ESXI5-VMNET-000008 - All physical switch ports must be configured with spanning tree disabled.

Information

Due to the integration of the ESXi Server into the physical network, the physical network (switch) adaptors must have spanning tree disabled or portfast configured for external switches, because VMware virtual switches do not support STP. Virtual switch uplinks do not create loops within the physical switch network. If these are not set, potential performance and connectivity issues might arise.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Note that this check refers to an entity outside the scope of the ESXi server system. Document the upstream physical switch configuration for spanning tree protocol disablement and/or portfast configuration for all physical ports connected to ESXi hosts. Log in to the physical switch(es) and disable spanning tree protocol and/or configure portfast for all physical ports connected to ESXi hosts. Update the documentation on an organization defined frequency or whenever modifications are made to either ESXi hosts or the upstream physical switches.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Group-ID|V-39365, Rule-ID|SV-250550r798649_rule, STIG-ID|ESXI5-VMNET-000008, STIG-Legacy|SV-51223, STIG-Legacy|V-39365, Vuln-ID|V-250550

Plugin: VMware

Control ID: 0fbe4020ea93745065615b866f18e6468b564b0c88a372319dc626896ffbd386