STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).

DISA Rule

SV-258922r934424_rule

Vulnerability Number

V-258922

Group Title

SRG-APP-000247

Rule Version

VCSA-80-000110

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

From the vSphere Client, go to Networking.

Select a distributed switch >> Configure >> Settings >> Properties.

In the "Properties" pane, click "Edit". Change "Network I/O Control" to "Enabled". Click "OK".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

(Get-VDSwitch "VDSwitch Name" | Get-View).EnableNetworkResourceManagement($true)

Check Contents

If distributed switches are not used, this is not applicable.

From the vSphere Client, go to Networking.

Select a distributed switch >> Configure >> Settings >> Properties.

View the "Properties" pane and verify "Network I/O Control" is "Enabled".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-VDSwitch | select Name,@{N="NIOC Enabled";E={$_.ExtensionData.config.NetworkResourceManagementEnabled}}

If "Network I/O Control" is disabled, this is a finding.

Vulnerability Number

V-258922

Documentable

False

Rule Version

VCSA-80-000110

Severity Override Guidance

If distributed switches are not used, this is not applicable.

From the vSphere Client, go to Networking.

Select a distributed switch >> Configure >> Settings >> Properties.

View the "Properties" pane and verify "Network I/O Control" is "Enabled".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-VDSwitch | select Name,@{N="NIOC Enabled";E={$_.ExtensionData.config.NetworkResourceManagementEnabled}}

If "Network I/O Control" is disabled, this is a finding.

Check Content Reference

M

Target Key

5573