ESXI5-VMNET-000009 – All port groups must be configured with a clear network label.
Details Each port group must be identified with a network label/name. Names serve as a functional descriptor for the port...
- Home
- Security Hardening
- DISA STIG VMware ESXi Server 5 STIG V2R1
DISA STIG VMware ESXi Server 5 STIG V2R1
ESXI5-VMNET-000010 – All port groups must be configured to a value other than that of the native VLAN.
Details ESXi does not use the concept of native VLAN. Frames with VLAN specified in the port group will have...ESXI5-VMNET-000011 – All port groups must not be configured to VLAN 4095 except for Virtual Guest Tagging (VGT) – VGT
Details When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch passes...ESXI5-VMNET-000012 – All port groups must not be configured to VLAN values reserved by upstream physical switches.
Details Physical vendor-specific switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured to these values. Use...ESXI5-VMNET-000013 – The system must ensure that the virtual switch Forged Transmits policy is set to reject.
Details If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated...ESXI5-VMNET-000014 – The system must ensure that the dvPortgroup Forged Transmits policy is set to reject.
Details If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated...ESXI5-VMNET-000015 – The system must ensure the dvPortGroup MAC Address Change policy is set to reject.
Details If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC...ESXI5-VMNET-000018 – The system must ensure the virtual switch Promiscuous Mode policy is set to reject.
Details When promiscuous mode is enabled for a virtual switch, all virtual machines connected to the dvPortgroup have the potential...ESXI5-VMNET-000019 – The system must ensure the dvPortgroup Promiscuous Mode policy is set to reject.
Details When promiscuous mode is enabled for a dvPortgroup, all virtual machines connected to the dvPortgroup have the potential of...ESXI5-VMNET-000020 – The system must ensure there are no unused ports on a distributed virtual port group.
Details The number of ports available on a dvSwitch distributed port group must be adjusted to exactly match the number...