Set Device Tags at the Device Level for Infected Host Remediation

When choosing how you would like Apstra ConnectorOps to handle infected hosts, you have two options. You can add device tags to specific devices at the device level, or you can import a Global Property Set that applies to all devices, and defines what actions Apstra ConnectorOps takes.

To set device tags at the device level:

  1. From your blueprint, navigate to Staged > Physical > Topology.
  2. Select a leaf device, click its box, and select Update node tags.
  3. Choose from one of the following:
    • ih-acl: The ih-acl-configlet reads this tag and creates a firewall filter that blocks traffic from the infected host’s MAC address. The interface stays up.
    • ih-port: Apstra ConnectorOps shuts down (down) the connected interface on the leaf if a host on that interface is flagged is infected, and brings it back up (up) when the issue is resolved and ATP Cloud removes the host’s IP from the infected host feed.
    • ih-no-action: Apstra ConnectorOps detects and logs the infected host and its connected interface, but takes no action.


  4. Click Update.