Detections
Analytics

ESXI5-VMNET-000012 - All port groups must not be configured to VLAN values reserved by upstream physical switches.

Information

Physical vendor-specific switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured to these values. Use of reserved VLAN IDs can result in a network denial-of-service.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client. Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials. If connecting to vCenter Server, click on the desired host. Click the Configuration tab. Click Software, Security Profile, Services, Properties, ESXi Shell, and Options, respectively. Start the ESXi Shell service, where/as required.

As root, log in to the ESXi Shell and run the command to set the value to something other than the vendor-specific reserved value.
esxcli network vswitch standard portgroup set --portgroup-name=<name> --vlan-id=<non-default_id_number>;

Re-enable Lockdown Mode on the host.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-39369, Rule-ID|SV-250554r798661_rule, STIG-ID|ESXI5-VMNET-000012, STIG-Legacy|SV-51227, STIG-Legacy|V-39369, Vuln-ID|V-250554

Plugin: VMware

Control ID: 9529f0c95afdb3543ff4a69358d68ae2b99652bec0c909aeff18d9dce88e0e33