VMware NSX 4.x Manager NDM Security Technical Implementation Guide
Pick two releases to diff their requirements.
Open a previous version of this STIG.
Digest of Updates +28 −28
Comparison against the immediately-prior release (V1R1). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.
Added rules 28
- V-265289 Medium The NSX Manager must configure logging levels for services to ensure audit records are generated.
- V-265292 High The NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.
- V-265293 Medium The NSX Manager must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.
- V-265294 Medium The NSX Manager must display the Standard Mandatory DOD Notice and Consent Banner before granting access.
- V-265295 Medium The NSX Manager must retain the Standard Mandatory DOD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.
- V-265296 High The NSX Manager must be configured to integrate with an identity provider that supports multifactor authentication (MFA).
- V-265313 Medium The NSX Manager must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
- V-265315 High The NSX Manager must only enable TLS 1.2 or greater.
- V-265316 Medium The NSX Manager must enforce a minimum 15-character password length for local accounts.
- V-265317 Medium The NSX Manager must enforce password complexity by requiring that at least one uppercase character be used for local accounts.
- V-265318 Medium The NSX Manager must enforce password complexity by requiring that at least one lowercase character be used for local accounts.
- V-265319 Medium The NSX Manager must enforce password complexity by requiring that at least one numeric character be used for local accounts.
- V-265320 Medium The NSX Manager must enforce password complexity by requiring that at least one special character be used for local accounts.
- V-265321 Medium The NSX Manager must require that when a password is changed, the characters are changed in at least eight of the positions within the password.
- V-265327 High The NSX Manager must terminate all network connections associated with a session after five minutes of inactivity.
- V-265338 Medium The NSX Manager must be configured to synchronize internal information system clocks using redundant authoritative time sources.
- V-265339 Medium The NSX Manager must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
- V-265346 Medium The NSX Manager must be configured to protect against denial-of-service (DoS) attacks by limit the number of concurrent sessions to an organization-defined number.
- V-265348 High The NSX Manager must be configured to send logs to a central log server.
- V-265349 Low The NSX Manager must not provide environment information to third parties.
- V-265350 Medium The NSX Manager must be configured to conduct backups on an organizationally defined schedule.
- V-265351 Medium The NSX Manager must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
- V-265352 High The NSX Manager must be running a release that is currently supported by the vendor.
- V-265353 Medium The NSX Manager must disable SSH.
- V-265354 Medium The NSX Manager must disable SNMP v2.
- V-265355 Medium The NSX Manager must enable the global FIPS compliance mode for load balancers.
- V-265358 Medium The NSX Manager must be configured as a cluster.
- V-265359 Medium The NSX Managers must be deployed on separate physical hosts.
Removed rules 28
- V-263202 Medium The NSX Manager must configure logging levels for services to ensure audit records are generated.
- V-263203 High The NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.
- V-263204 Medium The NSX Manager must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.
- V-263205 Medium The NSX Manager must display the Standard Mandatory DOD Notice and Consent Banner before granting access.
- V-263206 Medium The NSX Manager must retain the Standard Mandatory DOD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access.
- V-263207 High The NSX Manager must be configured to integrate with an identity provider that supports multifactor authentication (MFA).
- V-263208 Medium The NSX Manager must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.
- V-263209 High The NSX Manager must only enable TLS 1.2 or greater.
- V-263210 Medium The NSX Manager must enforce a minimum 15-character password length for local accounts.
- V-263211 Medium The NSX Manager must enforce password complexity by requiring that at least one uppercase character be used for local accounts.
- V-263212 Medium The NSX Manager must enforce password complexity by requiring that at least one lowercase character be used for local accounts.
- V-263213 Medium The NSX Manager must enforce password complexity by requiring that at least one numeric character be used for local accounts.
- V-263214 Medium The NSX Manager must enforce password complexity by requiring that at least one special character be used for local accounts.
- V-263215 Medium The NSX Manager must require that when a password is changed, the characters are changed in at least eight of the positions within the password.
- V-263216 High The NSX Manager must terminate all network connections associated with a session after five minutes of inactivity.
- V-263217 Medium The NSX Manager must be configured to synchronize internal information system clocks using redundant authoritative time sources.
