

Group Title

SRG-APP-000516

Rule Version

VCSA-70-000279

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configuration of an IP-based VMkernel will be unique to each environment.

To configure VLANs and traffic types, do the following:

Standard switch:

From the vSphere Client, select the ESXi host and go to Configure >> Networking >> VMkernel adapters.

Select the Storage VMkernel (for any IP-based storage). Click "Edit..." and click the "Port properties" tab.

Uncheck everything (unless vSAN).

Click the "IPv4" settings or "IPv6" settings tab.

Enter the appropriate IP address and subnet information.

Click "OK".

From the vSphere Client, select the ESXi host and go to Configure >> Networking >> Virtual switches. Select a standard switch.

For each storage port group (iSCSI, NFS, vSAN), select the port group and click "...". Click "Edit Settings". On the "Properties" tab, enter the appropriate VLAN ID and click "OK".

Distributed switch:

From the vSphere Client, go to "Networking".

Select a distributed switch >> Configure >> Settings >> Topology.

Select the Storage VMkernel (for any IP-based storage). Click "..." and click "Edit Settings".

On the "Port properties" tab, uncheck everything (unless vSAN).

Click the "IPv4" settings or "IPv6" settings tab.

Enter the appropriate IP address and subnet information.

Click "OK".

From the vSphere Client, go to Networking >> Select and expand a distributed switch.

For each storage port group (iSCSI, NFS, vSAN), select the port group and navigate to Configure >> Settings >> Properties.

Click "Edit".

Click the "VLAN" tab.

Enter the appropriate VLAN type and ID and click "OK".

Check Contents

If IP-based storage is not used, this is not applicable.

IP-based storage (iSCSI, NFS, vSAN) VMkernel port groups must be in a dedicated VLAN that can be on a standard or distributed virtual switch that is logically separated from other traffic types.

The check for this will be unique per environment.

To check a standard switch, from the vSphere Client, select the ESXi host and go to Configure >> Networking >> Virtual switches. Select a standard switch.

For each storage port group (iSCSI, NFS, vSAN), select the port group and note the VLAN ID associated with each port group.

Verify it is dedicated to that purpose and is logically separated from other traffic types.

To check a distributed switch, from the vSphere Client, go to "Networking" and select and expand a distributed switch.

For each storage port group (iSCSI, NFS, vSAN), select the port group and navigate to the "Summary" tab.

Note the VLAN ID associated with each port group and verify it is dedicated to that purpose and is logically separated from other traffic types.

If any IP-based storage networks are not isolated from other traffic types, this is a finding.

Vulnerability Number

V-256359

Documentable

False

Rule Version

VCSA-70-000279

Severity Override Guidance

If IP-based storage is not used, this is not applicable.

IP-based storage (iSCSI, NFS, vSAN) VMkernel port groups must be in a dedicated VLAN that can be on a standard or distributed virtual switch that is logically separated from other traffic types.

The check for this will be unique per environment.

To check a standard switch, from the vSphere Client, select the ESXi host and go to Configure >> Networking >> Virtual switches. Select a standard switch.

For each storage port group (iSCSI, NFS, vSAN), select the port group and note the VLAN ID associated with each port group.

Verify it is dedicated to that purpose and is logically separated from other traffic types.

To check a distributed switch, from the vSphere Client, go to "Networking" and select and expand a distributed switch.

For each storage port group (iSCSI, NFS, vSAN), select the port group and navigate to the "Summary" tab.

Note the VLAN ID associated with each port group and verify it is dedicated to that purpose and is logically separated from other traffic types.

If any IP-based storage networks are not isolated from other traffic types, this is a finding.

Check Content Reference

M

Target Key

5517