Configuring and applying NSX Policy for Network Threat Protection in the Infrastructure managed by VMware NSX-T Manager

To configure NSX policy for Network Threat Protection in the infrastructure managed by VMware NSX-T Manager:

1. Create an NSX Service Profile for the Kaspersky Network Protection service as follows:
   1. In the VMware NSX Manager Web Console, in the Security → Network Introspection Settings section, go to the Service Profiles tab and select the Kaspersky Network Protection service in the Partner Service drop-down list.
   2. Click the Add Service Profile button and specify the following settings:
      • Service Profile Name – an arbitrary name of NSX Service Profile.
      • Vendor Template – Default Configuration.
   3. Save the profile of the Kaspersky Network Protection service (the Save button).
2. Configure the NSX Service Chain as follows:
   1. In VMware NSX Manager Web Console, in the Security → Network Introspection Settings section, go to the Service Chains tab.
   2. Click the Add Chain button and specify the following settings:
      • Service Chain Name – an arbitrary name of NSX Service Chain.
      • Service segment – NSX Service Segment that you specified when deploying an SVM with Network Threat Protection component.
      • Forward Path – the profile of the service that processes traffic. Select the NSX Service Profile created at the previous step of the procedure (Kaspersky Network Protection service profile). The window for selecting an NSX Service Profile opens by clicking the Set Forward Path link.

        It is not recommended to add other NSX Service Profiles to the NSX service chain that contains the Kaspersky Network Protection service profile.

      • Reverse Path – make sure that the Inverse Forward Path check box is selected.
      • Failure Policy – Allow.
   3. Save the NSX Service Chain (the Save button).
3. Create an NSX Policy for network protection as follows:
   1. In the VMware NSX Manager Web Console in the Security → Network Introspection (E-W) section, click the Add Policy button and specify the following settings:
      • Name – arbitrary policy name.
      • Redirect To – NSX Service Chain to which the traffic is redirected. Select the NSX Service Chain that you created at the previous step of the procedure.
   2. Save the policy (the Publish button).
4. If you want to scan inbound traffic of the virtual machines, create a rule for inbound traffic in the NSX Policy as follows:
   1. Select the created policy and click the Add Rule button.
   2. Specify the following settings:
      • Name – arbitrary rule name.
      • Sources – Any.
      • Destinations – NSX Group that includes protected virtual machines.
      • Services – Any.
      • Applied To – NSX Group that includes protected virtual machines.
      • Action – Redirect.
   3. Save the policy (the Publish button).
5. If you want to scan outbound traffic of the virtual machines, create a rule for outbound traffic in the NSX Policy as follows:
   1. Select the created policy and click the Add Rule button.
   2. Specify the following settings:
      • Name – arbitrary rule name.
      • Sources – NSX Group that includes protected virtual machines.
      • Destinations – Any.
      • Services – Any.
      • Applied To – NSX Group that includes protected virtual machines.
      • Action – Redirect.
   3. Save the NSX Policy (the Publish button).

If you created both rules, the configured policy will redirect inbound and outbound traffic of the protected virtual machines to the Kaspersky Network Protection service for scan.

For more details on configuring NSX Policies, refer to the VMware product documentation and the Knowledge base.