ESXI-65-000048 - The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.

Information

While encrypted vMotion is available now vMotion traffic should still be sequestered from other traffic to further protect it from attack. This network must be only be accessible to other ESXi hosts preventing outside access to the network.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configuration of the vMotion VMkernel will be unique to each environment. As an example, to modify the IP address and VLAN information to the correct network on a distributed switch do the following:

From the vSphere Web Client go to Networking >> Select a distributed switch >> Select a port group >> Configure >> Settings >> Edit >> VLAN. Change the 'VLAN Type' to 'VLAN' and change the 'VLAN ID' to a network allocated and dedicated to vMotion traffic exclusively.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-5_Y23M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-8, CAT|II, CCI|CCI-002418, Rule-ID|SV-207649r854581_rule, STIG-ID|ESXI-65-000048, STIG-Legacy|SV-104129, STIG-Legacy|V-94043, Vuln-ID|V-207649

Plugin: VMware

Control ID: d3bf1a717d526ce50523071182e77a09c8776d88ea696c7da82171804920956a