ESXI-67-000048 - The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

While encrypted vMotion is available now, vMotion traffic should still be sequestered from other traffic to further protect it from attack. This network must be only be accessible to other ESXi hosts preventing outside access to the network.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configuration of the vMotion VMkernel will be unique to each environment.

As an example, to modify the IP address and VLAN information to the correct network on a distributed switch, do the following:

From the vSphere Client, go to Networking >> Select a distributed switch >> Select a port group >> Configure >> Settings >> Edit >> VLAN.

Change the 'VLAN Type' to 'VLAN' and change the 'VLAN ID' to a network allocated and dedicated to vMotion traffic exclusively.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip

Item Details

References: CAT|II, CCI|CCI-002418, Rule-ID|SV-239303r674838_rule, STIG-ID|ESXI-67-000048, STIG-Legacy|SV-104129, STIG-Legacy|V-94043, Vuln-ID|V-239303

Plugin: VMware

Control ID: 93325c8dda3f177950c208fec463d4b1eb395509cb2c4344d4338e82e50350e6