ESXI5-VMNET-000025 - Spanning tree protocol must be enabled and BPDU guard and Portfast must be disabled on the upstream physical switch port for virtual machines that route or bridge traffic.

Information

If an ESXi host guest VM is configured to perform a bridging function, the VM will generate BPDU frames to send out to the VDS. The VDS forwards the BPDU frames through the network adapter to the physical switch port. When the switch port configured with 'BPDU guard' receives the BPDU frame, the switch will disable the port and the VM will lose connectivity. To avoid this network failure scenario while running a software-bridging function on an ESXi host, the 'portfast' and 'BPDU guard' configuration must be disabled on the port and spanning tree protocol must be enabled.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Organization and vendor specific fix. If a guest VM is configured to perform a bridging function, enable spanning tree protocol for the VMs switch port. Note that this check refers to an entity outside the scope of the ESXi server system.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Group-ID|V-39379, Rule-ID|SV-250566r798697_rule, STIG-ID|ESXI5-VMNET-000025, STIG-Legacy|SV-51237, STIG-Legacy|V-39379, Vuln-ID|V-250566

Plugin: VMware

Control ID: 88f6fa4b8e309b1bb1c067503c68ede387aa5275be5f526bc36886d3c2220d91