Dynamically Quarantine Infected Guests

Confirm that you have content update version 636 or later installed on Panorama.
Create a dynamic address to be your quarantine dynamic address group.

Create an HTTP Server Profile to send API calls to NSX Manager.
Select

Panorama

Server Profiles

HTTP

and

Add

a new HTTP Server Profile.

Enter a descriptive

Name

.

Select

Add

to provide the details of NSX Manager.

Enter a

Name

for NSX Manager.

Enter the

IP Address

of NSX Manager.

Select the Protocol (HTTP or HTTPS). The default Port is 80 or 443 respectively.

Select PUT under the HTTP Method column.

Enter the username and password for NSX Manager.



Select

Payload Format

and choose an NSX payload format from the Pre-defined Formats drop-down. This populates the URI Format, HTTP Headers, and Payload fields with the correct information to send the HTTP API call to NSX Manager. Additionally, the chosen format determines which security tag NSX Manager applies to infected guest VMs. In the example below,

NSX Anti-Virus Threat High

is selected which corresponds to the

ANTI_VIRUS.VirusFound.threat=high

security tag on NSX Manager.


Define the match criteria for when Panorama will forward logs to the NSX Manager, and attach the HTTP server profile to use.
Select

Panorama

Log Settings

for Threat or Traffic logs.

Enter a descriptive name for the new log settings.

(

Optional

) Under Filter, you can add filters such as severity to narrow the logs that are forwarded to NSX Manager. If All Logs is selected, all threat or traffic logs that meet the criteria set in the HTTP Server profile are sent to NSX Manager.

Click

Add

under HTTP and select the HTTP Server Profile configured in step 3.

Click

OK

.


Configure an NSX server certificate for Panorama to forward logs to NSX manager.
Select
Panorama
Certificate Management
Certificates
.
Create a root CA certificate with CN=IP address of Panorama.
Create a signed certificate with CN=IP address of NSX Manager.
Export the root CA certificate in PEM format without a private key.
Export the signed certificate in PEM format with a private key.

Using a tool such as OpenSSL, concatenate the exported certificates into a single PEM file for upload to NSX manager. Use the following commands in OpenSSL to complete this step.
cat cert_NSX_Root_CA.crt cert_NSX_Signed1.pem > cert_NSX_cert_chain.pem
openssl pkcs12 -export -in cert_NSX_cert_chain.pem -out cert_NSX_cert.p12
Log in to NSX Manager and select
Manage Appliance Settings
SSL Certificates
Upload PKC#12 Keystore
. Click
Choose File
, locate the p12 file you created in the previous step, and click
Import
.
Associate a security group with a security tag in vCenter.
Log in to vCenter.

Select

Networking & Security

Service Composer

Security Groups

.

Select a security group that is counterpart to the quarantine dynamic address group you created previously and click

Edit Security Group

.



Select Define dynamic membership and click the + icon.

Click

Add

.

Set the criteria details to Security Tag Contains and then enter the NSX security tag that corresponds to the NSX payload format you chose in 3. Each of the predefined NSX payload formats corresponds to an NSX security tag. To view the NSX security tags in NSX, select

Networking & Security

NSX Managers

NSX Manager IP

Manage

Security Tags

.

In this example,

NSX Anti-Virus Threat High

is used in the HTTP Server Profile so

ANTI_VIRUS.VirusFound.threat=high

is the NSX Security Tag that is used here.

Click Finish.


After the guest VM is cleared for removal from quarantine, manually remove the NSX security tag from the guest VM in NSX.
Log in to vCenter.
Select
VMs and Templates
and choose the quarantined guest.
Select
Summary
Security Tags
Manage
.
Uncheck the security tag used by the quarantine security group and click OK.
Refresh the page and the quarantine security will no longer be listed under
Summary
Security Group Membership
.
Source and destination UUID fields in threat and traffic logs may be blank after a guest VM is removed from quarantine. This can occur when running NSX 6.2.3 or earlier or if NSX steering rules do not use the inout direction. You can resolve this by upgrading NSX to 6.2.4 or issue an NSX Config-sync under
Panorama
VMware NSX
Service Manager
and reboot the PA-VM to resolve this issue.