Details
Ensure the MAC Address Change policy within the vSwitch is set to reject. Reject MAC
Changes can be set at the vSwitch and/or the Portgroup level. You can override switch- l
evel settings at the Portgroup level.
*Rationale*
If the virtual machine operating system changes the MAC address, it can send frames with
an impersonated source MAC address at any time. This allows it to stage malicious attacks
on the devices in a network by impersonating a network adaptor authorized by the receiving network.
Solution
1. In the vSphere Web Client, navigate to the host.
2. ‘Hosts and Clusters’ -> ‘vCenter’ -> host.
3. On the Manage tab, click Networking, and select Virtual switches.
4. Select a standard switch from the list and click the pencil icon to edit settings.
5. Select Security.
6. Set MAC Address Changes to ‘Reject’.
7. Click ‘OK’.
Additionally, perform the following to implement the recommended configuration state
using the ESXi shell-
# esxcli network vswitch standard policy security set -v vSwitch2 -m false
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system VMware.