Detections
Analytics
VCTR-67-000012 - The vCenter Server must disable the distributed virtual switch health check.
Information
Network Healthcheck is disabled by default. Once enabled, the healthcheck packets contain information on host#, vds#, and port#, which an attacker would find useful. It is recommended that network healthcheck be used for troubleshooting and turned off when troubleshooting is finished.NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
From the vSphere Client, go to Networking >> select a distributed switch >> Configure >> Settings >> Health Check.Click 'Edit' and disable the 'VLAN and MTU' and 'Teaming and failover' checks.
or
From a PowerCLI command prompt while connected to the vCenter server, run the following command:
Get-View -ViewType DistributedVirtualSwitch | ?{($_.config.HealthCheckConfig | ?{$_.enable -notmatch 'False'})}| %{$_.UpdateDVSHealthCheckConfig(@((New-Object Vmware.Vim.VMwareDVSVlanMtuHealthCheckConfig -property @{enable=0}),(New-Object Vmware.Vim.VMwareDVSTeamingHealthCheckConfig -property @{enable=0})))}
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere 6.7 vCenter v1r4
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-243081r879887_rule, STIG-ID|VCTR-67-000012, Vuln-ID|V-243081
Plugin: VMware
Control ID: babfda9e4828f677db5fb5bfe65416bcc012296fec98bf83e4586ef02f4f7dad