Host must filter Bridge Protocol Data Unit (BPDU) packets

СредњаНиво 1Аутоматскаvmware

Опис

To prevent cascading lockout of uplink interfaces from the ESXi host, the Net.BlockGuestBPDU parameter can be set to 1, enabling BPDU Filter to drop BPDU packets sent from virtual machines to the physical switch. This is crucial as ESXi's Standard and Distributed Virtual Switches do not support STP, making them prone to network loops if BPDUs are unfiltered. The audit reads Net.BlockGuestBPDU with esxcli and requires 1. Runs in the ESXi Shell (busybox sh) as root.

Како се проверава

Метод провере: Команда љуске

shell

out=$(esxcli system settings advanced list -o /Net/BlockGuestBPDU 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Net/BlockGuestBPDU: no integer value'; exit 1 ;; esac
if [ "$v" -eq 1 ]; then echo compliant; else echo "/Net/BlockGuestBPDU = $v (expected 1)"; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

From an administrative PowerCLI session: Execute - Get-VMHost | Get-AdvancedSetting -Name Net.BlockGuestBPDU | Set-AdvancedSetting - Value 1 -Confirm:$false. Validate network appliances/virtual switching workloads before enforcing this setting.

Својства

Оперативни системи: Било који
Ознаке: vmwareesxinetwork
Референца: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.4 Host must filter Bridge Protocol Data Unit (BPDU) packets

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target vmware