Configuring an NSX Security Policy

An NSX Security Policy is configured in the VMware vSphere Web Client console. For a previously created NSX security group, you must assign an NSX security policy that defines the use of Kaspersky Security services:

• File system protection service (Kaspersky File Antimalware Protection), if you want to protect virtual machines by using the File Anti-Virus component.
• Network protection service (Kaspersky Network Protection), if you want to protect virtual machines by using the Network Threat Detection component.

To configure an NSX security policy:

1. In the VMware vSphere Web Client console, start the NSX Security Policy Wizard in the Networking & Security / Service Composer section on the Security Policies tab.
2. If you want to use the File Anti-Virus component, at the Guest Introspection Services step of the Wizard, add the Kaspersky File Antimalware Protection service with a user-defined name and the default action (Apply).
3. If you want to use the Network Threat Detection component to scan outbound traffic of virtual machines, at the Network Introspection Services step of the Wizard, add the Kaspersky Network Protection service and specify the following values for its settings:
   • User-defined name
   • Redirection of traffic to the network protection service (Kaspersky Network Protection) is enabled (Redirect to service setting)

     If you are using VMware NSX for vSphere 6.3.6, redirection of traffic to the network protection service is enabled by default (Action – Redirect to service). If you are using VMware NSX for vSphere 6.4.1, redirection of traffic is disabled by default. In this case, you need to select Yes for the Redirect to service setting.

   • Source – Policy's Security Groups (selected by default)
   • Destination – Any (selected by default)
4. If you want to use the Network Threat Detection component to scan inbound traffic of virtual machines, at the Network Introspection Services step of the Wizard, add the Kaspersky Network Protection service and specify the following values for its settings:
   • User-defined name
   • Redirection of traffic to the network protection service (Kaspersky Network Protection) is enabled (Redirect to service setting)

     If you are using VMware NSX for vSphere 6.3.6, redirection of traffic to the network protection service is enabled by default (Action – Redirect to service). If you are using VMware NSX for vSphere 6.4.1, redirection of traffic is disabled by default. In this case, you need to select Yes for the Redirect to service setting.

   • Source – Any
   • Destination – Policy's Security Groups
5. Finish the NSX Security Policy Wizard.
6. In the list of NSX security policies on the Security Policies tab, apply the policy (Apply) to the NSX Security Group that includes the protected virtual machines.

For more details about configuring NSX security policies, please refer to the Knowledge Base.