What changed in VMware NSX 4.x Distributed Firewall STIG V1R2V1R2 changes

VMware NSX 4.x Distributed Firewall STIG V1R2 (2025-01-30) replaced V1R1 (2024-08-07): 6 checks added, 8 removed. It has 6 checks, against 8 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 6 added
  • 8 removed
  • 0 updated

Added in V1R2 (6)

  • V-265612CAT IIIThe NSX Distributed Firewall must generate traffic log entries that can be sent by the ESXi hosts to the central syslog.
  • V-265618CAT IIThe NSX Distributed Firewall must limit the effects of packet flooding types of denial-of-service (DoS) attacks.
  • V-265619CAT IIThe NSX Distributed Firewall must deny network communications traffic by default and allow network communications traffic by exception.
  • V-265628CAT IIThe NSX Distributed Firewall must be configured to inspect traffic at the application layer.
  • V-265630CAT IIThe NSX Distributed Firewall must configure SpoofGuard to restrict it from accepting outbound packets that contain an illegitimate address in the source address.
  • V-265633CAT IThe NSX Distributed Firewall must configure an IP Discovery profile to disable trust on every use method.

Removed since V1R1 (8)

  • V-263175The NSX Distributed Firewall must generate traffic log entries.
  • V-263176The NSX Distributed Firewall must generate traffic log entries containing information to establish the source of the events, such as the source IP address at a minimum.
  • V-263177The NSX Distributed Firewall must generate traffic log entries containing information to establish the outcome of the events, such as, at a minimum, the success or failure of the application of the NSX Distributed Firewall rule.
  • V-263178CAT IIThe NSX Distributed Firewall must limit the effects of packet flooding types of denial-of-service (DoS) attacks.
  • V-263179CAT IIThe NSX Distributed Firewall must deny network communications traffic by default and allow network communications traffic by exception.
  • V-263180CAT IIThe NSX Distributed Firewall must be configured to inspect traffic at the application layer.
  • V-263181CAT IIThe NSX Distributed Firewall must configure SpoofGuard to restrict it from accepting outbound packets that contain an illegitimate address in the source address.
  • V-263182CAT IThe NSX Distributed Firewall must configure an IP Discovery profile to disable trust on every use methods.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.