Details
When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch passes all network frames to the guest VM without modifying the VLAN tags, leaving it up to the guest to deal with them. VLAN 4095 should be used only if the guest has been specifically configured to manage VLAN tags itself. If VGT is enabled inappropriately, it might cause denial-of-service or allow a guest VM to interact with traffic on an unauthorized VLAN.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
From the vSphere Web Client go to Networking >> Select a distributed switch >> Select a distributed port group >> Configure >> Settings >> Policies. Click ‘Edit’ and under the VLAN section change the VLAN ID to an appropriate VLAN ID other than ‘4095’ and click ‘OK’.
or
From a PowerCLI command prompt while connected to the vCenter server run the following command:
Get-VDPortgroup ‘portgroup name’ | Set-VDVlanConfiguration -VlanId ‘New VLAN#’
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.
References
- 800-53|CM-6b.
- CAT|II
- CCI|CCI-000366
- Rule-ID|SV-216841r612237_rule
- STIG-ID|VCWN-65-000019
- STIG-Legacy|SV-104579
- STIG-Legacy|V-94749
- Vuln-ID|V-216841