VCTR-67-000054 - The vCenter Server must disable or restrict the connectivity between vSAN Health Check and public Hardware Compatibility List by use of an external proxy server.

Information

The vSAN Health Check is able to download the hardware compatibility list from VMware to check compliance against the underlying vSAN Cluster hosts.

To ensure the vCenter server is not directly downloading content from the internet, this functionality must be disabled or, if this feature is necessary, an external proxy server must be configured.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to Hosts and Clusters >> vCenter Server >> Configure >> vSAN >> Internet Connectivity >> Edit.

If the HCL internet download is not required, ensure that 'Status' is disabled.

If the HCL internet download is required, ensure that 'Status' is enabled and a proxy host is appropriately configured.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-243110r879887_rule, STIG-ID|VCTR-67-000054, Vuln-ID|V-243110

Plugin: VMware

Control ID: a7df3faa5497f4eedb841243d1049fb3a7a303e6002b3848734df112d39caee5