Host must isolate management communications

СреднийУровень 1Ручная проверкаvmware

Описание

Ensure that only vmk interfaces designated for management purposes have management services enabled to uphold network isolation and security. Incorrect configuration may undermine security efforts by breaching network isolation principles. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Review VMkernel adapters with: esxcli network ip interface list Verify that management traffic is carried only on dedicated, approved VMkernel interfaces/VLANs and is not mixed with untrusted VM, storage, vMotion, or public traffic without an approved design.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To remediate this recommendation, create or move management VMkernel interfaces to dedicated management port groups/VLANs, apply firewall/ACL restrictions, and remove management service flags from interfaces that do not require them. Test vCenter connectivity before deleting the old path.

Свойства

Операционные системы: Любая
Теги: vmwareesxinetwork
Источник: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.11 Host must isolate management communications