STIGQter: STIG Summary: VMware NSX 4.x Manager NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 30 Jan 2025:

The NSX Manager must be configured to protect against denial-of-service (DoS) attacks by limit the number of concurrent sessions to an organization-defined number.

DISA Rule

SV-265346r994261_rule

Vulnerability Number

V-265346

Group Title

SRG-APP-000435-NDM-000315

Rule Version

NMGR-4X-000079

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.
• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

From an NSX Manager shell, run the following commands:

> set service http client-api-concurrency-limit 40
> set service http global-api-concurrency-limit 199

Note: The limit numbers in this example, while not mandatory, are the vendor recommend options. Setting the limits to lower numbers in a large environment that is very busy may cause operational issues. Setting the limits higher may cause resource contention so should be tested and monitored.

Check Contents

From an NSX Manager shell, run the following command:

> get service http | find limit

Expected result:
Client API concurrency limit: 40 connections
Global API concurrency limit: 199 connections

If the NSX does not limit the number of concurrent sessions to an organization-defined number, this is a finding.

Vulnerability Number

V-265346

Documentable

False

Rule Version

NMGR-4X-000079

Severity Override Guidance

From an NSX Manager shell, run the following command:

> get service http | find limit

Expected result:
Client API concurrency limit: 40 connections
Global API concurrency limit: 199 connections

If the NSX does not limit the number of concurrent sessions to an organization-defined number, this is a finding.

Check Content Reference

M

Target Key

5633