STIGQter STIGQter: STIG Summary: VMware vSphere 7.0 ESXi Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 02 Apr 2025:

The ESXi host must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.

DISA Rule

SV-256413r958908_rule

Vulnerability Number

V-256413

Group Title

SRG-OS-000423-VMM-001700

Rule Version

ESXI-70-000050

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configuration of an IP-based VMkernel will be unique to each environment.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> Networking >> VMkernel adapters.

Select the VMkernel used for IP-based storage and click "Edit...". On the "Port" properties tab, uncheck all services. Click "OK".

Note: For VMkernels used for vSAN, leave the vSAN service enabled and uncheck all others.

From the vSphere Client, go to Hosts and Clusters >> select the ESXi Host >> Configure >> Networking >> Virtual switches.

Find the port group that is dedicated to IP-based storage and click the "..." button next to the name. Click "Edit Settings".

On the "Properties" tab, change the "VLAN ID" to one dedicated for IP-based storage traffic. Click "OK".

Check Contents

If IP-based storage is not used, this is not applicable.

From the vSphere Client, select the ESXi host and go to Configure >> Networking >> VMkernel adapters.

Select each IP-based storage VMkernel adapter and view the enabled services.

If any services are enabled on an NFS or iSCSI IP-based storage VMkernel adapter, this is a finding.

If any services are enabled on a vSAN VMkernel adapter other than vSAN, this is a finding.

From the vSphere Client, select the ESXi host and go to Configure >> Networking >> VMkernel adapters.

Review the VLANs associated with any IP-based storage VMkernels and verify they are dedicated for that purpose and are logically separated from other functions.

If any IP-based storage networks are not isolated from other traffic types, this is a finding.

Vulnerability Number

V-256413

Documentable

False

Rule Version

ESXI-70-000050

Severity Override Guidance

If IP-based storage is not used, this is not applicable.

From the vSphere Client, select the ESXi host and go to Configure >> Networking >> VMkernel adapters.

Select each IP-based storage VMkernel adapter and view the enabled services.

If any services are enabled on an NFS or iSCSI IP-based storage VMkernel adapter, this is a finding.

If any services are enabled on a vSAN VMkernel adapter other than vSAN, this is a finding.

From the vSphere Client, select the ESXi host and go to Configure >> Networking >> VMkernel adapters.

Review the VLANs associated with any IP-based storage VMkernels and verify they are dedicated for that purpose and are logically separated from other functions.

If any IP-based storage networks are not isolated from other traffic types, this is a finding.

Check Content Reference

M

Target Key

5518