Skip to main content

Getting Started with Illumio Insights

Quarantine Resources

Use Quarantine to isolate potentially compromised cloud resources by enforcing a predefined policy that restricts normal communication to and/or from the affected resources. It also supports defining specific exceptions to that policy when needed. See Enable Controlled Access to quarantined resources.

Note

The Quarantine button only works for users with an Admin or Owner role.

For the Quarantine button to appear in the UI, you must have a trial or paid Segmentation license.

Important

Quarantine is available only on virtual machines in Azure, AWS, and GCP.

Quarantine considerations

Review this section to learn more about Quarantine's operations and limitations.

  • Supported Cloud Service Providers

    • Azure

    • AWS

    • Google Cloud Platform

  • Quarantine and Insights

    • To block outbound traffic, the Quarantine feature creates an Override Deny rule which may take precedence over existing Allow rules, depending on the rule priority.

    • An Allow rule and All-Except IP list entry is added to the default quarantine policy to allow traffic to a quarantined resource from the resource you selected in Administrative Tools.

  • Quarantine and Illumio Segmentation for the Cloud

    You can apply quarantine policies to workloads in the cloud. Because each cloud provider has its own security model, quarantine behavior may vary. Keep these considerations in mind.

    • Permissions: Quarantine requires write access. If an account is onboarded with read-only permissions, Illumio will honor that access level.

    • Azure rule priorities: Illumio’s quarantine rules follow Azure’s priority logic so higher-priority allow rules continue to take effect.

    • Policy preferences: Illumio enforces quarantine at the NIC NSG/SG (Azure/AWS) and VNET Firewall (GCP) regardless of the policy preference you select in Settings > Cloud > Policy Preferences.

    • Locked controls: If the controls of the resource you attempt to quarantine are locked, Illumio respects the lock and doesn't modify the control. A Quarantine Failed error appears.

    • Rule quotas: Quarantine rule capacity is governed by CSP‑defined rule quotas.

    • AWS Firewall Manager and Illumio Quarantine: When Illumio quarantines an AWS EC2 instance, it replaces the security groups associated with the instance’s Elastic Network Interfaces (ENIs) with the Illumio Quarantine Security Group (SG). (Limited Availability for AWS EC2)

      In environments using AWS Firewall Manager, common security group policies may detect this security group change as configuration drift. Firewall Manager can then automatically re-attach the original security groups to the instance, effectively overriding the Illumio quarantine action and making the quarantine ineffective.

      To prevent this behavior, CloudSecure tags an EC2 instance placed in quarantine with:

      • Key: cloudsecure:quarantine

      • Value: true

      AWS Firewall Manager policies should be configured to exclude EC2 instances with this tag from security group drift remediation. This prevents Firewall Manager from restoring the original security groups while the instance is quarantined and allows the Illumio Quarantine Security Group to remain in effect.

      Important

      If tag creation errors surface during quarantine, you may need to update the AWS EC2 permissions to allow tag creation by adding ec2:CreateTags and ec2:DeleteTags. See Updating AWS permissions on the Assume Role.

How Illumio tags quarantined instances

When you quarantine an instance, Illumio:

  • Adds the tag cloudsecure:quarantine=true to the instance. (Limited Availability for AWS EC2)

  • Replaces the instance's security groups with the quarantine security group.

When you restore the instance, Illumio:

  • Restores the original security groups and reapplies policy.

  • Removes the cloudsecure:quarantine tag. The instance is then managed by your external firewall policy again. (Limited Availability for AWS EC2)

The tag doesn't isolate the instance. It tells external automation to leave the instance alone while Illumio controls its network configuration.

Note

Tagging applies only to AWS EC2 instances. (Limited Availability for AWS EC2)