The NSX-T Tier-1 Gateway must be configured to have all inactive interfaces removed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-251770	T1RT-3X-000016	SV-251770r810210_rule		High

Description
An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. If an interface is no longer used, the configuration must be deleted.

STIG	Date
VMware NSX-T Tier 1 Gateway RTR Security Technical Implementation Guide	2022-03-09

Details

Check Text ( C-55207r810208_chk )
From the NSX-T Manager web interface, go to Networking >> Tier-1 Gateways. For every Tier-1 Gateway, expand the Tier-1 Gateway. Click on the number in the Linked Segments to review the currently linked segments. For every Tier-1 Gateway, expand the Tier-1 Gateway. Expand Service Interfaces, then click on the number to review the Service Interfaces. Review each interface or linked segment present to determine if they are not in use or inactive. If there are any linked segments or service interfaces present on a Tier-1 Gateway that are not in use or inactive, this is a finding.

Check Text ( C-55207r810208_chk )

From the NSX-T Manager web interface, go to Networking >> Tier-1 Gateways.

For every Tier-1 Gateway, expand the Tier-1 Gateway. Click on the number in the Linked Segments to review the currently linked segments.

For every Tier-1 Gateway, expand the Tier-1 Gateway. Expand Service Interfaces, then click on the number to review the Service Interfaces.

Review each interface or linked segment present to determine if they are not in use or inactive.

If there are any linked segments or service interfaces present on a Tier-1 Gateway that are not in use or inactive, this is a finding.

Fix Text (F-55161r810209_fix)
To remove a stale linked segment from a Tier-1 Gateway, do the following: From the NSX-T Manager web interface, go to Networking >> Segments and edit the target segment. Under Connected Gateway, change to "None" and click "Save". Note: The stale linked segment can also be deleted if there are no active workloads attached to it. To remove a stale service interface from a Tier-1 Gateway, do the following: From the NSX-T Manager web interface, go to Networking >> Tier-1 Gateways >> Edit the target Tier-1 Gateway. Expand Service Interfaces >> click on the number to view the Service Interfaces. On the stale service interface, select "Delete" and click "Delete" again to confirm.

Fix Text (F-55161r810209_fix)

To remove a stale linked segment from a Tier-1 Gateway, do the following:

From the NSX-T Manager web interface, go to Networking >> Segments and edit the target segment.

Under Connected Gateway, change to "None" and click "Save".

Note: The stale linked segment can also be deleted if there are no active workloads attached to it.

To remove a stale service interface from a Tier-1 Gateway, do the following:

From the NSX-T Manager web interface, go to Networking >> Tier-1 Gateways >> Edit the target Tier-1 Gateway.

Expand Service Interfaces >> click on the number to view the Service Interfaces.

On the stale service interface, select "Delete" and click "Delete" again to confirm.