Detections
Analytics

7.4 Ensure port groups are not configured to the value of the native VLAN

Information

ESXi does not use the concept of native VLAN, so do not configure port groups to use the
 native VLAN ID. If the default value of 1 for the native VLAN is being used, the ESXi Server
 virtual switch port groups should be configured with any value between 2 and 4094.
 Otherwise, ensure that the port group is not configured to use whatever value is set for the native VLAN.

*Rationale*

Frames with VLAN specified in the port group will have a tag, but frames without a VLAN
specified in the port group are not tagged and therefore will end up as belonging to the
native VLAN of the physical switch. For example, frames on VLAN 1 from a Cisco physical
switch will be untagged, because this is considered as the native VLAN. However, frames
from ESXi specified as VLAN 1 will be tagged with a "1"; therefore, traffic from ESXi that is
destined for the native VLAN will not be correctly routed (because it is tagged with a "1"
instead of being untagged), and traffic from the physical switch coming from the native
VLAN will not be visible (because it is not tagged). If the ESXi virtual switch port group uses
the native VLAN ID, traffic from those VMs will not be visible to the native VLAN on the
switch, because the switch is expecting untagged traffic.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

If the default value of 1 for the native VLAN is being used, the ESXi Server virtual switch
port groups should be configured with any value between 2 and 4094. Otherwise, ensure
that the port group is not configured to use whatever value is set for the native VLAN.

1. From the vSphere web client select the host.
2. On the Manage tab, click Networking, and select Virtual switches.
3. Select a standard switch from the list.
4. The topology diagram of the switch appears showing the various port groups
associated with that switch.
5. For each port group on the vSwitch, verify and record the VLAN IDs used.
6. If a VLAN ID change is needed click the name of the port group in the topology
diagram of the virtual switch.
7. Click the 'Edit settings' pencil icon under the topology diagram title.
8. In the Properties section, name the port group in the Network Label text field.
9. Choose an existing VLAN ID drop-down menu or type in a new one.

See Also

https://workbench.cisecurity.org/files/2168

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv7|9.2

Plugin: VMware

Control ID: b2475989f7054acbf9b54a4df3164833c316b7a825e6a38a3c73b254e0b4a882