STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter Server must not override port group settings at the port level on distributed switches.

DISA Rule

SV-258966r934556_rule

Vulnerability Number

V-258966

Group Title

SRG-APP-000516

Rule Version

VCSA-80-000301

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

From the vSphere Client, go to "Networking".

Select a distributed switch >> Select a distributed port group >> Configure >> Settings >> Properties.

Click "Edit".

Select advanced and update all port policies besides "Block Ports" to "disabled" and click "OK".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

$pgs = Get-VDPortgroup | Get-View
ForEach($pg in $pgs){
$spec = New-Object VMware.Vim.DVPortgroupConfigSpec
$spec.configversion = $pg.Config.ConfigVersion
$spec.Policy = New-Object VMware.Vim.VMwareDVSPortgroupPolicy
$spec.Policy.VlanOverrideAllowed = $False
$spec.Policy.UplinkTeamingOverrideAllowed = $False
$spec.Policy.SecurityPolicyOverrideAllowed = $False
$spec.Policy.IpfixOverrideAllowed = $False
$spec.Policy.BlockOverrideAllowed = $True
$spec.Policy.ShapingOverrideAllowed = $False
$spec.Policy.VendorConfigOverrideAllowed = $False
$spec.Policy.TrafficFilterOverrideAllowed = $False
$pg.ReconfigureDVPortgroup_Task($spec)
}

Check Contents

If distributed switches are not used, this is not applicable.

From the vSphere Client, go to "Networking".

Select a distributed switch >> Select a distributed port group >> Configure >> Settings >> Properties.

Review the "Override port policies".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

(Get-VDPortgroup).ExtensionData.Config.Policy

If there are any distributed port groups that allow overridden port policies, this is a finding.

Note: This does not apply to the "Block Ports" or "Configure reset at disconnect" policies.

Vulnerability Number

V-258966

Documentable

False

Rule Version

VCSA-80-000301

Severity Override Guidance

If distributed switches are not used, this is not applicable.

From the vSphere Client, go to "Networking".

Select a distributed switch >> Select a distributed port group >> Configure >> Settings >> Properties.

Review the "Override port policies".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

(Get-VDPortgroup).ExtensionData.Config.Policy

If there are any distributed port groups that allow overridden port policies, this is a finding.

Note: This does not apply to the "Block Ports" or "Configure reset at disconnect" policies.

Check Content Reference

M

Target Key

5573