The NSX-T Tier-1 Gateway must be configured to have all inactive interfaces removed.

An XCCDF Rule

Description

An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. If an interface is no longer used, the configuration must be deleted.

ID: SV-251770r810210_rule
Version: T1RT-3X-000016
Severity: High
References: CCI-001414
Updated: about 2 months ago

Remediation Templates

To remove a stale linked segment from a Tier-1 Gateway, do the following:

From the NSX-T Manager web interface, go to Networking >> Segments and edit the target segment.

Under Connected Gateway, change to "None" and click "Save".
Note: The stale linked segment can also be deleted if there are no active workloads attached to it.

To remove a stale service interface from a Tier-1 Gateway, do the following:

From the NSX-T Manager web interface, go to Networking >> Tier-1 Gateways >> Edit the target Tier-1 Gateway.

Expand Service Interfaces >> click on the number to view the Service Interfaces.

On the stale service interface, select "Delete" and click "Delete" again to confirm.

The NSX-T Tier-1 Gateway must be configured to have all inactive interfaces removed.

Description

Remediation Templates

A Manual Procedure