Virtual machines must require encryption for Fault Tolerance

MediumLevel 1Manual reviewvmware

Description

Requiring encryption for Fault Tolerance in virtual machines is critical for ensuring secure data transmission between primary and secondary VMs, especially in environments where sensitive data is processed. While the default setting 'opportunistic' may result in encryption due to widespread AES-NI support in vSphere-compatible hardware, enforcing the 'required' setting for ... Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

The following PowerCLI command may be used: (Get-VM -Name $VM).ExtensionData.Config.FtEncryptionMode

How it is fixed

Fix method: Guidance or infrastructure patch

The following PowerCLI command may be used: $VMview = Get-VM -Name $VM | Get-View $ConfigSpec = New-Object VMware.Vim.VirtualMachineConfigSpec $ConfigSpec.FtEncryptionMode = New-object VMware.Vim.VirtualMachineConfigSpecEncryptedFtModes $ConfigSpec.FtEncryptionMode = "ftEncryptionRequired" $VMview.ReconfigVM_Task($ConfigSpec)

Properties

Operating systems: Any
Tags: vmwareesxivirtual-machine
Reference: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 7.3 Virtual machines must require encryption for Fault Tolerance