- V-263218 Medium The NSX Manager must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC).
- V-263219 Medium The NSX Manager must be configured to protect against denial-of-service (DoS) attacks by limit the number of concurrent sessions to an organization-defined number.
- V-263220 High The NSX Manager must be configured to send logs to a central log server.
- V-263221 Info The NSX Manager must not provide environment information to third parties.
- V-263222 Medium The NSX Manager must be configured to conduct backups on an organizationally defined schedule.
- V-263223 Medium The NSX Manager must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
- V-263224 High The NSX Manager must be running a release that is currently supported by the vendor.
- V-263225 Medium The NSX Manager must disable SSH.
- V-263226 Medium The NSX Manager must disable SNMP v2.
- V-263227 Medium The NSX Manager must enable the global FIPS compliance mode for load balancers.
- V-263228 Medium The NSX Manager must be configured as a cluster.
- V-263229 Medium The NSX Managers must be deployed on separate physical hosts.
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-001403
- Version
- NMGR-4X-000007
- Vuln IDs
-
- V-265289
- Rule IDs
-
- SV-265289r994090_rule
Checks: C-69206r994088_chk
From an NSX Manager shell, run the following commands: > get service async_replicator | find Logging > get service auth | find Logging > get service http | find Logging > get service manager | find Logging > get service telemetry | find Logging Expected result: Logging level: info If any service listed does not have logging level configured to "info", this is a finding.
Fix: F-69114r994089_fix
From an NSX Manager shell, run the following commands: > set service async_replicator logging-level info > set service auth logging-level info > set service http logging-level info > set service manager logging-level info > set service telemetry logging-level info
- RMF Control
- AC-3
- Severity
- H
- CCI
- CCI-000213
- Version
- NMGR-4X-000010
- Vuln IDs
-
- V-265292
- Rule IDs
-
- SV-265292r994099_rule
Checks: C-69209r994097_chk
From the NSX Manager web interface, go to System >> Settings >> User Management >> User Role Assignment. View each user and group and verify the role assigned has authorization limits as appropriate to the role and in accordance with the site's documentation. If any user/group or service account are assigned to roles with privileges that are beyond those required and authorized by the organization, this is a finding.
Fix: F-69117r994098_fix
To create a new role with reduced permissions, do the following: From the NSX Manager web interface, go to System >> Settings >> User Management >> Roles. Click "Add Role", provide a name and the required permissions, and then click "Save". To update user or group permissions to an existing role with reduced permissions, do the following: From the NSX Manager web interface, go to System >> User Management >> User Role Assignment. Click the menu dropdown next to the target user or group and select "Edit". Remove the existing role, select the new one, and then click "Save".
- RMF Control
- AC-7
- Severity
- M
- CCI
- CCI-000044
- Version
- NMGR-4X-000012
- Vuln IDs
-
- V-265293
- Rule IDs
-
- SV-265293r994102_rule
Checks: C-69210r994100_chk
From an NSX Manager shell, run the following commands: > get auth-policy api lockout-reset-period Expected result: 900 seconds If the output does not match the expected result, this is a finding. > get auth-policy api lockout-period Expected result: 900 seconds If the output does not match the expected result, this is a finding. > get auth-policy api max-auth-failures Expected result: 3 If the output does not match the expected result, this is a finding. > get auth-policy cli lockout-period Expected result: 900 seconds If the output does not match the expected result, this is a finding. > get auth-policy cli max-auth-failures Expected result: 3 If the output does not match the expected result, this is a finding.
