VMware NSX-T security tag action

VMware NSX SDN connectors' vCenter server and credentials can be configured so the FortiGate resolves NSX-T VMs. The FortiGate uses the VMWare NSX Security Tag automation action to assign a tag to the VM through an automation stitch.

The FortiGate is notified of a compromised host on the NSX-T network by an incoming webhook or other means, such as FortiGuard IOC. An automation stitch can be configured to process this trigger and action it by assigning a VMware NSX security tag on the VM instance.

To configure an automation stitch to assign a security tag to NSX-T VMs in the GUI:

1. Configure the NSX SDN connector:
   1. Go to Security Fabric > External Connectors and click Create New.
   2. Select VMware NSX.
   3. Configure the connector settings.
   4. Enable vCenter Settings and configure as needed.

      

   5. Click OK.
2. Configure the automation stitch trigger:
   1. Go to Security Fabric > Automation and click Create New.
   2. Enter the stitch name (auto_webhook).
   3. Click Add Trigger.
   4. Click Create and select Incoming Webhook.
   5. Enter a name (auto_webhook).
   6. Click OK to close the Incoming Webhook URL prompt.
   7. Select the trigger in the list and click Apply.
3. Configure the automation stitch action:
   1. Click Add Action.
   2. Click Create and select VMware NSX Security Tag.
   3. Enter the following:

      Name	auto_webhook_quarantine-nsx
      Specify NSX server(s)	Enable and select the SDN connector
      Security tag	Select an existing tag, or create a new one

      

   4. Click OK.
   5. Select the action in the list and click Apply.
4. Click OK.
5. In NSX-T, create a cURL request to trigger the automation stitch on the FortiGate:

   root@pc56:/home# curl -k -X POST -H 'Authorization: Bearer 3fdxNG08mgNg0fh4NQ51g1NQ1QHcxx' --data '{ "srcip": "10.1.30.242"}' https://172.16.116.230/api/v2/monitor/system/automation-stitch/webhook/auto_webhook
   {
     "http_method":"POST",
     "status":"success",
     "http_status":200,
     "serial":"FGVM08TM20000000",
     "version":"v6.4.0",
     "build":1608
   }

   The automation stitch is triggered and the configured tag is added to the NSX-T VM.

   

   In FortiOS, the Security Fabric > Automation page shows the last trigger time.

   

To configure an automation stitch to assign a security tag to NSX-T VMs in the CLI:

1. Configure the NSX SDN connector:

   config system sdn-connector
       edit "nsx_t25"
           set type nsx
           set server "172.18.64.205"
           set username "admin"
           set password xxxxxxxxxxxx
           set vcenter-server "172.18.64.201"
           set vcenter-username "administrator@vsphere.local"
           set vcenter-password xxxxxxxxxxxx
       next
   end

2. Configure the automation stitch:

   config system automation-trigger
       edit "auto_webhook"
           set trigger-type event-based
           set event-type incoming-webhook
       next
   end

   config system automation-action
       edit "auto_webhook_quarantine-nsx"
           set action-type quarantine-nsx
           set security-tag "automation_tag"
           set sdn-connector "nsx_t25"
       next
   end

   config system automation-stitch
       edit "auto_webhook"
           set status enable
           set trigger "auto_webhook"
           set action "auto_webhook_quarantine-nsx"
       next
   end

3. In NSX-T, create a cURL request to trigger the automation stitch on the FortiGate:

   root@pc56:/home# curl -k -X POST -H 'Authorization: Bearer 3fdxNG08mgNg0fh4NQ51g1NQ1QHcxx' --data '{ "srcip": "10.1.30.242"}' https://172.16.116.230/api/v2/monitor/system/automation-stitch/webhook/auto_webhook
   {
     "http_method":"POST",
     "status":"success",
     "http_status":200,
     "serial":"FGVM08TM20000000",
     "version":"v6.4.0",
     "build":1608
   }

To verify the automation stitch is triggered and the action is executed:

# diagnose test application autod 2

csf: enabled root:yes
version:1586883541 sync time:Tue Apr 14 11:04:05 2020

total stitches activated: 1

stitch: auto_webhook
destinations: all
trigger: auto_webhook

(id:15)service=auto_webhook

local hit: 1 relayed to: 0 relayed from: 0
actions:
auto_webhook_quarantine-nsx type:quarantine-nsx interval:0
security tag:automation_tag
sdn connector:
nsx_t25;