ESXI-06-000067 - All physical switch ports must be configured with spanning tree disabled.

Information

Since VMware virtual switches do not support STP, the ESXi host-connected physical switch ports must have portfast configured if spanning tree is enabled to avoid loops within the physical switch network. If these are not set, potential performance and connectivity issues might arise.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Note: This fix refers to an entity outside the scope of the ESXi server system. Document the upstream physical switch configuration for spanning tree protocol disablement and/or portfast configuration for all physical ports connected to ESXi hosts. Log in to the physical switch(es) and disable spanning tree protocol and/or configure portfast for all physical ports connected to ESXi hosts. Update the documentation on a regular basis or whenever modifications are made to either ESXi hosts or the upstream physical switches.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMware_vSphere_6-0_ESXi_V1R5_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Group-ID|V-63303, Rule-ID|SV-77793r1_rule, STIG-ID|ESXI-06-000067, Vuln-ID|V-63303

Plugin: VMware

Control ID: a6530f26724d0a72a7b24a92596547afc828083a62b42da4d729cc3cf7f534fc