6.0.3

n
Ensure that port groups are not congured to the value of the native VLAN. Physical switches use
VLAN 1 as their native VLAN. Frames on a native VLAN are not tagged with a 1. ESXi does not have a
native VLAN. Frames with VLAN specied in the port group have a tag, but frames with VLAN not
specied in the port group are not tagged. This can cause an issue because irtual machines that are
tagged with a 1 end up as belonging to native VLAN of the physical switch.
For example, frames on VLAN 1 from a Cisco physical switch are untagged because VLAN1 is the
native VLAN on that physical switch. However, frames from the ESXi host that are specied as VLAN 1
are tagged with a 1; therefore, trac from the ESXi host that is destined for the native VLAN is not
routed correctly because it is tagged with a 1 instead of being untagged. Trac from the physical switch
that is coming from the native VLAN is not visible because it is not tagged. If the ESXi virtual switch
port group uses the native VLAN ID, trac from virtual machines on that port is not be visible to the
native VLAN on the switch because the switch is expecting untagged trac.
n
Ensure that port groups are not congured to VLAN values reserved by upstream physical switches.
Physical switches reserve certain VLAN IDs for internal purposes and often disallow trac congured
to these values. For example, Cisco Catalyst switches typically reserve VLANs 1001–1024 and 4094.
Using a reserved VLAN might result in a denial of service on the network.
n
Ensure that port groups are not congured to VLAN 4095 except for Virtual Guest Tagging (VGT).
Seing a port group to VLAN 4095 activates VGT mode. In this mode, the virtual switch passes all
network frames to the virtual machine without modifying the VLAN tags, leaving it to the virtual
machine to deal with them.
n
Restrict port-level conguration overrides on a distributed virtual switch. Port-level conguration
overrides are disabled by default. Once enabled, overrides allow dierent security seings for a virtual
machine than the seings at the port-group level. Certain virtual machines require unique
congurations, but monitoring is essential. If overrides are not monitored, anyone who gains access to a
virtual with a less secure distributed virtual switch conguration might aempt to exploit that access.
n
Ensure that distributed virtual switch port mirror trac is sent only to authorized collector ports or
VLANs. A vSphere Distributed Switch can mirror trac from one port to another to allow packet
capture devices to collect specic trac ows. Port mirroring sends a copy of all specied trac in un-
encrypted format. This mirrored trac contains the full data in the packets captured and can result in
total compromise of that data if misdirected. If port mirroring is required, verify that all port mirror
destination VLAN, port and uplink IDs are correct.
Labeling Networking Components
Identifying the dierent components of your networking architecture is critical and helps ensure that no
errors are introduced as your network grows.
Follow these best practices:
n
Ensure that port groups are congured with a clear network label. These labels serve as a functional
descriptor for the port group and help you identify each port group's function as the network becomes
more complex.
n
Ensure that each vSphere Distributed Switch has a clear network label that indicates the function or IP
subnet of the switch. This label serves as a functional descriptor for the switch, just as physical switches
require a host name. For example, you can label the switch as internal to show that it is for internal
networking. You cannot change the label for a standard virtual switch.
vSphere Security
244 VMware, Inc.