All dvPortgroup VLAN IDs must be fully documented.

From VMware ESXi Server 5.0 Security Technical Implementation Guide

Associated with: CCI-000366

SV-51214r2_rule All dvPortgroup VLAN IDs must be fully documented.

Vulnerability discussion

If using VLAN tagging on a dvPortgroup, tags must correspond to the IDs on external VLAN-aware upstream switches if any. If VLAN IDs are not tracked completely, mistaken re-use of IDs could allow for traffic to be allowed between inappropriate physical and virtual machines. Similarly, wrong or missing VLAN IDs may lead to traffic not passing between appropriate physical and virtual machines.

Check content

If a vNetwork Distributed Switch (vDS) is not configured, this is not applicable. From the vSphere Client log into vCS. Home >> Inventory >> Networking. Select dvSwitch and dvPortgroup and Edit Settings >> Policies >> VLAN >> VLAN ID. The dvPortGroup VLAN tags must be documented to match the IDs on external VLAN-aware upstream switches. Verify that VLAN IDs are documented and matched in an (organization-specific) tracking system. If the VLAN tagging on a dvPortgroup does not correspond to the IDs on external VLAN-aware upstream switches, this is a finding.

Fix text

From the vSphere Client log into vCS. Home >> Inventory >> Networking. Select dvSwitch and dvPortgroup and Edit Settings >> Policies >> VLAN >> VLAN ID. Record all VLAN IDs in an organization defined tracking system.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.