Fix: F-69118r994101_fix
From an NSX Manager shell, run the following commands: > set auth-policy api lockout-reset-period 900 > set auth-policy api lockout-period 900 > set auth-policy api max-auth-failures 3 > set auth-policy cli lockout-period 900 > set auth-policy cli max-auth-failures 3
- RMF Control
- AC-8
- Severity
- M
- CCI
- CCI-000048
- Version
- NMGR-4X-000013
- Vuln IDs
-
- V-265294
- Rule IDs
-
- SV-265294r994105_rule
Checks: C-69211r994103_chk
Determine if the network device is configured to present a DOD-approved banner that is formatted in accordance with DTM-08-060. From the NSX Manager web interface, go to System >> Settings >> General Settings >> User Interface. Review the Login Consent Settings. If the "Consent Message Description" does not contain the Standard Mandatory DOD Notice and Consent Banner verbiage, this is a finding. The Standard Mandatory DOD Notice and Consent Banner verbiage is as follows: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
Fix: F-69119r994104_fix
From the NSX Manager web interface, go to System >> Settings >> General Settings >> User Interface. Under Login Consent Settings click "Edit". Enter the banner language in the "Consent Message Description" text box, formatted in accordance with DTM-08-060, and click "Save". "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
- RMF Control
- AC-8
- Severity
- M
- CCI
- CCI-000050
- Version
- NMGR-4X-000014
- Vuln IDs
-
- V-265295
- Rule IDs
-
- SV-265295r994108_rule
Checks: C-69212r994106_chk
From the NSX Manager web interface, go to System >> Settings >> General Settings >> User Interface. Review the Login Consent Settings. Verify "Login Consent" is not On. Verify "Require Explicit User Consent" is set to Yes. If the Standard Mandatory DOD Notice and Consent Banner is not retained on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log on for further access, this is a finding.
Fix: F-69120r994107_fix
From the NSX Manager web interface, go to System >> Settings >> General Settings >> User Interface. Under Login Consent Settings, click "Edit". Toggle "Login Consent" to On. Toggle "Require Explicit User Consent" to Yes. Note: The banner text is also entered; however, that is covered by NMGR-4X-000013.
- RMF Control
- AU-10
- Severity
- H
- CCI
- CCI-000166
- Version
- NMGR-4X-000015
- Vuln IDs
-
- V-265296
- Rule IDs
-
- SV-265296r994111_rule
Checks: C-69213r994109_chk
From the NSX Manager web interface, go to System >> Settings >> Users Management >> Authentication Providers. Verify that the "VMware Identity Manager" and "OpenID Connect" tabs are configured. If NSX is not configured to integrate with an identity provider that supports MFA, this is a finding.
Fix: F-69121r994110_fix
To configure NSX to integrate with VMware Identity Manager or Workspace ONE Access, as the authentication source, do the following: From the NSX Manager web interface, go to System >> Users and Roles >> VMware Identity Manager and click "Edit". If using an external load balancer for the NSX Management cluster, enable "External Load Balancer Integration". If using a cluster VIP, leave this disabled. Click the toggle button to enable "VMware Identity Manager Integration". Enter the VMware Identity Manager or Workspace ONE Access appliance name, OAuth Client ID, OAuth Client Secret, and certificate thumbprint as provided by the administrators. Enter the NSX Appliance FQDN. For a cluster, enter the load balancer FQDN or cluster VIP FQDN. Click "Save", import users and groups, and then assign them roles. (The users are not actually local and remain in the authentication/AAA server.) Note: As of NSX 4.1 and vCenter 8.0 Update 2, NSX Manager administrator access can also be configured by connecting VMware NSX to the Workspace ONE Access Broker in VMware vCenter for federated identity. Refer to the NSX product documentation to configure this access option. Ensure the identity provider administrators have configured the provider to support multi-factor authentication.
- RMF Control
- AC-2
- Severity
- M
- CCI
- CCI-001358
- Version
- NMGR-4X-000035
- Vuln IDs
-
- V-265313
- Rule IDs
-
- SV-265313r1051115_rule
Checks: C-69230r994160_chk
From the NSX Manager web interface, go to the System >> Settings >> User Management >> Local Users and view the status column. If any local account other than the account of last resort are active, this is a finding.
Fix: F-69138r994161_fix
From the NSX Manager web interface, go to the System >> Settings >> User Management >> Local Users. Select the menu drop down next to any local user on the list except for the "admin" account. Click modify and click "Deactivate User".
