The vCenter Server must disable or restrict the connectivity between vSAN Health Check and public Hardware Compatibility List (HCL) by use of an external proxy server.

An XCCDF Rule

Description

<VulnDiscussion>The vSAN Health Check is able to download the HCL from VMware to check compliance against the underlying vSAN Cluster hosts. To ensure the vCenter server is not directly downloading content from the internet, this functionality must be disabled. If this feature is necessary, an external proxy server must be configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-256361r885694_rule
Severity: Medium
References: CCI-000366
Updated: 9 months ago

From the vSphere Client, go to Host and Clusters.

Select the vCenter Server >> Configure >> vSAN >> Internet Connectivity.

Click "Edit".
If the HCL internet download is not required, ensure "Status" is "Disabled".

If the HCL internet download is required, ensure "Status" is "Enabled" and a proxy host is appropriately configured.

The vCenter Server must disable or restrict the connectivity between vSAN Health Check and public Hardware Compatibility List (HCL) by use of an external proxy server.

Description

Remediation - Manual Procedure