Detections
Analytics

VCTR-67-000012 - The vCenter Server must disable the distributed virtual switch health check.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Network Healthcheck is disabled by default. Once enabled, the healthcheck packets contain information on host#, vds#, and port#, which an attacker would find useful. It is recommended that network healthcheck be used for troubleshooting and turned off when troubleshooting is finished.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to Networking >> select a distributed switch >> Configure >> Settings >> Health Check.

Click 'Edit' and disable the 'VLAN and MTU' and 'Teaming and failover' checks.

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-View -ViewType DistributedVirtualSwitch | ?{($_.config.HealthCheckConfig | ?{$_.enable -notmatch 'False'})}| %{$_.UpdateDVSHealthCheckConfig(@((New-Object Vmware.Vim.VMwareDVSVlanMtuHealthCheckConfig -property @{enable=0}),(New-Object Vmware.Vim.VMwareDVSTeamingHealthCheckConfig -property @{enable=0})))}

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y22M04_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-243081r816839_rule, STIG-ID|VCTR-67-000012, Vuln-ID|V-243081

Plugin: VMware

Control ID: 752d73a2ae3cfcaa2efb363f19e5a8823e430b18ebf6681c1957aa0cb7bb8040