- RMF Control
- IA-2
- Severity
- H
- CCI
- CCI-001941
- Version
- NMGR-4X-000038
- Vuln IDs
-
- V-265315
- Rule IDs
-
- SV-265315r994168_rule
Checks: C-69232r994166_chk
Viewing TLS protocol enablement must be done via the API. Execute the following API call using curl or another REST API client: GET https://<nsx-mgr>/api/v1/cluster/api-service Example result: "protocol_versions": [ { "name": "TLSv1.1", "enabled": false }, { "name": "TLSv1.2", "enabled": true }, { "name": "TLSv1.3", "enabled": true } ] If TLS 1.1 is enabled, this is a finding.
Fix: F-69140r994167_fix
Capture the output from the check GET command and update the TLS 1.1 protocol to false. Run the following API call using curl or another REST API client: PUT https://<nsx-mgr>/api/v1/cluster/api-service Example request body: { "session_timeout": 1800, "connection_timeout": 30, "protocol_versions": [ { "name": "TLSv1.1", "enabled": false }, { "name": "TLSv1.2", "enabled": true }, { "name": "TLSv1.3", "enabled": true } ], "cipher_suites": [ { "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "enabled": true }, { "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "enabled": true }, { "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "enabled": true }, { "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "enabled": true }, { "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "enabled": true }, { "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "enabled": true }, { "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "enabled": true }, { "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "enabled": true }, { "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "enabled": true }, { "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "enabled": true }, { "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "enabled": true }, { "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "enabled": true }, { "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "enabled": true }, { "name": "TLS_AES_128_GCM_SHA256", "enabled": true }, { "name": "TLS_AES_256_GCM_SHA384", "enabled": true }, { "name": "TLS_CHACHA20_POLY1305_SHA256", "enabled": true } ], "redirect_host": "", "client_api_rate_limit": 100, "global_api_concurrency_limit": 199, "client_api_concurrency_limit": 40, "basic_authentication_enabled": true, "cookie_based_authentication_enabled": true, "resource_type": "ApiServiceConfig", "id": "reverse_proxy_config", "display_name": "reverse_proxy_config", "_create_time": 1703175890703, "_create_user": "system", "_last_modified_time": 1703175890703, "_last_modified_user": "system", "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Note: Changes are applied to all nodes in the cluster. The API service on each node will restart after it is updated using this API. There may be a delay of up to a minute or so between the time this API call completes and when the new configuration goes into effect.
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000205
- Version
- NMGR-4X-000039
- Vuln IDs
-
- V-265316
- Rule IDs
-
- SV-265316r994171_rule
Checks: C-69233r994169_chk
From an NSX Manager shell, run the following command: > get password-complexity If the minimum password length is not 15 or greater, this is a finding.
Fix: F-69141r994170_fix
From an NSX Manager shell, run the following command: > set password-complexity minimum-password-length 15
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000192
- Version
- NMGR-4X-000040
- Vuln IDs
-
- V-265317
- Rule IDs
-
- SV-265317r994174_rule
Checks: C-69234r994172_chk
From an NSX Manager shell, run the following command: > get password-complexity If the minimum uppercase characters is not 1 or more, this is a finding. Note: If a maximum number of uppercase characters has been configured a minimum will not be shown.
Fix: F-69142r994173_fix
From an NSX Manager shell, run the following command: > set password-complexity upper-chars -1 Note: Negative numbers indicate a minimum number of characters.
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000193
- Version
- NMGR-4X-000041
- Vuln IDs
-
- V-265318
- Rule IDs
-
- SV-265318r994177_rule
Checks: C-69235r994175_chk
From an NSX Manager shell, run the following command: > get password-complexity If the minimum lowercase characters is not 1 or more, this is a finding. Note: If a maximum number of lowercase characters has been configured, a minimum will not be shown.
Fix: F-69143r994176_fix
From an NSX Manager shell, run the following command: > set password-complexity lower-chars -1 Note: Negative numbers indicate a minimum number of characters.
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000194
- Version
- NMGR-4X-000042
- Vuln IDs
-
- V-265319
- Rule IDs
-
- SV-265319r994180_rule
Checks: C-69236r994178_chk
From an NSX Manager shell, run the following command: > get password-complexity If the minimum numeric characters is not 1 or more, this is a finding. Note: If a maximum number of numeric characters has been configured, a minimum will not be shown.
