ESXI5-VMNET-000011 - All port groups must not be configured to VLAN 4095 except for Virtual Guest Tagging (VGT) - VGT

Information

When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch passes all network frames to the guest VM without modifying the VLAN tags, leaving it up to the guest to deal with them. VLAN 4095 should be used only if the guest has been specifically configured to manage VLAN tags itself. If VGT is enabled inappropriately, it might cause denial-of-service or allow a guest VM to interact with traffic on an unauthorized VLAN.

Solution

Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client. Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials. If connecting to vCenter Server, click on the desired host. Click the Configuration tab. Click Software, Security Profile, Services, Properties, ESXi Shell, and Options, respectively. Start the ESXi Shell service, where/as required.

As root, log in to the ESXi Shell and run the command to set the value to something other than the VGT 4095 value.
esxcli network vswitch standard portgroup set --portgroup-name=<name> --vlan-id=<non-default_id_number>

Re-enable Lockdown Mode on the host.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-39368, Rule-ID|SV-250553r798658_rule, STIG-ID|ESXI5-VMNET-000011, STIG-Legacy|SV-51226, STIG-Legacy|V-39368, Vuln-ID|V-250553

Plugin: VMware

Control ID: 253671f16d1ef6cd1a9ed110842e7dda92441cf1d8299e73d0fb56bb7fc4bb4f