ESXI-67-000057 - The ESXi host must configure the firewall to block network traffic by default - incoming

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

In addition to service-specific firewall rules, ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic. Reduce the risk of attack by making sure this is set to deny incoming and outgoing traffic.

Solution

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHostFirewallDefaultPolicy | Set-VMHostFirewallDefaultPolicy -AllowIncoming $false -AllowOutgoing $false

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(12), CAT|II, CCI|CCI-000366, Rule-ID|SV-239311r674862_rule, STIG-ID|ESXI-67-000057, STIG-Legacy|SV-104147, STIG-Legacy|V-94061, Vuln-ID|V-239311

Plugin: VMware

Control ID: b6b91873a3a147b8137cc6d406c570640ae5a00e951ba7299a4ebd8a3b440ed6