Home
Security Hardening
DISA STIG VMware vSphere VCenter 6.5 V2R2

DISA STIG VMware vSphere VCenter 6.5 V2R2

VCWN-65-000012 – The vCenter Server for Windows must disable the distributed virtual switch health check.
Details Network Healthcheck is disabled by default. Once enabled, the healthcheck packets contain information on host#, vds#, port#, which an...
VCWN-65-000013 – The vCenter Server for Windows must set the distributed port group Forged Transmits policy to reject.
Details If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated...
VCWN-65-000014 – The vCenter Server for Windows must set the distributed port group MAC Address Change policy to reject.
Details If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC...
VCWN-65-000015 – The vCenter Server for Windows must set the distributed port group Promiscuous Mode policy to reject.
Details When promiscuous mode is enabled for a virtual switch all virtual machines connected to the Portgroup have the potential...
VCWN-65-000017 – The vCenter Server for Windows must not override port group settings at the port level on distributed switches.
Details Port-level configuration overrides are disabled by default. Once enabled, this allows for different security settings to be set from...
VCWN-65-000033 – The vCenter Server for Windows must use a least-privileges assignment for the vCenter Server database user.
Details Least-privileges mitigates attacks if the vCenter database account is compromised. vCenter requires very specific privileges on the database. Privileges...
VCWN-65-000018 – The vCenter Server for Windows must configure all port groups to a value other than that of the native VLAN.
Details ESXi does not use the concept of native VLAN. Frames with VLAN specified in the port group will have...
VCWN-65-000034 – The vCenter Server for Windows must use unique service accounts when applications connect to vCenter.
Details In order to not violate non-repudiation (i.e., deny the authenticity of who is connecting to vCenter), when applications need...
VCWN-65-000019 – The vCenter Server for Windows must configure all port groups to VLAN 4095 unless Virtual Guest Tagging (VGT) is required.
Details When a port group is set to VLAN 4095, this activates VGT mode. In this mode, the vSwitch passes...
VCWN-65-000035 – vCenter Server for Windows plugins must be verified.
Details The vCenter Server includes a vSphere Client extensibility framework, which provides the ability to extend the vSphere Client with...

Prev Next

DISA STIG VMware vSphere VCenter 6.5 V2R2

VCWN-65-000012 – The vCenter Server for Windows must disable the distributed virtual switch health check.

VCWN-65-000013 – The vCenter Server for Windows must set the distributed port group Forged Transmits policy to reject.

VCWN-65-000014 – The vCenter Server for Windows must set the distributed port group MAC Address Change policy to reject.

VCWN-65-000015 – The vCenter Server for Windows must set the distributed port group Promiscuous Mode policy to reject.

VCWN-65-000017 – The vCenter Server for Windows must not override port group settings at the port level on distributed switches.

VCWN-65-000033 – The vCenter Server for Windows must use a least-privileges assignment for the vCenter Server database user.

VCWN-65-000018 – The vCenter Server for Windows must configure all port groups to a value other than that of the native VLAN.

VCWN-65-000034 – The vCenter Server for Windows must use unique service accounts when applications connect to vCenter.

VCWN-65-000019 – The vCenter Server for Windows must configure all port groups to VLAN 4095 unless Virtual Guest Tagging (VGT) is required.

VCWN-65-000035 – vCenter Server for Windows plugins must be verified.