Fix: F-69144r994179_fix
From an NSX Manager shell, run the following command: > set password-complexity digits -1 Note: Negative numbers indicate a minimum number of characters.
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-001619
- Version
- NMGR-4X-000043
- Vuln IDs
-
- V-265320
- Rule IDs
-
- SV-265320r994183_rule
Checks: C-69237r994181_chk
From an NSX Manager shell, run the following command: > get password-complexity If the minimum special characters is not 1 or more, this is a finding. Note: If a maximum number of special characters has been configured, a minimum will not be shown.
Fix: F-69145r994182_fix
From an NSX Manager shell, run the following command: > set password-complexity special-chars -1 Note: Negative numbers indicate a minimum number of characters.
- RMF Control
- IA-5
- Severity
- M
- CCI
- CCI-000195
- Version
- NMGR-4X-000044
- Vuln IDs
-
- V-265321
- Rule IDs
-
- SV-265321r1043189_rule
Checks: C-69238r994184_chk
From an NSX Manager shell, run the following command: > get password-complexity If the number of consecutive characters allowed for reuse is not eight or more, this is a finding. Note: If this has not previously been configured it will not be shown in the output.
Fix: F-69146r994185_fix
From an NSX Manager shell, run the following command: > set password-complexity max-repeats 8
- RMF Control
- SC-10
- Severity
- H
- CCI
- CCI-001133
- Version
- NMGR-4X-000052
- Vuln IDs
-
- V-265327
- Rule IDs
-
- SV-265327r994204_rule
Checks: C-69244r994202_chk
From an NSX Manager shell, run the following command: > get service http | find Session Expected result: Session timeout: 300 If the session timeout is not configured to 300 or less, this is a finding. From an NSX Manager shell, run the following command: > get cli-timeout Expected result: 300 seconds If the CLI timeout is not configured to 300 or less, this is a finding.
Fix: F-69152r994203_fix
From an NSX Manager shell, run the following commands: > set service http session-timeout 300 > set cli-timeout 300
- RMF Control
- AU-8
- Severity
- M
- CCI
- CCI-001893
- Version
- NMGR-4X-000067
- Vuln IDs
-
- V-265338
- Rule IDs
-
- SV-265338r994237_rule
Checks: C-69255r994235_chk
From the NSX Manager web interface, go to System >> Configuration >> Fabric >> Profiles >> Node Profiles. Click "All NSX Nodes" and verify the NTP servers listed. or From an NSX Manager shell, run the following command: > get ntp-server If the output does not contain at least two authoritative time sources, this is a finding. If the output contains unknown or nonauthoritative time sources, this is a finding.
Fix: F-69163r994236_fix
To configure a profile to apply NTP servers to all NSX Manager nodes, do the following: From the NSX Manager web interface, go to System >> Configuration >> Fabric >> Profiles >> Node Profiles. Click "All NSX Nodes" and then click "Edit". Under NTP servers, remove any unknown or nonauthoritative NTP servers, enter at least two authoritative servers, and then click "Save". or From an NSX Manager shell, run the following commands: > del ntp-server <server-ip or server-name> > set ntp-server <server-ip or server-name>
- RMF Control
- AU-8
- Severity
- M
- CCI
- CCI-001890
- Version
- NMGR-4X-000068
- Vuln IDs
-
- V-265339
- Rule IDs
-
- SV-265339r994240_rule
Checks: C-69256r994238_chk
From the NSX Manager web interface, go to System >> Configuration >> Fabric >> Profiles >> Node Profiles. Note: This check must be run from each NSX Manager as they are configured individually if done from the command line. Click "All NSX Nodes" and verify the time zone. or From an NSX Manager shell, run the following command: > get clock If system clock is not configured with the UTC time zone, this is a finding.
Fix: F-69164r994239_fix
To configure a profile to apply a time zone to all NSX Manager nodes, do the following: From the NSX Manager web interface, go to System >> Configuration >> Fabric >> Profiles >> Node Profiles. Click "All NSX Nodes", and then click "Edit". In the time zone drop-down list, select "UTC", and then click "Save". or From an NSX Manager shell, run the following command: > set timezone UTC Note: This fix must be run from each NSX Manager as they are configured individually if done from the command line.
