STIGQter STIGQter: STIG Summary: VMware vSphere 6.5 ESXi Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The ESXi host must protect the confidentiality and integrity of transmitted information by protecting IP based management traffic.

DISA Rule

SV-207650r380176_rule

Vulnerability Number

V-207650

Group Title

SRG-OS-000423-VMM-001700

Rule Version

ESXI-65-000050

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configuration of an IP-Based VMkernel will be unique to each environment but for example to modify the IP address and VLAN information to the correct network on a standard switch for an iSCSI VMkernel do the following:

From the vSphere Web Client select the ESXi host and go to Configure >> Networking >> VMkernel adapters. Select the Storage VMkernel (for vSAN only) and click Edit settings >> On the Port properties tab uncheck everything but "vSAN.” On the IP Settings tab >> Enter the appropriate IP address and subnet information and click OK.

Set the appropriate VLAN ID >> Configure >> Networking >> Virtual switches. Select the Storage portgroup (iSCSI, NFS, vSAN) and click Edit settings >> On the properties tab, enter the appropriate VLAN ID and click OK.

Check Contents

IP-Based storage (iSCSI, NFS, vSAN) VMkernel port groups must be in a dedicated VLAN that can be on a common standard or distributed virtual switch that is logically separated from other traffic types. The check for this will be unique per environment.

From the vSphere Web Client select the ESXi Host and go to Configure >> Networking >> VMkernel adapters and review the VLANs associated with any IP-Based storage VMkernels and verify they are dedicated for that purpose and are logically separated from other functions.

If any IP-Based storage networks are not isolated from other traffic types, this is a finding.

If IP-based storage is not used, this is not applicable.

Vulnerability Number

V-207650

Documentable

False

Rule Version

ESXI-65-000050

Severity Override Guidance

IP-Based storage (iSCSI, NFS, vSAN) VMkernel port groups must be in a dedicated VLAN that can be on a common standard or distributed virtual switch that is logically separated from other traffic types. The check for this will be unique per environment.

From the vSphere Web Client select the ESXi Host and go to Configure >> Networking >> VMkernel adapters and review the VLANs associated with any IP-Based storage VMkernels and verify they are dedicated for that purpose and are logically separated from other functions.

If any IP-Based storage networks are not isolated from other traffic types, this is a finding.

If IP-based storage is not used, this is not applicable.

Check Content Reference

M

Target Key

2925

Comments