STIGQter: STIG Summary: VMware NSX 4.x Tier-0 Gateway Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 30 Jan 2025:

The NSX Tier-0 Gateway router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.

DISA Rule

SV-265390r994520_rule

Vulnerability Number

V-265390

Group Title

SRG-NET-000019-RTR-000003

Rule Version

NT0R-4X-000013

Severity

CAT I

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Disable multicast PIM routing on interfaces that are not required to support multicast by doing the following:

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways and expand the target Tier-0 gateway.

Expand "Interfaces and GRE Tunnels", click on the number of interfaces present to open the interfaces dialog, and then select "Edit" on the target interface.

Expand "Multicast", change PIM to "disabled", and then click "Save".

Check Contents

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways.

For every Tier-0 Gateway, expand the Tier-0 Gateway >> Interfaces and GRE Tunnels, and click on the number of interfaces present to open the interfaces dialog.

Expand each interface that is not required to support multicast routing, then expand "Multicast" and verify PIM is disabled.

If PIM is enabled on any interfaces that are not supporting multicast routing, this is a finding.

Vulnerability Number

V-265390

Documentable

False

Rule Version

NT0R-4X-000013

Severity Override Guidance

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways.

For every Tier-0 Gateway, expand the Tier-0 Gateway >> Interfaces and GRE Tunnels, and click on the number of interfaces present to open the interfaces dialog.

Expand each interface that is not required to support multicast routing, then expand "Multicast" and verify PIM is disabled.

If PIM is enabled on any interfaces that are not supporting multicast routing, this is a finding.

Check Content Reference

M

Target Key

5634