Detections
Analytics

1.31 VCSA-80-000267

Information

The vCenter Server must disable the distributed virtual switch health check.

GROUP ID: V-258934RULE ID: SV-258934r961863

Network health check is disabled by default. Once enabled, the health check packets contain information on host, vds, and port, which an attacker would find useful. It is recommended that network health check be used for troubleshooting and turned off when troubleshooting is finished.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to "Networking".

Select a distributed switch >> Configure >> Settings >> Health Check.

Click "Edit".

Disable the "VLAN and MTU" and "Teaming and failover" checks.

Click "OK".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-View -ViewType DistributedVirtualSwitch | ?{($ .config.HealthCheckConfig | ?{$ .enable -notmatch "False"})}| %{$_.UpdateDVSHealthCheckConfig(@((New-Object Vmware.Vim.VMwareDVSVlanMtuHealthCheckConfig -property @{enable=0}),(New-Object Vmware.Vim.VMwareDVSTeamingHealthCheckConfig -property @{enable=0})))}

See Also

https://workbench.cisecurity.org/benchmarks/23621

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258934r961863_rule, STIG-ID|VCSA-80-000267, Vuln-ID|V-258934

Plugin: VMware

Control ID: cbd03384cf4ad6500f7b03fd55e2774e29501a835268f0c1f86166dfcbf67d10