Detections
Analytics

VCSA-70-000267 - The vCenter Server must disable the distributed virtual switch health check.

Information

Network health check is disabled by default. Once enabled, the health check packets contain information on host#, vds#, and port#, which an attacker would find useful. It is recommended that network health check be used for troubleshooting and turned off when troubleshooting is finished.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to 'Networking'.

Select a distributed switch >> Configure >> Settings >> Health Check.

Click 'Edit'.

Disable the 'VLAN and MTU' and 'Teaming and failover' checks.

Click 'OK'.

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-View -ViewType DistributedVirtualSwitch | ?{($_.config.HealthCheckConfig | ?{$_.enable -notmatch 'False'})}| %{$_.UpdateDVSHealthCheckConfig(@((New-Object Vmware.Vim.VMwareDVSVlanMtuHealthCheckConfig -property @{enable=0}),(New-Object Vmware.Vim.VMwareDVSTeamingHealthCheckConfig -property @{enable=0})))}

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y24M01_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-256347r885652_rule, STIG-ID|VCSA-70-000267, Vuln-ID|V-256347

Plugin: VMware

Control ID: 48ea9a5b23f3ea0ac0b491aee5b53e6a3601e862af741d0e8ed8aba82da29701