What changed in VMware NSX 4.x Tier-0 Gateway Router STIG V1R2V1R2 changes

VMware NSX 4.x Tier-0 Gateway Router STIG V1R2 (2025-01-30) replaced V1R1 (2024-08-07): 16 checks added, 16 removed. It has 16 checks, against 16 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 16 added
  • 16 removed
  • 0 updated

Added in V1R2 (16)

  • V-265390CAT IThe NSX Tier-0 Gateway router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
  • V-265393CAT IThe NSX Tier-0 Gateway router must be configured to have all inactive interfaces removed.
  • V-265404CAT IIIThe NSX Tier-0 Gateway router must be configured to have the Dynamic Host Configuration Protocol (DHCP) service disabled if not in use.
  • V-265406CAT IThe NSX Tier-0 Gateway router must be configured to use encryption for Open Shortest Path First (OSPF) routing protocol authentication.
  • V-265428CAT IThe NSX Tier-0 Gateway router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field by enabling Unicast Reverse Path Forwarding (uRPF).
  • V-265431CAT IThe NSX Tier-0 Gateway router must be configured to implement message authentication for all control plane protocols.
  • V-265432CAT IIThe NSX Tier-0 Gateway must be configured to use a unique password for each autonomous system (AS) with which it peers.
  • V-265441CAT IIThe NSX Tier-0 Gateway router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.
  • V-265442CAT IIThe NSX Tier-0 Gateway router must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.
  • V-265443CAT IIThe NSX Tier-0 Gateway router must be configured to have Internet Control Message Protocol (ICMP) redirects disabled on all external interfaces.
  • V-265444CAT IIThe NSX Tier-0 Gateway router must be configured to use the Border Gateway Protocol (BGP) maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
  • V-265468CAT IIIThe NSX Tier-0 Gateway router must be configured to use its loopback address as the source address for Internal Border Gateway Protocol (IBGP) peering sessions.
  • V-265479CAT IIIThe NSX Tier-0 Gateway router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.
  • V-265483CAT IIIThe NSX Tier-0 Gateway router must be configured to have routing protocols disabled if not in use.
  • V-265484CAT IIIThe NSX Tier-0 Gateway router must be configured to have multicast disabled if not in use.
  • V-265485CAT IThe NSX Tier-0 Gateway router must be configured to use encryption for border gateway protocol (BGP) routing protocol authentication.

Removed since V1R1 (16)

  • V-263298CAT IThe NSX Tier-0 Gateway router must be configured to disable Protocol Independent Multicast (PIM) on all interfaces that are not required to support multicast routing.
  • V-263299CAT IThe NSX Tier-0 Gateway router must be configured to have all inactive interfaces removed.
  • V-263300The NSX Tier-0 Gateway router must be configured to have the Dynamic Host Configuration Protocol (DHCP) service disabled if not in use.
  • V-263301CAT IThe NSX Tier-0 Gateway router must be configured to use encryption for Open Shortest Path First (OSPF) routing protocol authentication.
  • V-263302CAT IThe NSX Tier-0 Gateway router must be configured to restrict it from accepting outbound IP packets that contain an illegitimate address in the source address field by enabling Unicast Reverse Path Forwarding (uRPF).
  • V-263303CAT IThe NSX Tier-0 Gateway router must be configured to implement message authentication for all control plane protocols.
  • V-263304CAT IIThe NSX Tier-0 Gateway must be configured to use a unique password for each autonomous system (AS) with which it peers.
  • V-263305CAT IIThe NSX Tier-0 Gateway router must be configured to have Internet Control Message Protocol (ICMP) unreachable notifications disabled on all external interfaces.
  • V-263306CAT IIThe NSX Tier-0 Gateway router must be configured to have Internet Control Message Protocol (ICMP) mask replies disabled on all external interfaces.
  • V-263307CAT IIThe NSX Tier-0 Gateway router must be configured to have Internet Control Message Protocol (ICMP) redirects disabled on all external interfaces.
  • V-263308CAT IIThe NSX Tier-0 Gateway router must be configured to use the Border Gateway Protocol (BGP) maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.
  • V-263309The NSX Tier-0 Gateway router must be configured to use its loopback address as the source address for Internal Border Gateway Protocol (IBGP) peering sessions.
  • V-263310The NSX Tier-0 Gateway router must be configured to advertise a hop limit of at least 32 in Router Advertisement messages for IPv6 stateless auto-configuration deployments.
  • V-263311The NSX Tier-0 Gateway router must be configured to have routing protocols disabled if not in use.
  • V-263312The NSX Tier-0 Gateway router must be configured to have multicast disabled if not in use.
  • V-263313CAT IThe NSX Tier-0 Gateway router must be configured to use encryption for border gateway protocol (BGP) routing protocol authentication.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.