ESXI5-VMNET-000004 - Virtual switch VLANs must be fully documented and have only the required VLANs

Information

When defining a physical switch port for trunk mode, only specified VLANs must be configured on the VLAN trunk link. The risk with not fully documenting all VLANs on the vSwitch is that it is possible that a physical trunk port might be configured without needed VLANs, or with unneeded VLANs, potentially enabling an administrator to either accidentally or maliciously connect a VM to an unauthorized VLAN.

Solution

Both standard and distributed vSwitch configurations can be viewed in the vSphere Client. For vSwitch: Home>> Inventory>> Hosts and Clusters, then select an ESXi host in Inventory panel on left. In the Configuration tab, Hardware window, under Networking, select each vSwitch, and for each port group on the vSwitch, verify and record the VLAN IDs used. For dvSwitches, go to Home>> Inventory>> Networking and for each dvSwitch in the inventory, and for each dvPortGroup in each dvSwitch, select Edit Settings>> Policies>> VLAN and record all VLAN IDs

See Also

http://iase.disa.mil/stigs/os/virtualization/Pages/index.aspx

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CAT|III, CCI|CCI-000366, CSCv6|3.1, Group-ID|V-39359, Rule-ID|SV-51217r1_rule, STIG-ID|ESXI5-VMNET-000004

Plugin: VMware

Control ID: b475188b095ad69c26a7f51d94d67cdefc3de9b5f788a92bb05c97ff071c6aca