If an endpoint instance in a VMware NSX environment is compromised, this action will assign the configured security tag to the compromised endpoint.
This action is only available when the automation trigger is set to compromised host.
To set up the NSX quarantine action, you need to:
- Configure a VMware NSX SDN connector
- Configure an NSX security tag automation stitch
- Configure FortiAnalyzer logging on the FortiGate
The FortiGate retrieves security tags from the VMware NSX server through the connector.
- Go to Security Fabric > External Connectors.
- Click Create New.
- Select VMware NSX.
- Configure the settings as needed.
- Click OK