The system must ensure the virtual switches MAC Address Change policy is set to reject.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
ESXI5-VMNET-000016	ESXI5-VMNET-000016	ESXI5-VMNET-000016_rule		High

Description
If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. This will prevent VMs from changing their effective MAC address. It will affect applications that require this functionality. An example of an application like this is Microsoft Clustering, which requires systems to effectively share a MAC address. This will also affect how a layer 2 bridge will operate. This will also affect applications that require a specific MAC address for licensing. An exception should be made for the dvPortgroups that these applications are connected to.

Description

If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the devices in a network by impersonating a network adaptor authorized by the receiving network. This will prevent VMs from changing their effective MAC address. It will affect applications that require this functionality. An example of an application like this is Microsoft Clustering, which requires systems to effectively share a MAC address. This will also affect how a layer 2 bridge will operate. This will also affect applications that require a specific MAC address for licensing. An exception should be made for the dvPortgroups that these applications are connected to.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-ESXI5-VMNET-000016_chk )
From the vSphere Client, connect to the vCenter Server and as administrator: Go to "Home>> Inventory>> Hosts and clusters". Select each ESXi host with active virtual switches connected to active VMs requiring securing. Go to tab "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> vSwitch>> Default Policies>> Security". Verify the "Mac Address Changes" = "Reject". If the "Mac Address Changes" parameter is not set to "Reject", this is a finding.

Check Text ( C-ESXI5-VMNET-000016_chk )

From the vSphere Client, connect to the vCenter Server and as administrator:
Go to "Home>> Inventory>> Hosts and clusters".
Select each ESXi host with active virtual switches connected to active VMs requiring securing.
Go to tab "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> vSwitch>> Default Policies>> Security".
Verify the "Mac Address Changes" = "Reject".

If the "Mac Address Changes" parameter is not set to "Reject", this is a finding.

Fix Text (F-ESXI5-VMNET-000016_fix)
From the vSphere Client, connect to the vCenter Server and as administrator: Go to "Home>> Inventory>> Hosts and clusters". Select each ESXi host with active virtual switches connected to active VMs requiring securing. Go to tab "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> vSwitch>> Default Policies>> Security". Change the "Mac Address Changes" = "Reject".