STIGQter: STIG Summary: VMware NSX 4.x Manager NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 30 Jan 2025:

The NSX Manager must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).

DISA Rule

SV-265339r994240_rule

Vulnerability Number

V-265339

Group Title

SRG-APP-000374-NDM-000299

Rule Version

NMGR-4X-000068

Severity

CAT II

CCI(s)

• CCI-001890 - Record time stamps for audit records that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.

Weight

10

Fix Recommendation

To configure a profile to apply a time zone to all NSX Manager nodes, do the following:

From the NSX Manager web interface, go to System >> Configuration >> Fabric >> Profiles >> Node Profiles.

Click "All NSX Nodes", and then click "Edit".

In the time zone drop-down list, select "UTC", and then click "Save".

or

From an NSX Manager shell, run the following command:

> set timezone UTC

Note: This fix must be run from each NSX Manager as they are configured individually if done from the command line.

Check Contents

From the NSX Manager web interface, go to System >> Configuration >> Fabric >> Profiles >> Node Profiles.

Note: This check must be run from each NSX Manager as they are configured individually if done from the command line.

Click "All NSX Nodes" and verify the time zone.

or

From an NSX Manager shell, run the following command:

> get clock

If system clock is not configured with the UTC time zone, this is a finding.

Vulnerability Number

V-265339

Documentable

False

Rule Version

NMGR-4X-000068

Severity Override Guidance

From the NSX Manager web interface, go to System >> Configuration >> Fabric >> Profiles >> Node Profiles.

Note: This check must be run from each NSX Manager as they are configured individually if done from the command line.

Click "All NSX Nodes" and verify the time zone.

or

From an NSX Manager shell, run the following command:

> get clock

If system clock is not configured with the UTC time zone, this is a finding.

Check Content Reference

M

Target Key

5633