All dvSwitch Private VLAN IDs must be fully documented.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39357	ESXI5-VMNET-000002	SV-51215r1_rule		Low

Description
dvSwitch Private VLANs (PVLANs) require primary and secondary VLAN IDs. The IDs must correspond to the IDs on external PVLAN-aware upstream switches, if any. If VLAN IDs are not tracked completely, mistaken re-use of IDs could allow for traffic to be allowed between inappropriate physical and virtual machines. Similarly, wrong or missing PVLAN IDs may lead to traffic not passing between appropriate physical and virtual machines.

Description

dvSwitch Private VLANs (PVLANs) require primary and secondary VLAN IDs. The IDs must correspond to the IDs on external PVLAN-aware upstream switches, if any. If VLAN IDs are not tracked completely, mistaken re-use of IDs could allow for traffic to be allowed between inappropriate physical and virtual machines. Similarly, wrong or missing PVLAN IDs may lead to traffic not passing between appropriate physical and virtual machines.

STIG	Date
VMware ESXi Server 5.0 Security Technical Implementation Guide	2017-01-06

Details

Check Text ( C-46631r4_chk )
Verify by using the vSphere Client to connect to the vCenter Server and as administrator go to "Home>> Inventory>> Hosts and Clusters". Select each ESXi host with virtual switches connected to active VMs requiring securing. Go to "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> [Portgroup Name]>> VLAN ID". The dvSwitch Private VLAN tags must be documented to match the IDs on external PVLAN-aware upstream switches. Verify that Private VLAN IDs are documented and matched in an (organization-specific) tracking system. If any PVLAN IDs do not correspond to the IDs on external PVLAN-aware upstream switches, this is a finding.

Check Text ( C-46631r4_chk )

Verify by using the vSphere Client to connect to the vCenter Server and as administrator
go to "Home>> Inventory>> Hosts and Clusters".
Select each ESXi host with virtual switches connected to active VMs requiring securing.
Go to "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> [Portgroup Name]>> VLAN ID".
The dvSwitch Private VLAN tags must be documented to match the IDs on external PVLAN-aware upstream switches. Verify that Private VLAN IDs are documented and matched in an (organization-specific) tracking system.

If any PVLAN IDs do not correspond to the IDs on external PVLAN-aware upstream switches, this is a finding.

Fix Text (F-44371r4_fix)
From the vSphere Client connect to the vCenter Server and as administrator go to "Home>> Inventory>> Hosts and Clusters". Select each ESXi host with virtual switches connected to active VMs requiring securing. Go to "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> [Portgroup Name]>> VLAN ID". Record all configured VLAN IDs in an organization defined tracking system.