The system must ensure the virtual switch Promiscuous Mode policy is set to reject.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39375	ESXI5-VMNET-000018	SV-51233r1_rule		Medium

Description
When promiscuous mode is enabled for a virtual switch, all virtual machines connected to the dvPortgroup have the potential of reading all packets across that network, meaning only the virtual machines connected to that dvPortgroup. Promiscuous mode is disabled by default on the ESXi Server.

STIG	Date
VMware ESXi Server 5.0 Security Technical Implementation Guide	2017-01-06

Details

Check Text ( C-46649r3_chk )
Use the vSphere Client to connect to the vCenter Server and as administrator: Go to "Home > Inventory > Hosts and clusters". Select each ESXi host with active virtual switches connected to active VM's requiring securing. Go to the tab "Configuration >> Network >> vSwitch(?) >> Properties >> Ports >> vSwitch >> Default Policies >> Security". Check that the "Promiscuous Mode" is set to "Reject". If the "Promiscuous Mode" is not set to "Reject", this is a finding.

Check Text ( C-46649r3_chk )

Use the vSphere Client to connect to the vCenter Server and as administrator: Go to "Home > Inventory > Hosts and clusters". Select each ESXi host with active virtual switches connected to active VM's requiring securing. Go to the tab "Configuration >> Network >> vSwitch(?) >> Properties >> Ports >> vSwitch >> Default Policies >> Security". Check that the "Promiscuous Mode" is set to "Reject".

If the "Promiscuous Mode" is not set to "Reject", this is a finding.

Fix Text (F-44389r2_fix)
From the vSphere Client/vCenter Server as administrator: Go to "Home>> Inventory>> Hosts and clusters". Select each ESXi host with active virtual switches connected to active VMs requiring securing. Go to tab "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> vSwitch>> Default Policies>> Security". Set "Promiscuous Mode" = "Reject".