The NSX Manager must be configured to integrate with an identity provider that supports multifactor authentication (MFA).

An XCCDF Rule

Description

Common attacks against single-factor authentication are attacks on user passwords. These attacks include brute force password guessing, password spraying, and password credential stuffing. This requirement also supports nonrepudiation of actions taken by an administrator. This requirement ensures the NSX Manager is configured to use a centralized authentication services to authenticate users prior to granting administrative access. As of NSX 4.1 and vCenter 8.0 Update 2, NSX Manager administrator access can also be configured by connecting VMware NSX to the Workspace ONE Access Broker in VMware vCenter for federated identity. Refer to the NSX product documentation to configure this access option. Satisfies: SRG-APP-000080-NDM-000220, SRG-APP-000149-NDM-000247, SRG-APP-000516-NDM-000336

ID: SV-265296r994111_rule
Version: NMGR-4X-000015
Severity: High
References: CCI-000166 CCI-000370 CCI-000765
Updated: about 2 months ago

Remediation Templates

To configure NSX to integrate with VMware Identity Manager or Workspace ONE Access, as the authentication source, do the following:

From the NSX Manager web interface, go to System >> Users and Roles >> VMware Identity Manager and click "Edit".

If using an external load balancer for the NSX Management cluster, enable "External Load Balancer Integration". If using a cluster VIP, leave this disabled.
Click the toggle button to enable "VMware Identity Manager Integration".

Enter the VMware Identity Manager or Workspace ONE Access appliance name, OAuth Client ID, OAuth Client Secret, and certificate thumbprint as provided by the administrators.

Enter the NSX Appliance FQDN. For a cluster, enter the load balancer FQDN or cluster VIP FQDN.

Click "Save", import users and groups, and then assign them roles. (The users are not actually local and remain in the authentication/AAA server.)

Note: As of NSX 4.1 and vCenter 8.0 Update 2, NSX Manager administrator access can also be configured by connecting VMware NSX to the Workspace ONE Access Broker in VMware vCenter for federated identity. Refer to the NSX product documentation to configure this access option.

Ensure the identity provider administrators have configured the provider to support multi-factor authentication.

The NSX Manager must be configured to integrate with an identity provider that supports multifactor authentication (MFA).

Description

Remediation Templates

A Manual Procedure