6.5.1

n
Ensure that only authorized administrators have access to virtual networking components by using
the role-based access controls. For example, give virtual machine administrators only access to port
groups in which their virtual machines reside. Give network administrators access to all virtual
networking components but no access to virtual machines. Limiting access reduces the risk of
misconfiguration, whether accidental or malicious, and enforces key security concepts of separation
of duties and least privilege.
n
Ensure that port groups are not configured to the value of the native VLAN. Physical switches use
VLAN 1 as their native VLAN. Frames on a native VLAN are not tagged with a 1. ESXi does not have
a native VLAN. Frames with VLAN specified in the port group have a tag, but frames with VLAN not
specified in the port group are not tagged. This can cause an issue because virtual machines that are
tagged with a 1 end up belonging to native VLAN of the physical switch.
For example, frames on VLAN 1 from a Cisco physical switch are untagged because VLAN 1 is the
native VLAN on that physical switch. However, frames from the ESXi host that are specified as VLAN
1 are tagged with a 1. As a result, traffic from the ESXi host that is destined for the native VLAN is not
routed correctly because it is tagged with a 1 instead of being untagged. Traffic from the physical
switch that is coming from the native VLAN is not visible because it is not tagged. If the ESXi virtual
switch port group uses the native VLAN ID, traffic from virtual machines on that port is not visible to
the native VLAN on the switch because the switch is expecting untagged traffic.
n
Ensure that port groups are not configured to VLAN values reserved by upstream physical switches.
Physical switches reserve certain VLAN IDs for internal purposes and often disallow traffic configured
to these values. For example, Cisco Catalyst switches typically reserve VLANs 1001–1024 and 4094.
Using a reserved VLAN might result in a denial of service on the network.
n
Ensure that port groups are not configured to VLAN 4095 except for Virtual Guest Tagging (VGT).
Setting a port group to VLAN 4095 activates VGT mode. In this mode, the virtual switch passes all
network frames to the virtual machine without modifying the VLAN tags, leaving it to the virtual
machine to deal with them.
n
Restrict port-level configuration overrides on a distributed virtual switch. Port-level configuration
overrides are disabled by default. When overrides are enabled, you can use different security settings
for a virtual machine than the port-group level settings. Certain virtual machines require unique
configurations, but monitoring is essential. If overrides are not monitored, anyone who gains access
to a virtual machine with a less secure distributed virtual switch configuration might attempt to exploit
that access.
n
Ensure that distributed virtual switch port mirror traffic is sent only to authorized collector ports or
VLANs. A vSphere Distributed Switch can mirror traffic from one port to another to allow packet
capture devices to collect specific traffic flows. Port mirroring sends a copy of all specified traffic in
unencrypted format. This mirrored traffic contains the full data in the packets captured and can result
in total compromise of that data if misdirected. If port mirroring is required, verify that all port mirror
destination VLAN, port and uplink IDs are correct.
vSphere Security
VMware, Inc. 196