ESXI5-VMNET-000005 - All vSwitch and VLAN IDs must be fully documented - 'vSwitch labels'

Information

VLAN tagging used on a vSwitch must correspond to the IDs on external VLAN-aware upstream switches, if any. If VLAN IDs are not tracked completely, mistaken re-use of IDs could allow for traffic to be allowed between inappropriate physical and virtual machines. Similarly, wrong or missing VLAN IDs may lead to traffic not passing between appropriate physical and virtual machines.

Solution

From the vSphere Client/vCenter: Go to 'Home>> Inventory>> Hosts and Clusters'. Select each ESXi host with virtual switches connected to active VMs. Go to 'Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> [Portgroup Name]>> VLAN ID'. Record all VLAN IDs in a (site-specific) tracking system.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Group-ID|V-39360, Rule-ID|SV-250547r798640_rule, STIG-ID|ESXI5-VMNET-000005, STIG-Legacy|SV-51218, STIG-Legacy|V-39360, Vuln-ID|V-250547

Plugin: VMware

Control ID: 4a126dc62e8b74efa3c920eb422f0ac1fc67f1db5877c754d83eaf3edf7478f9