Initial commit

2026-04-18 10:12:10 -05:00
1 parent 37a2659067
commit 2e3c012074
@@ -0,0 +1,82 @@
+# [AppName] — NSX Security Blueprint Template
+
+Generic template for creating NSX tags, security groups, and a Distributed Firewall (DFW) policy for a new application. Copy this directory and replace `[AppName]` throughout.
+
+## Application Overview
+
+_Describe the application, its role in the environment, and the tiers that need to be segmented._
+
+## Tiers & Tags
+
+| Tag | Scope | Purpose |
+|---|---|---|
+| `[AppName]\|Web` | `AppName` | Web / presentation tier |
+| `[AppName]\|App` | `AppName` | Application tier |
+| `[AppName]\|DB` | `AppName` | Database tier |
+
+_Add or remove tiers as needed._
+
+## Security Groups
+
+| Group | Membership Criteria | Purpose |
+|---|---|---|
+| `SG-[AppName]-Web` | Tag: `[AppName]\|Web` | Web-tier VMs |
+| `SG-[AppName]-App` | Tag: `[AppName]\|App` | Application-tier VMs |
+| `SG-[AppName]-DB` | Tag: `[AppName]\|DB` | Database-tier VMs |
+| `SG-[AppName]-All` | All groups above | All app workloads — used in lockdown rule |
+
+## DFW Policy: `Policy-[AppName]`
+
+| # | Rule Name | Source | Destination | Service | Action | Applied To |
+|---|---|---|---|---|---|---|
+| 1 | Allow-HTTPS-Web | Any | SG-[AppName]-Web | HTTPS (443) | Allow | DFW |
+| 2 | Allow-MSSQL-DB | SG-[AppName]-App | SG-[AppName]-DB | MSSQL (1433) | Allow | DFW |
+| 3 | Allow-SSH-DB | SG-[AppName]-Mgmt | SG-[AppName]-DB | SSH (22) | Allow | DFW |
+| 4 | Lockdown-[AppName] | Any | SG-[AppName]-All | Any | Deny | SG-[AppName]-All |
+
+> **Lockdown rule** (last rule): set **Applied To** to `SG-[AppName]-All` so the deny is scoped to this application's workloads only and does not affect other traffic on the DFW.
+
+## Infrastructure Policy
+
+An infrastructure-category policy (`Policy-Infra-[AppName]`) should be used for cross-cutting concerns such as:
+- DNS / NTP access from app workloads
+- AD/LDAP access
+- Monitoring and backup agent traffic
+- Syslog forwarding
+
+_This policy lives under the **Infrastructure** DFW category and is documented separately._
+
+## Files
+
+```
+_template/
+├── README.md
+├── deploy.py          # Main entry point — orchestrates tags, groups, policy
+├── tags.py            # Tag creation logic
+├── security_groups.py # Security group creation logic
+└── policy.py          # DFW policy and rule creation logic
+```
+
+## Usage
+
+```bash
+python <appname>/deploy.py \
+  --nsx-manager <IP_OR_FQDN> \
+  --username <admin_user> \
+  --password <password>
+```
+
+### Optional flags
+| Flag | Default | Description |
+|---|---|---|
+| `--dry-run` | False | Print planned changes without applying them |
+| `--verify-ssl` | True | Disable with `--no-verify-ssl` for lab environments |
+
+## Customization Checklist
+
+- [ ] Replace all `[AppName]` placeholders
+- [ ] Add/remove tiers to match actual application architecture
+- [ ] Adjust services/ports in the policy table
+- [ ] Define which group gets SSH admin access (Rule 3 source)
+- [ ] Review lockdown rule — confirm Applied To is correct
+- [ ] Add infrastructure policy rules as needed