Detections
Analytics

5.5 Host should deactivate virtual hardware management network interfaces

Information

Hardware management controllers may present virtual or USB NICs to the host, potentially serving as backdoors if left active. It's recommended to deactivate these interfaces both in the hardware configuration and within ESXi to prevent unauthorized access. The parameter governing this behavior is Net.BMCNetworkEnable with a recommended value of 0.

Deactivating virtual hardware management network interfaces minimizes the attack surface, thereby enhancing the security posture of the host.

Solution

To remediate this recommendation, remove or deactivate unnecessary virtual hardware management VMkernel interfaces and associated port groups. Keep out-of-band BMC/iDRAC/iLO management on dedicated physical management networks wherever possible.

Impact:

While this control enhances security, it may impact third-party managed solutions that require these interfaces, necessitating alternative configurations or additional management considerations.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: VMware

Control ID: e6de3986d36704e991d5873afc928a9d399ef1d2b0ee059fca0f94c9bfa7b041