Detections
Analytics

5.11 Host must isolate management communications

Information

Ensure that only vmk interfaces designated for management purposes have management services enabled to uphold network isolation and security. Incorrect configuration may undermine security efforts by breaching network isolation principles.

Restricting management services to designated vmk interfaces minimizes the attack surface and ensures that management communications are isolated from other traffic, adhering to network segmentation best practices.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To remediate this recommendation, create or move management VMkernel interfaces to dedicated management port groups/VLANs, apply firewall/ACL restrictions, and remove management service flags from interfaces that do not require them. Test vCenter connectivity before deleting the old path.

Impact:

This control may affect third-party managed solutions requiring specific configurations. Configurations may need to be tailored based on the particular environment and third-party solutions in use.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: ACCESS CONTROL, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-17(3), 800-53|SI-7, CSCv7|4.6

Plugin: Unix

Control ID: b0896b8e3d9e9329b8a5116c0cf392609a5d8fe5deb56c449d37edcb9b786b92