Once vMotion is triggered, Deep Security Virtual Appliance (DSVA) restores the status for the guest virtual machine (VM), sending policy from the Deep Security Manager (DSM) to restart the protection.
There was an issue found in Deep Security 12.0 GM version, it may take a long time until the VM can be protected again after the vMotion.
This symptom can be noticed in Trend Micro Deep Security Virtual Appliance with agent version 12.0 and NSX-T that enable Guest Introspection functionality only.
There is an implement introduced in Deep Security 12.0 U1 and above, however, it may still take up to 25 seconds until the VM can be protected after vMotion.
Solution
This issue is fixed in Deep Security Manager Feature Release (12 FR 2020-04-29).
Reference:
https://help.deepsecurity.trendmicro.com/feature-releases/release-notes-dsm.html
Improved Security
Continuous Anti-Malware protection: Deep Security Manager now sends guest VMs' Anti-Malware real-time configuration to all Deep Security Virtual Appliances that are under the same cluster. The effect is that the appliances can now maintain the protection of guest machines that use the Anti-Malware real-time feature during and after a vMotion migration from one ESXi host to another under the same cluster. This feature only applies to NSX-T environments.
