Register the Carbon Black Cloud Workload Appliance with NSX-T

After you register the Carbon Black Cloud Workload Appliance with the vCenter Server and the Carbon Black Cloud, you can register an NSX integration with your Carbon Black Cloud organization.

This is an onboarding workflow that sets up a trust between the Carbon Black Cloud Workload Appliance and the NSX Manager appliance. After the onboarding completes, the Carbon Black Cloud Workload Appliance creates one or more pre-defined Distributed Firewall (DFW) policy templates for use by the Carbon Black Cloud, and instantiates them as a part of the initial authentication and configuration process. It creates the following NSX DFW policies and associated tags.

• CB-NSX-Quarantine – The VM workload is quarantined from the network. This is a read-only policy for NSX administrators. The policy allows the following network flows:
  • DHCP for IP addresses and DNS traffic for name resolution.
  • HTTPS traffic to a list of FQDNs required by sensor to remain connected to Carbon Black Cloud.
• CB-NSX-Isolate – The VM workload is completely isolated from the network. This is a read-only policy for NSX administrators.
• CB-NSX-Custom – Customizable by the NSX security admin. Advanced users can use such a policy to create a custom security posture.

After NSX-T integration, you can use the newly created NSX policies to remediate VM workloads in the Carbon Black Cloud console or you can remove applied NSX policies from VM workloads.

Prerequisites

• Verify the Carbon Black Cloud Workload Appliance VM is powered-on.
• Verify the SSO registration is valid.
• The Carbon Black Cloud Workload Appliance must have a valid registration with both vCenter Server and Carbon Black Cloud.
• Communication between Carbon Black Cloud and Carbon Black Cloud Workload Appliance is over HTTPS.
• Communication between NSX and Carbon Black Cloud Workload Appliance is over HTTPS, and uses certificate-based authentication with NSX principal identity. For information on adding a role assignment or principal identity, see VMware NSX-T Data Center Product Documentation.
• The supported NSX-T version is 3.1.3+.
• Register the Carbon Black Cloud Workload Appliance with Carbon Black Cloud

Procedure

1. Log in to the Carbon Black Cloud Workload Appliance at https://<appliance IP address> using admin credentials.
2. Go to the Appliance > Registration page.
3. In the NSX details section, select the NSX Manager IP address from the NSX hostname dropdown menu.
   The Register button becomes active.
4. To initiate NSX on-boarding, click Register.
5. Enter the NSX administrator user name and password and click Register.
   It can take up to 15 seconds for the process to complete. A green check mark confirms a successful registration.
6. Verify all objects are created in the NSX Manager:
   1. Log in to the NSX Manager with admin credentials.
   2. Navigate to the Inventory > Groups page and check if the following groups exist:
      • CB-NSX-Custom-Group
      • CB-NSX-Isolate-Group
      • CB-NSX-Quarantine-Group
   3. Navigate to the Security > Distributed Firewalls > CATEGORY SPECIFIC RULES page and check if the following default policies exist:
      • CB-NSX-Custom
      • CB-NSX-Isolate
      • CB-NSX-Quarantine
   4. Navigate to the Inventory > Context Profiles > Context Profiles page and check if the CB-NSX-Quarantine-Context-Profile exists with valid FQDNs.

What to do next

Preparing VMs with Carbon Black Launcher