VCWN-06-000051 - The system must protect the confidentiality and integrity of transmitted info by isolating IP-based storage traffic.

Information

Virtual machines might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes VSAN, iSCSI, and NFS. This configuration might expose IP-based storage traffic to unauthorized virtual machine users. IP-based storage frequently is not encrypted. It can be viewed by anyone with access to this network. To restrict unauthorized users from viewing the IP-based storage traffic, the IP-based storage network must be logically separated from the production traffic. Configuring the IP-based storage adaptors on separate VLANs or network segments from other VMkernels and Virtual Machines will limit unauthorized users from viewing the traffic.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configuration of an IP-Based VMkernel will be unique to each environment but for example to modify the IP address and VLAN information to the correct network on a standard switch for an iSCSI VMkernel do the following:

From the vSphere Client select the ESXi host and go to Configuration > Networking > On the vSwitch that contains the iSCSI VMkernel select Properties. Select the iSCSI VMkernel and click Edit > On the General tab uncheck everything and set the appropriate VLAN ID > Go to the IP Settings tab > Enter the appropriate IP address and subnet information and click OK.

See Also

http://iasecontent.disa.mil/stigs/zip/U_VMware_vSphere_6-0_vCenter_Server_for_Windows_V1R4_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-73137, Rule-ID|SV-87789r1_rule, STIG-ID|VCWN-06-000051, Vuln-ID|V-73137

Plugin: VMware

Control ID: bfac3f35d770c9579c8c2d40a03d9b08953c6ddec9d7fbc6e72dfda623edf01c