UCF STIG Viewer Logo

The ESXi host must configure the firewall to block network traffic by default.


Overview

Finding ID Version Rule ID IA Controls Severity
V-239311 ESXI-67-000057 SV-239311r674862_rule Medium
Description
In addition to service-specific firewall rules, ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic. Reduce the risk of attack by making sure this is set to deny incoming and outgoing traffic.
STIG Date
VMware vSphere 6.7 ESXi Security Technical Implementation Guide 2022-01-05

Details

Check Text ( C-42544r674860_chk )
From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHostFirewallDefaultPolicy

If the Incoming or Outgoing policies are "True", this is a finding.
Fix Text (F-42503r674861_fix)
From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHostFirewallDefaultPolicy | Set-VMHostFirewallDefaultPolicy -AllowIncoming $false -AllowOutgoing $false