ESXI-67-000068 - All ESXi host-connected virtual switch VLANs must be fully documented and have only the required VLANs.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

When defining a physical switch port for trunk mode, only specified VLANs must be configured on the VLAN trunk link. The risk with not fully documenting all VLANs on the vSwitch is that it is possible that a physical trunk port might be configured without needed VLANs, or with unneeded VLANs. This could enable an administrator to either accidentally or maliciously connect a VM to an unauthorized VLAN.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Note that this check refers to an entity outside the scope of the ESXi server system.

Remove any VLANs trunked across physical ports connected to ESXi hosts that are not in use.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-239322r674895_rule, STIG-ID|ESXI-67-000068, STIG-Legacy|SV-104169, STIG-Legacy|V-94083, Vuln-ID|V-239322

Plugin: VMware

Control ID: 131847bf42e52d341994cad4e5ba735e2e8d08e9fbcd528d1090bdb9a514da75