NSX Quarantine action

If an endpoint instance in a VMware NSX environment is compromised, this action will assign the configured security tag is to the compromised endpoint.

This action is only available when the automation trigger is set to compromised host.

To set up the NSX quarantine action, you need to:

1. Configure a VMware NSX SDN connector
2. Configure an NSX security tag automation stitch
3. Configure FortiAnalyzer logging on the FortiGate

Configure a VMware NSX SDN connector

The FortiGate retrieves security tags from the VMware NSX server through the connector.

To configure a VMware NSX SDN connector in the GUI:

1. Go to Security Fabric > Fabric Connectors
2. Click Create New.
3. Select VMware NSX
4. Configure the settings.

   

5. Click OK.

To configure a VMware NSX SDN connector in the CLI:

config system sdn-connector
    edit "nsx"
        set type nsx
        set server "172.18.64.32"
        set username "admin"
        set password xxxxxx
    next
end

Configure an NSX security tag automation stitch

Security tags are retrieved from the VMware NSX server through the NSX SDN connector.

To configure an NSX security tag automation stitch in the GUI:

1. Go to Security Fabric > Automation.
2. Click Create New.
3. In the Trigger section, select Compromised Host.
4. In the Action section, select Assign VMware NSX Security Tag.
5. Configure the settings.

   

6. Click OK.

To configure an NSX security tag automation stitch in the CLI:

1. Create an automation action:

   config system automation-action
       edit "pcui-test_quarantine-nsx"
           set action-type quarantine-nsx
           set security-tag "pcui-tag2"
           set sdn-connector "nsx"
       next
   end

2. Create an automation trigger:

   config system automation-trigger
       edit "pcui-test"
           set ioc-level high
       next
   end

3. Create the automation stitch:

   config system automation-stitch
       edit "pcui-test"
           set trigger "pcui-test"
           set action "pcui-test_quarantine-nsx"
       next
   end

Configure FortiAnalyzer logging on the FortiGate

The FortiAnalyzer is used to send endpoint compromise notification to the FortiGate.

See Configuring FortiAnalyzer for more information.

To configure FortiAnalyzer logging in the GUI:

1. Go to Security Fabric > Settings.
2. Enable and configure FortiAnalyzer Logging.

   

3. Click Apply.

To configure FortiAnalyzer logging in the CLI:

config log fortianalyzer setting
    set status enable
    set server "172.18.64.234"
    set serial "FL-8HFT718900132"
    set upload-option realtime
    set reliable enable
end

When an endpoint instance is compromised

When an endpoint instance, such as pcui-ubuntu2, in the VMware NSX environment is compromised, the automation stitch is triggered. The FortiGate then assigns the configured security tag, pcui-tag2 in this example, to the compromised NSX endpoint instance.