STIGQter: STIG Summary: VMware NSX 4.x Manager NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 30 Jan 2025:

The NSX Manager must be configured to integrate with an identity provider that supports multifactor authentication (MFA).

DISA Rule

SV-265296r994111_rule

Vulnerability Number

V-265296

Group Title

SRG-APP-000080-NDM-000220

Rule Version

NMGR-4X-000015

Severity

CAT I

CCI(s)

• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-000370 - Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.

Weight

10

Fix Recommendation

To configure NSX to integrate with VMware Identity Manager or Workspace ONE Access, as the authentication source, do the following:

From the NSX Manager web interface, go to System >> Users and Roles >> VMware Identity Manager and click "Edit".

If using an external load balancer for the NSX Management cluster, enable "External Load Balancer Integration". If using a cluster VIP, leave this disabled.

Click the toggle button to enable "VMware Identity Manager Integration".

Enter the VMware Identity Manager or Workspace ONE Access appliance name, OAuth Client ID, OAuth Client Secret, and certificate thumbprint as provided by the administrators.

Enter the NSX Appliance FQDN. For a cluster, enter the load balancer FQDN or cluster VIP FQDN.

Click "Save", import users and groups, and then assign them roles. (The users are not actually local and remain in the authentication/AAA server.)

Note: As of NSX 4.1 and vCenter 8.0 Update 2, NSX Manager administrator access can also be configured by connecting VMware NSX to the Workspace ONE Access Broker in VMware vCenter for federated identity. Refer to the NSX product documentation to configure this access option.

Ensure the identity provider administrators have configured the provider to support multi-factor authentication.

Check Contents

From the NSX Manager web interface, go to System >> Settings >> Users Management >> Authentication Providers.

Verify that the "VMware Identity Manager" and "OpenID Connect" tabs are configured.

If NSX is not configured to integrate with an identity provider that supports MFA, this is a finding.

Vulnerability Number

V-265296

Documentable

False

Rule Version

NMGR-4X-000015

Severity Override Guidance

From the NSX Manager web interface, go to System >> Settings >> Users Management >> Authentication Providers.

Verify that the "VMware Identity Manager" and "OpenID Connect" tabs are configured.

If NSX is not configured to integrate with an identity provider that supports MFA, this is a finding.

Check Content Reference

M

Target Key

5633