Host must restrict the use of Virtual Guest Tagging (VGT) on standard virtual switches

中レベル 1自動vmware

説明

When a port group is set to VLAN 4095 on standard virtual switches, it enables Virtual Guest Tagging (VGT), letting all network frames pass to the attached virtual machines (VMs) without altering the VLAN tags. This requires VMs to process VLAN information themselves via an 802.1Q driver. The audit lists standard port groups and fails any using VLAN ID 4095 (Virtual Guest Tagging); document the exception when VGT is required. Runs in the ESXi Shell (busybox sh) as root.

チェック方法

監査方法: シェルコマンド

shell

out=$(esxcli --formatter=csv network vswitch standard portgroup list 2>/dev/null) || exit 1
bad=$(printf '%s\n' "$out" | awk -F, 'NR==1 {for (i = 1; i <= NF; i++) {if ($i == "Name") n = i; if ($i == "VLANID") l = i}; next} n && l && $l == "4095" {print $n}')
[ -z "$bad" ] && echo compliant || { echo 'port groups on VLAN 4095 (VGT):'; printf '%s\n' "$bad"; }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

To set port groups to values other than 4095 and 0 unless VGT is required, perform the following: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand Networking. 3. Select Virtual switches. 4. Expand the Standard vSwitch. 5. View the topology diagram of the switch, which shows the various port groups associated with that switch. 6. For each port group on the vSwitch, verify and record the VLAN IDs used. 7. If a VLAN ID change is needed, click the name of the port group in the topology diagram of the virtual switch. 8. Click the Edit settings option. 9. In the Properties section, enter an appropriate name in the Network label field. 10.

プロパティ

オペレーティングシステム: すべて
タグ: vmwareesxinetwork
参照: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.10 Host must restrict the use of Virtual Guest Tagging (VGT) on standard virtual switches

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target vmware