STIGQter STIGQter: STIG Summary: VMware ESXi Server 5.0 Security Technical Implementation Guide Version: 1 Release: 10 Benchmark Date: 27 Jan 2017: All port groups must not be configured to VLAN 4095 except for Virtual Guest Tagging (VGT).

DISA Rule

SV-51226r1_rule

Vulnerability Number

V-39368

Group Title

ESXI5-VMNET

Rule Version

ESXI5-VMNET-000011

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client. Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials. If connecting to vCenter Server, click on the desired host. Click the Configuration tab. Click Software, Security Profile, Services, Properties, ESXi Shell, and Options, respectively. Start the ESXi Shell service, where/as required.

As root, log in to the ESXi Shell and run the command to set the value to something other than the VGT 4095 value.
esxcli network vswitch standard portgroup set --portgroup-name=<name> --vlan-id=<non-default_id_number>

Re-enable Lockdown Mode on the host.

Check Contents

Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client. Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials. If connecting to vCenter Server, click on the desired host. Click the Configuration tab. Click Software, Security Profile, Services, Properties, ESXi Shell, and Options, respectively. Start the ESXi Shell service, where/as required.

As root, log in to the ESXi Shell and run the following command.
# esxcli network vswitch standard portgroup list

If the VGT value (4095) is set and the guest is not configured to handle VLAN tags, this is a finding.

Re-enable Lockdown Mode on the host.

Vulnerability Number

V-39368

Documentable

False

Rule Version

ESXI5-VMNET-000011

Severity Override Guidance

Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client. Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials. If connecting to vCenter Server, click on the desired host. Click the Configuration tab. Click Software, Security Profile, Services, Properties, ESXi Shell, and Options, respectively. Start the ESXi Shell service, where/as required.

As root, log in to the ESXi Shell and run the following command.
# esxcli network vswitch standard portgroup list

If the VGT value (4095) is set and the guest is not configured to handle VLAN tags, this is a finding.

Re-enable Lockdown Mode on the host.

Check Content Reference

M

Target Key

2370

Comments