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-002385
- Version
- NMGR-4X-000079
- Vuln IDs
-
- V-265346
- Rule IDs
-
- SV-265346r994261_rule
Checks: C-69263r994259_chk
From an NSX Manager shell, run the following command: > get service http | find limit Expected result: Client API concurrency limit: 40 connections Global API concurrency limit: 199 connections If the NSX does not limit the number of concurrent sessions to an organization-defined number, this is a finding.
Fix: F-69171r994260_fix
From an NSX Manager shell, run the following commands: > set service http client-api-concurrency-limit 40 > set service http global-api-concurrency-limit 199 Note: The limit numbers in this example, while not mandatory, are the vendor recommend options. Setting the limits to lower numbers in a large environment that is very busy may cause operational issues. Setting the limits higher may cause resource contention so should be tested and monitored.
- RMF Control
- AU-4
- Severity
- H
- CCI
- CCI-001851
- Version
- NMGR-4X-000087
- Vuln IDs
-
- V-265348
- Rule IDs
-
- SV-265348r994267_rule
Checks: C-69265r994265_chk
From the NSX Manager web interface, go to System >> Fabric >> Profiles >> Node Profiles. Click "All NSX Nodes" and verify the Syslog servers listed. or From an NSX Manager shell, run the following command: > get logging-servers Note: This command must be run from each NSX Manager as they are configured individually. If no logging severs are configured or unauthorized logging servers are configured, this is a finding. If the log level is not set to INFO, this is a finding.
Fix: F-69173r994266_fix
To configure a profile to apply syslog servers to all NSX Manager nodes, do the following: From the NSX Manager web interface, go to System >> Fabric >> Profiles >> Node Profiles. Click "All NSX Nodes" and then under "Syslog Servers" click "Add". Enter the syslog server details and choose "Information" for the log level and click "Add". or (Optional) From an NSX Manager shell, run the following command to clear any existing incorrect logging-servers: > clear logging-servers From an NSX Manager shell, run the following command to configure a udp/tcp syslog server: > set logging-server <server-ip or server-name> proto <tcp or udp> level info From an NSX Manager shell, run the following command to configure a TLS syslog server: > set logging-server <server-ip or server-name> proto tls level info serverca ca.pem clientca ca.pem certificate cert.pem key key.pem From an NSX Manager shell, run the following command to configure an LI-TLS syslog server: > set logging-server <server-ip or server-name> proto li-tls level info serverca root-ca.crt Note: If using the protocols TLS or LI-TLS to configure a secure connection to a log server, the server and client certificates must be stored in /image/vmware/nsx/file-store on each NSX-T Manager appliance.
- RMF Control
- CM-6
- Severity
- L
- CCI
- CCI-000366
- Version
- NMGR-4X-000088
- Vuln IDs
-
- V-265349
- Rule IDs
-
- SV-265349r994270_rule
Checks: C-69266r994268_chk
From the NSX Manager web interface, go to System >> Settings >> General Settings >> Customer Program >> Customer Experience Improvement Program. If Joined is set to "Yes", this is a finding.
Fix: F-69174r994269_fix
From the NSX Manager web interface, go to System >> Settings >> General Settings >> Customer Program >> Customer Experience Improvement Program, and then click "Edit". Uncheck "Join the VMware Customer Experience Improvement Program" and click "Save".
- RMF Control
- CP-9
- Severity
- M
- CCI
- CCI-000539
- Version
- NMGR-4X-000093
- Vuln IDs
-
- V-265350
- Rule IDs
-
- SV-265350r994273_rule
Checks: C-69267r994271_chk
From the NSX Manager web interface, go to System >> Lifecycle Management >> Backup and Restore to view the backup configuration. If backup is not configured and scheduled on a recurring frequency, this is a finding.
