Details
Don’t use VLAN 4095 except for Virtual Guest Tagging (VGT).
*Rationale*
When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch
passes all network frames to the guest VM without modifying the VLAN tags, leaving it up
to the guest to deal with them. VLAN 4095 should be used only if the guest has been
specifically configured to manage VLAN tags itself. If VGT is enabled inappropriately, it
might cause denial of service or allow a guest VM to interact with traffic on an
unauthorized VLAN.
Solution
VLAN ID setting on all port groups should not be set to 4095 unless VGT is required.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.