Details

When defining a physical switch port for trunk mode, only specified VLANs must be configured on the VLAN trunk link. The risk with not fully documenting all VLANs on the vSwitch is that it is possible that a physical trunk port might be configured without needed VLANs, or with unneeded VLANs. This could enable an administrator to either accidentally or maliciously connect a VM to an unauthorized VLAN.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Note that this check refers to an entity outside the scope of the ESXi server system.

Remove any VLANs trunked across physical ports connected to ESXi hosts that are not in use.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.

References

• 800-53|CM-6b.
• CAT|II
• CCI|CCI-000366
• Rule-ID|SV-239322r674895_rule
• STIG-ID|ESXI-67-000068
• STIG-Legacy|SV-104169
• STIG-Legacy|V-94083
• Vuln-ID|V-239322

Source

• Tenable.com/audits