Details

When promiscuous mode is enabled for a virtual switch, all virtual machines connected to the dvPortgroup have the potential of reading all packets across that network, meaning only the virtual machines connected to that dvPortgroup. Promiscuous mode is disabled by default on the ESXi Server.

Solution

From the vSphere Client/vCenter Server as administrator: Go to ‘Home>> Inventory>> Hosts and clusters’. Select each ESXi host with active virtual switches connected to active VMs requiring securing. Go to tab ‘Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> vSwitch>> Default Policies>> Security’. Set ‘Promiscuous Mode’ = ‘Reject’.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.

References

• 800-53|CM-6b.
• CAT|II
• CCI|CCI-000366
• Group-ID|V-39375
• Rule-ID|SV-250560r798679_rule
• STIG-ID|ESXI5-VMNET-000018
• STIG-Legacy|SV-51233
• STIG-Legacy|V-39375
• Vuln-ID|V-250560

Source

• Tenable.com/audits