VCWN-06-000017 - The system must not override port group settings at the port level on distributed switches.


Port-level configuration overrides are disabled by default. Once enabled, this allows for different security settings to be set from what is established at the Port-Group level. There are cases where particular VMs require unique configurations, but this should be monitored so it is only used when authorized. If overrides are not monitored, anyone who gains access to a VM with a less secure VDS configuration could surreptitiously exploit that broader access.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.


From the vSphere Web Client go to Networking >> Select a distributed port group >> Manage >> Settings >> Properties. Click Edit and change all Override port policies to disabled.

From a PowerCLI command prompt while connected to the vCenter server run the following commands:

$pgs = Get-VDPortgroup | Get-View
ForEach($pg in $pgs){
$spec = New-Object VMware.Vim.DVPortgroupConfigSpec
$spec.configversion = $pg.Config.ConfigVersion
$spec.Policy = New-Object VMware.Vim.VMwareDVSPortgroupPolicy
$spec.Policy.VlanOverrideAllowed = $False
$spec.Policy.UplinkTeamingOverrideAllowed = $False
$spec.Policy.SecurityPolicyOverrideAllowed = $False
$spec.Policy.IpfixOverrideAllowed = $False
$spec.Policy.BlockOverrideAllowed = $False
$spec.Policy.ShapingOverrideAllowed = $False
$spec.Policy.VendorConfigOverrideAllowed = $False
$spec.Policy.TrafficFilterOverrideAllowed = $False
$spec.Policy.PortConfigResetAtDisconnect = $True

See Also

Item Details


References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Group-ID|V-63971, Rule-ID|SV-78461r1_rule, STIG-ID|VCWN-06-000017, Vuln-ID|V-63971

Plugin: VMware

Control ID: d0c795133517d26ce595c14afeafcf96bae12fc6541f7d4d15b0f9bb2b8f24ff