The system must configure the firewall to block network traffic by default.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-63283 | ESXI-06-000057 | SV-77773r1_rule | Medium |
| Description |
|---|
| In addition to service specific firewall rules ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic. Reduce the risk of attack by making sure this is set to deny incoming and outgoing traffic. |
| STIG | Date |
|---|---|
| VMware vSphere ESXi 6.0 Security Technical Implementation Guide | 2019-01-04 |
Details
| Check Text ( C-64017r1_chk ) |
|---|
| From a PowerCLI command prompt while connected to the ESXi host run the following command: Get-VMHostFirewallDefaultPolicy If the Incoming or Outgoing policies are True, this is a finding. |
| Fix Text (F-69201r1_fix) |
|---|
| From a PowerCLI command prompt while connected to the ESXi host run the following command: Get-VMHostFirewallDefaultPolicy | Set-VMHostFirewallDefaultPolicy -AllowIncoming $false -AllowOutgoing $false |