7.5 Ensure that port groups are not configured to VLAN values reserved by upstream physical switches

Information

Ensure that port groups are not configured to VLAN values reserved by upstream physical
switches. Certain physical switches reserve certain VLAN IDs for internal purposes and
often disallow traffic configured to these values. For example, Cisco Catalyst switches
typically reserve VLANs 1001 through 1024 and 4094, while Nexus switches typically
reserve 3968 through 4047 and 4094. Check the documentation for your specific switch.

*Rationale*

Using a reserved VLAN might result in a denial of service on the network.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

VLAN ID setting on all port groups should not be set to reserved values of the physical
switch.

1. From the vSphere web client select the host.
2. On the Configure tab, click Networking, and select Virtual switches.
3. Select a standard switch from the list.
4. The topology diagram of the switch appears showing the various port groups
associated with that switch.
5. For each port group on the vSwitch, verify and record the VLAN IDs used.
6. If a VLAN ID change is needed click the name of the port group in the topology
diagram of the virtual switch.
7. Click the 'Edit settings' pencil icon under the topology diagram title.
8. In the Properties section, name the port group in the Network Label text field.
9. Choose an existing VLAN ID drop-down menu or type in a new one.

See Also

https://workbench.cisecurity.org/files/2168

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SC-7, 800-53|SI-4, CSCv7|9.2, CSCv7|12.4

Plugin: VMware

Control ID: 0675adf248402104e81ce9c6c11273d5a09598f6353c0c339a18138051856725