7.5 Ensure port groups are not configured to VLAN values reserved by upstream physical switches

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


Ensure that port groups are not configured to VLAN values reserved by upstream physical switches. Certain physical switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured to these values. For example, Cisco Catalyst switches typically reserve VLANs 1001 through 1024 and 4094, while Nexus switches typically reserve 3968 through 4047 and 4094. Check the documentation for your specific switch.


Using a reserved VLAN might result in a denial of service on the network.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.


To change the VLAN values for port groups to non-reserved values, perform the following:

From the vSphere Web Client, select the host.

Click Configure then expand Networking.

Select Virtual switches.

Expand the Standard vSwitch.

View the topology diagram of the switch, which shows the various port groups associated with that switch.

For each port group on the vSwitch, verify and record the VLAN IDs used.

If a VLAN ID change is needed, click the name of the port group in the topology diagram of the virtual switch.

Click the Edit settings option.

In the Properties section, enter an appropriate name in the Network label field.

In the VLAN ID dropdown select or type a new VLAN.

Click OK.

See Also