The NSX Manager must be configured to integrate with an identity provider that supports multifactor authentication (MFA).
An XCCDF Rule
Description
<VulnDiscussion>Common attacks against single-factor authentication are attacks on user passwords. These attacks include brute force password guessing, password spraying, and password credential stuffing. This requirement also supports nonrepudiation of actions taken by an administrator. This requirement ensures the NSX Manager is configured to use a centralized authentication services to authenticate users prior to granting administrative access. As of NSX 4.1 and vCenter 8.0 Update 2, NSX Manager administrator access can also be configured by connecting VMware NSX to the Workspace ONE Access Broker in VMware vCenter for federated identity. Refer to the NSX product documentation to configure this access option.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-263207r977388_rule
- Severity
- High
- References
- Updated
Remediation - Manual Procedure
To configure NSX to integrate with VMware Identity Manager or Workspace ONE Access, as the authentication source, do the following:
From the NSX Manager web interface, go to System >> Users and Roles >> VMware Identity Manager and click "Edit".
If using an external load balancer for the NSX Management cluster, enable "External Load Balancer Integration". If using a cluster VIP, leave this disabled.