Configure the following to be able to auto-quarantine VMs with malware detection:
- Set up the Transport Node profile with VLAN and Overlay transport zone
- Enable the NSX-T security tag from the Deep Security Policy
- Create a new group and provide a suitable name such as "isolation-VM" that includes the VMs that will be tagged with "ANTI_VIRUS.VirusFound.threat=medium"
- Create an NSX-T Distributed Firewall rules to "Reject" outgoing connection from source group "isolation-VM" to destination "Any"
- Create a new segment that connect to VLAN transport zone and assign all Guest VM connect to this segment
Refer DS 20.0 OLH document for other basic NSX-T configuration - https://help.deepsecurity.trendmicro.com/20_0/on-premise/appliance-nsxt3x-about.html?Highlight=NSX-T
Testing if the configuration works
- Login to the Guest VM and verify it can access the internet.
- Follow the instructions on this article to simulate a malware detection
- Login to the manager console and verify that there are Anti-Malware Events
- From the NSX, verify that the Guest VM has been added into the "Isolation-VM" group
- Login to the Guest VM, notice that all outgoing connection is rejected by the NSX-T DFW.
- From the manager console, initiate a manual or scheduled Anti-Malware scan. Once there is no additional detection. The Security Tag will be removed and the Guest VM will no longer be in the "Isolation-VM" group.
- Verify that the Guest VM can access the internet again.