The vCenter Server must set the distributed port group Promiscuous Mode policy to "Reject".

An XCCDF Rule

Description

<VulnDiscussion>When promiscuous mode is enabled for a virtual switch, all virtual machines connected to the port group have the potential of reading all packets across that network, meaning only the virtual machines connected to that port group. Promiscuous mode is disabled by default on the ESXi Server, and this is the recommended setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-256350r942490_rule
Severity: Medium
References: CCI-000366
Updated: 9 months ago

From the vSphere Client, go to "Networking".

Select a distributed switch and then select a port group. 

Select Configure >> Settings >> Policies.
Click "Edit".

Click the "Security" tab.

Set "Promiscuous Mode" to "Reject".

Click "OK".
 
or

From a PowerCLI command prompt while connected to the vCenter server, run the following commands:

Get-VDSwitch | Get-VDSecurityPolicy | Set-VDSecurityPolicy -AllowPromiscuous $false
Get-VDPortgroup | ?{$_.IsUplink -eq $false} | Get-VDSecurityPolicy | Set-VDSecurityPolicy -AllowPromiscuous $false

The vCenter Server must set the distributed port group Promiscuous Mode policy to "Reject".

Description

Remediation - Manual Procedure