Fix: F-69175r994272_fix
To configure a backup destination, do the following: From the NSX Manager web interface, go to System >> Lifecycle Management >> Backup and Restore, and then click "Edit" next to SFTP Server. Enter the target SFTP server, Directory Path, Username, Password, SSH Fingerprint, and Passphrase, and then click "Save". To configure a backup schedule, do the following: From the NSX Manager web interface, go to System >> Lifecycle Management >> Backup and Restore, and then click "Edit" next to Schedule. Click the "Recurring Backup" toggle and configure an interval between backups. Enable "Detect NSX configuration change" to trigger backups on detection of configuration changes and specify an interval for detecting changes. Click "Save".
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- NMGR-4X-000094
- Vuln IDs
-
- V-265351
- Rule IDs
-
- SV-265351r994276_rule
Checks: C-69268r994274_chk
NSX Manager uses a certificate for each manager and one for the cluster VIP. In some cases these are the same, but each node and cluster VIP certificate must be checked individually. Browse to the NSX Manager web interface for each node and cluster VIP and view the certificate and its issuer of the website. or From an NSX Manager shell, run the following commands: > get certificate api > get certificate cluster Save the output to a .cer file to examine. If the certificate the NSX Manager web interface or cluster is using is not issued by an approved certificate authority and is not currently valid, this is a finding.
Fix: F-69176r994275_fix
Obtain a certificate or certificates signed by an approved certification authority. This can be done individually by generating CSRs through the NSX Manager web interface >> System >> Settings >> Certificates >> CSRs >> Generate CSR or outside of NSX if a common manager and cluster certificate is desired. Import the certificate(s) into NSX by doing the following: From the NSX Manager web interface, go to System >> Settings >> Certificates >> Certificates >> Import >> Import Certificate. Provide a name for the certificate and paste the certificates contents and key. Uncheck "Service Certificate" and click "Import". After import, note the ID of the certificate(s). Using curl or another REST API client, perform the following API calls and replace the certificate IDs noted in the previous steps. To replace a managers certificate: POST https://<nsx-mgr>/api/v1/node/services/http?action=apply_certificate&certificate_id=e61c7537-3090-4149-b2b6-19915c20504f To replace the cluster certificate: POST https://<nsx-mgr>/api/v1/cluster/api-certificate?action=set_cluster_certificate&certificate_id=d60c6a07-6e59-4873-8edb-339bf75711ac Note: If an NSX Intelligence appliance is deployed with the NSX Manager cluster, update the NSX Manager node IP, certificate, and thumbprint information that is on the NSX Intelligence appliance. Refer to the VMware Knowledge Base article https://kb.vmware.com/s/article/78505 for more information.
- RMF Control
- CM-6
- Severity
- H
- CCI
- CCI-000366
- Version
- NMGR-4X-000096
- Vuln IDs
-
- V-265352
- Rule IDs
-
- SV-265352r994279_rule
Checks: C-69269r994277_chk
From the NSX Manager web interface, go to the System >> Lifecycle Management >> Upgrade. If the NSX Manager current version is not the latest approved for use in DOD and supported by the vendor, this is a finding.
Fix: F-69177r994278_fix
To upgrade NSX, reference the upgrade guide in the documentation for the relevant version being upgraded. Refer to the NSX documentation and release notes for information on the latest releases. https://docs.vmware.com/en/VMware-NSX/index.html If NSX is part of a VMware Cloud Foundation deployment, refer to that documentation for latest supported versions and upgrade guidance.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- NMGR-4X-000097
- Vuln IDs
-
- V-265353
- Rule IDs
-
- SV-265353r994282_rule
Checks: C-69270r994280_chk
From an NSX Manager shell, run the following command: > get service ssh Expected results: Service name: ssh Service state: stopped Start on boot: False If the SSH server is not stopped or starts on boot, this is a finding.
Fix: F-69178r994281_fix
From an NSX Manager shell, run the following command(s): > stop service ssh > clear service ssh start-on-boot
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- NMGR-4X-000098
- Vuln IDs
-
- V-265354
- Rule IDs
-
- SV-265354r994285_rule
Checks: C-69271r994283_chk
From the NSX Manager web interface, go to the System >> Configuration >> Fabric >> Profiles >> Node Profiles. Click "All NSX Nodes" and view the SNMP Polling and Traps configuration. If SNMP v2c Polling or Traps are configured, this is a finding.
