Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The system must ensure the virtual switch Promiscuous Mode policy is set to reject.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| ESXI5-VMNET-000018 | ESXI5-VMNET-000018 | ESXI5-VMNET-000018_rule | Medium |
| Description |
|---|
| When promiscuous mode is enabled for a virtual switch, all virtual machines connected to the dvPortgroup have the potential of reading all packets across that network, meaning only the virtual machines connected to that dvPortgroup. Promiscuous mode is disabled by default on the ESXi Server. |
| STIG | Date |
|---|---|
| VMware ESXi v5 Security Technical Implementation Guide | 2013-01-15 |
Details
| Check Text ( C-ESXI5-VMNET-000018_chk ) |
|---|
| Use the vSphere Client to connect to the vCenter Server and as administrator: Go to "Home > Inventory > Hosts and clusters". Select each ESXi host with active virtual switches connected to active VM's requiring securing. Go to the tab "Configuration >> Network >> vSwitch(?) >> Properties >> Ports >> vSwitch >> Default Policies >> Security". Verify "Promiscuous Mode" = "Reject". |
| Fix Text (F-ESXI5-VMNET-000018_fix) |
|---|
| From the vSphere Client/vCenter Server as administrator: Go to "Home>> Inventory>> Hosts and clusters". Select each ESXi host with active virtual switches connected to active VMs requiring securing. Go to tab "Configuration>> Network>> vSwitch(?)>> Properties>> Ports>> vSwitch>> Default Policies>> Security". Set "Promiscuous Mode" = "Reject". |