STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter Server must reset port configuration when virtual machines are disconnected.

DISA Rule

SV-258967r934559_rule

Vulnerability Number

V-258967

Group Title

SRG-APP-000516

Rule Version

VCSA-80-000302

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

From the vSphere Client, go to "Networking".

Select a distributed switch >> Select a distributed port group >> Configure >> Settings >> Properties.

Click "Edit".

Select advanced and update "Configure reset at disconnect" to be enabled and click "OK".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

$pgs = Get-VDPortgroup | Get-View
ForEach($pg in $pgs){
$spec = New-Object VMware.Vim.DVPortgroupConfigSpec
$spec.configversion = $pg.Config.ConfigVersion
$spec.Policy = New-Object VMware.Vim.VMwareDVSPortgroupPolicy
$spec.Policy.PortConfigResetAtDisconnect = $True
$pg.ReconfigureDVPortgroup_Task($spec)
}

Check Contents

If distributed switches are not used, this is not applicable.

From the vSphere Client, go to "Networking".

Select a distributed switch >> Select a distributed port group >> Configure >> Settings >> Properties.

Review the "Configure reset at disconnect" setting.

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

(Get-VDPortgroup).ExtensionData.Config.Policy.PortConfigResetAtDisconnect

If there are any distributed port groups with "Configure reset at disconnect" configured to "disabled" or "False", this is a finding.

Vulnerability Number

V-258967

Documentable

False

Rule Version

VCSA-80-000302

Severity Override Guidance

Check Content Reference

Target Key

5573