Host must filter Bridge Protocol Data Unit (BPDU) packets

보통레벨 1자동vmware

설명

To prevent cascading lockout of uplink interfaces from the ESXi host, the Net.BlockGuestBPDU parameter can be set to 1, enabling BPDU Filter to drop BPDU packets sent from virtual machines to the physical switch. This is crucial as ESXi's Standard and Distributed Virtual Switches do not support STP, making them prone to network loops if BPDUs are unfiltered. The audit reads Net.BlockGuestBPDU with esxcli and requires 1. Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

out=$(esxcli system settings advanced list -o /Net/BlockGuestBPDU 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Net/BlockGuestBPDU: no integer value'; exit 1 ;; esac
if [ "$v" -eq 1 ]; then echo compliant; else echo "/Net/BlockGuestBPDU = $v (expected 1)"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

From an administrative PowerCLI session: Execute - Get-VMHost | Get-AdvancedSetting -Name Net.BlockGuestBPDU | Set-AdvancedSetting - Value 1 -Confirm:$false. Validate network appliances/virtual switching workloads before enforcing this setting.

속성

운영 체제: 모두
태그: vmwareesxinetwork
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.4 Host must filter Bridge Protocol Data Unit (BPDU) packets

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware