The NSX-T Tier-1 Gateway Firewall must configure SpoofGuard to block outbound IP packets that contain illegitimate packet attributes.
An XCCDF Rule
Description
<VulnDiscussion>If outbound communications traffic is not filtered, hostile activity intended to harm other networks may not be detected and prevented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-251769r856688_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
To create a segment profile with SpoofGuard enabled do the following:
From the NSX-T Manager web interface, go to Networking >> Segments >> Segment Profiles >> Add Segment Profile >> SpoofGuard.
Enter a profile name and enable port bindings, then click "Save".