The NSX-T Tier-1 Gateway must be configured to have all inactive interfaces removed.

An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface.

If an interface is no longer used, the configuration must be deleted.

From the NSX-T Manager web interface, go to Networking >> Tier-1 Gateways.

For every Tier-1 Gateway, expand the Tier-1 Gateway. Click on the number in the Linked Segments to review the currently linked segments.

For every Tier-1 Gateway, expand the Tier-1 Gateway. Expand Service Interfaces, then click on the number to review the Service Interfaces.

Review each interface or linked segment present to determine if they are not in use or inactive.

If there are any linked segments or service interfaces present on a Tier-1 Gateway that are not in use or inactive, this is a finding.

To remove a stale linked segment from a Tier-1 Gateway, do the following:

From the NSX-T Manager web interface, go to Networking >> Segments and edit the target segment.

Under Connected Gateway, change to "None" and click "Save".

Note: The stale linked segment can also be deleted if there are no active workloads attached to it.

To remove a stale service interface from a Tier-1 Gateway, do the following:

From the NSX-T Manager web interface, go to Networking >> Tier-1 Gateways >> Edit the target Tier-1 Gateway.

Expand Service Interfaces >> click on the number to view the Service Interfaces.

On the stale service interface, select "Delete" and click "Delete" again to confirm.