VMware ESXi
TMA-ESXI9-6.2.1
Host must isolate storage communications
Description
Isolating storage communications through zoning and Logical Unit Number (LUN) masking is instrumental in segregating Storage Area Network (SAN) activity. Zoning defines the connections between host bus adapters (HBAs) and targets, ensuring devices outside a zone remain invisible to the devices within, thus facilitating the independent management of zones such as testing and ... Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.
How it is checked
Audit method: Manual review
The audit procedures to verify SAN activity is properly segregated are SAN vendor or product-specific.
How it is fixed
Fix method: Guidance or infrastructure patch
The remediation procedures to properly segregate SAN activity are SAN vendor or product-specific. In general, with ESXi hosts, use a single-initiator zoning or a single-initiator-single-target zoning. The latter is a preferred zoning practice. Using the more restrictive zoning prevents problems and misconfigurations that can occur on the SAN.
Properties
- Operating systems
- Any
- Tags
- vmwareesxiservices
- Reference
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.2.1 Host must isolate storage communications