Skip to main content

Getting Started with Illumio Insights

Quarantine Resources

The Quarantine feature allows you to isolate potentially compromised cloud resources by enforcing a predefined policy that restricts normal communication to and/or from the affected resources. It also supports defining specific exceptions to that policy when needed. (See Enable Controlled Access to quarantined resources).

Note

Although the Quarantine button appears in the user interface to all users, it only works for users with an Admin or Owner role.

Important

For the Quarantine button to appear in the user interface, you must have a trial or paid Segmentation license.

Note

Quarantine is available only on virtual machines in Azure, AWS, and GCP.

Quarantine considerations

Review this section to learn more about Quarantine's operations and limitations.

  • Supported Cloud Service Providers

    • Azure

    • AWS

    • Google Cloud Platform

  • Quarantine and Insights

    • To block outbound traffic, the Quarantine feature creates an Override Deny rule which may take precedence over existing Allow rules, depending on the rule priority.

    • An Allow rule and All-Except IP list entry is added to the default quarantine policy to allow traffic to a quarantined resource from the resource you selected in Administrative Tools.

  • Quarantine and Illumio Segmentation for the Cloud

    You can apply quarantine policies to workloads in the cloud. Because each cloud provider has its own security model, quarantine behavior may vary. Keep these considerations in mind.

    • Permissions: Quarantine requires write access. If an account is onboarded with read-only permissions, Illumio will honor that access level.

    • Azure rule priorities: Illumio’s quarantine rules follow Azure’s priority logic so higher-priority allow rules continue to take effect.

    • Policy preferences: Illumio enforces quarantine at the NIC NSG/SG (Azure/AWS) and VNET Firewall (GCP) regardless of the policy preference you select in Settings > Cloud > Policy Preferences.

    • Locked controls: If the controls of the resource you attempt to quarantine are locked, Illumio respects the lock and doesn't modify the control. A Quarantine Failed error appears.

    • Rule quotas: Quarantine rule capacity is governed by CSP‑defined rule quotas.