The vCenter Server must set the distributed port group Promiscuous Mode policy to "Reject".

An XCCDF Rule

Description

<VulnDiscussion>When promiscuous mode is enabled for a virtual switch, all virtual machines connected to the port group have the potential of reading all packets across that network, meaning only the virtual machines connected to that port group. Promiscuous mode is disabled by default on the ESXi Server, and this is the recommended setting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-258937r934469_rule
Severity: Medium
References: CCI-000366
Updated: 17 days ago

From the vSphere Client, go to "Networking".

Select a distributed switch >> Select a port group >> Configure >> Settings >> Policies.

Click "Edit".
Click the "Security" tab.

Set "Promiscuous Mode" to "Reject".

Click "OK".
 
or

From a PowerCLI command prompt while connected to the vCenter server, run the following commands:

Get-VDSwitch | Get-VDSecurityPolicy | Set-VDSecurityPolicy -AllowPromiscuous $false
Get-VDPortgroup | ?{$_.IsUplink -eq $false} | Get-VDSecurityPolicy | Set-VDSecurityPolicy -AllowPromiscuous $false

The vCenter Server must set the distributed port group Promiscuous Mode policy to "Reject".

Description

Remediation - Manual Procedure