Details
Certain physical switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured to these values. For example, Cisco Catalyst switches typically reserve VLANs 1001-1024 and 4094, while Nexus switches typically reserve 3968-4047 and 4094. Check with the documentation for your specific switch. Using a reserved VLAN might result in a denial of service on the network.
Solution
From the vSphere Client select the ESXi Host and go to Configuration >> Networking >> Select properties on the virtual switch >> Select the port group and click Edit. Change the VLAN ID to not be a reserved VLAN ID and click OK.
or
From a PowerCLI command prompt while connected to the ESXi host run the following command:
Get-VirtualPortGroup -Name ‘portgroup name’ | Set-VirtualPortGroup -VLanId ‘New VLAN#’
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.
References
- 800-53|CM-6b.
- CAT|II
- CCI|CCI-000366
- Group-ID|V-63299
- Rule-ID|SV-77789r1_rule
- STIG-ID|ESXI-06-000065
- Vuln-ID|V-63299