The vCenter Server must remove unauthorized port mirroring sessions on distributed switches.
An XCCDF Rule
Description
The vSphere Distributed Virtual Switch can enable port mirroring sessions allowing traffic to be mirrored from one source to a destination. If port mirroring is configured unknowingly this could allow an attacker to observe network traffic of virtual machines.
- ID
- SV-258965r934553_rule
- Version
- VCSA-80-000300
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
From the vSphere Client, go to "Networking".
Select a distributed switch >> Configure >> Settings >> Port Mirroring.
Select the unauthorized "Port Mirroring" session and click "Remove". Click "OK".