ESXI5-VMNET-000021 – vMotion traffic must be isolated.
Details The security issue with vMotion migrations is that information is transmitted in plain text, and anyone with access to...
- Home
- Security Hardening
- DISA STIG VMware ESXi Server 5 STIG V2R1
DISA STIG VMware ESXi Server 5 STIG V2R1
ESXI5-VMNET-000023 – Access to the management network must be strictly controlled through a network gateway.
Details A controlled gateway or other controlled method must be configured to access the management network. The management network must...ESXI5-VMNET-000024 – Access to the management network must be strictly controlled through a network jump box.
Details Based upon an organization’s risk assessment, jump boxes that run vSphere Client and other management clients (e.g., VSphere Management...ESXI5-VMNET-000025 – Spanning tree protocol must be enabled and BPDU guard and Portfast must be disabled on the upstream physical switch port for virtual machines that route or bridge traffic.
Details If an ESXi host guest VM is configured to perform a bridging function, the VM will generate BPDU frames...ESXI5-VMNET-000026 – The system must disable the autoexpand option for VDS dvPortgroups.
Details If the ‘no-unused-dvports’ guideline is followed, there should be only the amount of ports on a VDS that are...ESXI5-VMNET-000036 – All IP-based storage traffic must be isolated to a management-only network using a dedicated, management-only vSwitch.
Details Virtual machines might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes iSCSI and NFS....ESXI5-VMNET-000046 – All IP-based storage traffic must be isolated using a vSwitch containing management-only port groups.
Details Virtual machines might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes iSCSI and NFS....GEN000100-ESXI5-000062 – The operating system must be a supported release.
Details An operating system release is considered supported if the vendor continues to provide security patches for the product. With...GEN000790-ESXI5-000085 – The system must prevent the use of dictionary words for passwords – V-39246
Details An easily guessable password provides an open door to any external or internal malicious intruder. Many computer compromises occur...GEN000240-ESXI5-000058 – The system clock must be synchronized to an authoritative DoD time source.
Details To assure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD....