All vSwitch and VLAN IDs must be fully documented.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39360	ESXI5-VMNET-000005	SV-51218r1_rule		Low

Description
VLAN tagging used on a vSwitch must correspond to the IDs on external VLAN-aware upstream switches, if any. If VLAN IDs are not tracked completely, mistaken re-use of IDs could allow for traffic to be allowed between inappropriate physical and virtual machines. Similarly, wrong or missing VLAN IDs may lead to traffic not passing between appropriate physical and virtual machines.

STIG	Date
VMware ESXi Server 5.0 Security Technical Implementation Guide	2017-01-06

Details

Check Text ( C-46634r2_chk )
From the vSphere Client/vCenter: Go to "Home>> Inventory>> Hosts and Clusters". Select each ESXi host with virtual switches connected to active VMs. Go to "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> [Portgroup Name]>> VLAN ID". Verify the recorded VLAN IDs in the (site-specific) tracking system. If the system VLAN IDs do not match the external VLAN IDs on record, this is a finding.

Check Text ( C-46634r2_chk )

From the vSphere Client/vCenter: Go to "Home>> Inventory>> Hosts and Clusters". Select each ESXi host with virtual switches connected to active VMs. Go to "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> [Portgroup Name]>> VLAN ID". Verify the recorded VLAN IDs in the (site-specific) tracking system. If the system VLAN IDs do not match the external VLAN IDs on record, this is a finding.

Fix Text (F-44374r2_fix)
From the vSphere Client/vCenter: Go to "Home>> Inventory>> Hosts and Clusters". Select each ESXi host with virtual switches connected to active VMs. Go to "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> [Portgroup Name]>> VLAN ID". Record all VLAN IDs in a (site-specific) tracking system.