This settings will prevent the virtual machines that use the switch from acting as a sniffer, changing their mac address or forging traffic with fake mac address thous protecting the rest of the virtual machines in the case of a compromise of a VM from it being used to conduct Man In the Middle Attacks, ARP Poison Attacks or being used to sniff traffic. To set the Policy on Reject on a virtual switch it can be done both from the Service Console or thru the VI Client. On the VI Client:
- Log into the VMware VI Client and select the server from the inventory panel.The hardware configuration page for this server appears.
- Click the Configuration tab, and click Networking.
- Click Properties for the vSwitch whose Layer 2 Security policy you want to edit.
- In the Properties dialog box for the vSwitch, click the Ports tab.
- Select the vSwitch item and click Edit.
- In the Properties dialog box for the vSwitch, click the Security tab.
- Select reject on the drpdown boxes for all 3 Policy Exceptions.
- Click OK
- vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-macchange=false
- vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-forgedxmit=false
0 comments:
Post a Comment