7.2.2 Ensure that port groups are not configured to VLAN 4095 except for Virtual Guest Tagging (VGT)

Information

Don't use VLAN 4095 except for Virtual Guest Tagging (VGT).

*Rationale*

When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch
passes all network frames to the guest VM without modifying the VLAN tags, leaving it up
to the guest to deal with them. VLAN 4095 should be used only if the guest has been
specifically configured to manage VLAN tags itself. If VGT is enabled inappropriately, it
might cause denial of service or allow a guest VM to interact with traffic on an
unauthorized VLAN.

Solution

VLAN ID setting on all port groups should not be set to 4095 unless VGT is required.

See Also

https://workbench.cisecurity.org/files/902

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: VMware

Control ID: fcaa8713a4375bdb40be5b576d951151e81ca8f78b98d2e07a7a922c7177c6af