The vCenter Server must disable or restrict the connectivity between vSAN Health Check and public Hardware Compatibility List (HCL) by use of an external proxy server.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-258948 | VCSA-80-000281 | SV-258948r934502_rule | CCI-000366 | medium |
| Description | ||||
| The vSAN Health Check is able to download the HCL from VMware to check compliance against the underlying vSAN Cluster hosts. To ensure the vCenter server is not directly downloading content from the internet, this functionality must be disabled. If this feature is necessary, an external proxy server must be configured. | ||||
| STIG | Date | |||
| VMware vSphere 8.0 vCenter Security Technical Implementation Guide | 2023-10-11 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · V1R1 · disa_xccdf · related
Details
Check Text (C-258948r934502_chk)
If no clusters are enabled for vSAN, this is not applicable.
From the vSphere Client, go to Host and Clusters.
Select the vCenter Server >> Configure >> vSAN >> Internet Connectivity.
If the HCL internet download is not required, verify "Status" is "Disabled".
If the "Status" is "Enabled", this is a finding.
If the HCL internet download is required, verify "Status" is "Enabled" and a proxy host is configured.
If "Status" is "Enabled" and a proxy is not configured, this is a finding.
Fix Text (F-62597r934501_fix)
From the vSphere Client, go to Host and Clusters.
Select the vCenter Server >> Configure >> vSAN >> Internet Connectivity.
Click "Edit".
If the HCL internet download is not required, ensure that "Status" is "Disabled".
If the HCL internet download is required, ensure that "Status" is "Enabled" and that a proxy host is appropriately configured.