Fix: F-69179r994284_fix
From the NSX Manager web interface, go to the System >> Configuration >> Fabric >> Profiles >> Node Profiles. Click on "All NSX Nodes" and delete and v2c Polling or Trap configurations.
- RMF Control
- CM-6
- Severity
- M
- CCI
- CCI-000366
- Version
- NMGR-4X-000099
- Vuln IDs
-
- V-265355
- Rule IDs
-
- SV-265355r994288_rule
Checks: C-69272r994286_chk
From the NSX Manager web interface, go to the Home >> Monitoring Dashboards >> Compliance Report. Review the compliance report for code 72024 with description load balancer FIPS global setting disabled. Note: This may also be checked via the API call GET https://<nsx-mgr>/policy/api/v1/infra/global-config If the global FIPS setting is disabled for load balancers, this is a finding.
Fix: F-69180r994287_fix
Execute the following API call using curl or another REST API client: PUT https://<nsx-mgr>/policy/api/v1/infra/global-config Example request body: { "fips": { "lb_fips_enabled": true }, "resource_type": "GlobalConfig", "_revision": 2 } The global setting is used when the new load balancer instances are created. Changing the setting does not affect existing load balancer instances. To update existing load balancers to use this setting, do the following: From the NSX Manager web interface, go to the Networking >> Load Balancing and then click "Edit" on the target load balancer. In the attachment field, click the "X" to detach the load balancer from its current Gateway and click "Save". Edit the target load balancer again, reattach it to its Gateway, and then click "Save". Caution: Detaching a load balancer from the Tier-1 gateway results in a traffic interruption for the load balancer instance.
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-002385
- Version
- NMGR-4X-000102
- Vuln IDs
-
- V-265358
- Rule IDs
-
- SV-265358r994297_rule
Checks: C-69275r994295_chk
From the NSX Manager web interface, go to System >> Configuration >> Appliances. Verify three NSX Managers are deployed, a VIP or external load balancer is configured, and the cluster is in a healthy state. If three NSX Managers are not deployed, a VIP or external load balancer is not configured, and the cluster is not in a healthy state, this is a finding.
Fix: F-69183r994296_fix
To add additional NSX Manager appliances do the following: From the NSX Manager web interface, go to System >> Configuration >> Appliances, and then click "Add NSX Appliance". Supply the required information to add additional nodes as needed, up to three total. To configure NSX with a cluster VIP or external load balancer, do the following: From the NSX Manager web interface, go to System >> Configuration >> Appliances, and then click "Set Virtual IP", enter a VIP that is part of the same subnet as the other management nodes, and then click "Save". To configure NSX with an external load balancer, setup an external load balancer with the following requirements: - Configure the external load balancer to control traffic to the NSX Manager nodes. - Configure the external load balancer to use the round robin method and configure source persistence for the load balancer's virtual IP. - Create or import a signed certificate and apply the same certificate to all the NSX Manager nodes. The certificate must have the FQDN of the virtual IP and each of the nodes in the SAN. Note: An external load balancer will not work with the NSX Manager VIP. Do not configure an NSX Manager VIP if using an external load balancer. If the cluster status is not in a healthy state, identify the degraded component on the appliance and troubleshoot the issue with the error information provided.
- RMF Control
- SC-5
- Severity
- M
- CCI
- CCI-002385
- Version
- NMGR-4X-000103
- Vuln IDs
-
- V-265359
- Rule IDs
-
- SV-265359r994300_rule
Checks: C-69276r994298_chk
This check must be performed in vCenter. From the vSphere Client, go to Administration >> Hosts and Clusters >> Select the cluster where the NSX Managers are deployed >> Configure >> Configuration >> VM/Host Rules. If the NSX Manager cluster does not have rules applied to it that separate the nodes onto different physical hosts, this is a finding.
Fix: F-69184r994299_fix
This fix must be performed in vCenter. From the vSphere Client, go to Administration >> Hosts and Clusters >> Select the cluster where the NSX Managers are deployed >> Configure >> Configuration >> VM/Host Rules. Click "Add" to create a new rule. Provide a name and select "Separate Virtual Machines" under Type. Add the three NSX Manager virtual machines to the list and click "OK".