STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter Server must enable data in transit encryption for vSAN.

DISA Rule

SV-258969r934565_rule

Vulnerability Number

V-258969

Group Title

SRG-APP-000516

Rule Version

VCSA-80-000304

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

From the vSphere Client, go to Host and Clusters.

Select the vCenter Server >> Select the target cluster >> Configure >> vSAN >> Services >> Data Services.

Click "Edit".

Enable "Data-In-Transit encryption" and choose a rekey interval suitable for the environment then click "Apply".

Check Contents

If no clusters are enabled for vSAN, this is not applicable.

From the vSphere Client, go to Host and Clusters.

Select the vCenter Server >> Select the cluster >> Configure >> vSAN >> Services >> Data Services.

Review the "Data-in-transit encryption" status.

or

From a PowerCLI command prompt while connected to the vCenter server, run the following commands:

$vsanclusterconf = Get-VsanView -Id VsanVcClusterConfigSystem-vsan-cluster-config-system
$vsanclusterconf.VsanClusterGetConfig((Get-Cluster -Name <cluster name>).ExtensionData.MoRef).DataInTransitEncryptionConfig

Repeat these steps for each vSAN enabled cluster in the environment.

If "Data-In-Transit encryption" is not enabled, this is a finding.

Vulnerability Number

V-258969

Documentable

False

Rule Version

VCSA-80-000304

Severity Override Guidance

Check Content Reference

Target Key

5573