Initial commit

2026-04-18 10:12:10 -05:00
1 parent 37a2659067
commit 2e3c012074
@@ -0,0 +1,94 @@
+# Infrastructure — NSX Security Blueprint
+
+Automates NSX security groups and DFW policies for shared infrastructure services used across all application blueprints. Lives under the NSX **Infrastructure** DFW category.
+
+## Scope
+
+Infrastructure groups and policies cover cross-cutting services that every application needs to reach — DNS, NTP, Active Directory, monitoring, backup, syslog, etc. By placing these rules in the **Infrastructure** category they evaluate before application-level policies and remain centrally managed.
+
+## Tag Convention
+
+| Scope | Value | Purpose |
+|---|---|---|
+| `Infra` | `DNS Server` | Authoritative / recursive DNS servers |
+| `Infra` | `NTP Server` | NTP time sources |
+| `Infra` | `Domain Controller` | Active Directory Domain Controllers |
+
+Apply these tags to VMs in NSX (or via vCenter tag sync) so that new servers are automatically picked up by the dynamic group membership criteria.
+
+## Security Groups
+
+Managed by `security_groups.py`. Each group uses a **union** of three member sources so the groups can be built up incrementally:
+
+| Group | Dynamic (Tag) | Static IPs | Explicit VMs |
+|---|---|---|---|
+| `SG-Infra-DNS-Servers` | `Infra:DNS Server` | ✓ | ✓ |
+| `SG-Infra-NTP-Servers` | `Infra:NTP Server` | ✓ | ✓ |
+| `SG-Infra-Domain-Controllers` | `Infra:Domain Controller` | ✓ | ✓ |
+
+> The `GROUP_PREFIX` (`SG-Infra-`) is configurable at the top of each script.
+
+## DFW Policy: `Policy-Infra`
+
+_Defined in `policy.py` — coming soon._
+
+Planned rules (Infrastructure category, evaluated before application policies):
+
+| # | Rule Name | Source | Destination | Service | Action |
+|---|---|---|---|---|---|
+| 1 | Allow-DNS-UDP | Any | SG-Infra-DNS-Servers | DNS/UDP (53) | Allow |
+| 2 | Allow-DNS-TCP | Any | SG-Infra-DNS-Servers | DNS/TCP (53) | Allow |
+| 3 | Allow-NTP | Any | SG-Infra-NTP-Servers | NTP/UDP (123) | Allow |
+| 4 | Allow-LDAP | Any | SG-Infra-Domain-Controllers | LDAP (389), LDAPS (636) | Allow |
+| 5 | Allow-Kerberos | Any | SG-Infra-Domain-Controllers | Kerberos (88/UDP+TCP) | Allow |
+| 6 | Allow-SMB-DC | Any | SG-Infra-Domain-Controllers | SMB (445) | Allow |
+
+## Files
+
+```
+infra/
+├── README.md
+├── security_groups.py   # Creates/updates infrastructure security groups
+└── policy.py            # DFW policy and rules  (coming soon)
+```
+
+## Usage
+
+### Prerequisites
+```bash
+pip install requests
+```
+
+### Populate member data
+Open `security_groups.py` and edit the `GROUPS` dictionary:
+- `ip_addresses` — static IPs or CIDRs for servers not yet tagged
+- `vm_ext_ids` — vCenter MoRef IDs (e.g. `"vm-1042"`) for explicit VM membership
+- `tag_value` — already set; drives dynamic membership via NSX tag conditions
+
+### Dry run (no changes)
+```bash
+python infra/security_groups.py \
+  --nsx-manager <IP_OR_FQDN> \
+  --username admin \
+  --password <password> \
+  --dry-run
+```
+
+### Apply
+```bash
+python infra/security_groups.py \
+  --nsx-manager <IP_OR_FQDN> \
+  --username admin \
+  --password <password>
+```
+
+### Lab / self-signed cert environments
+Add `--no-verify-ssl` to either command above.
+
+## Customization
+
+| Variable | Location | Default | Purpose |
+|---|---|---|---|
+| `GROUP_PREFIX` | top of `security_groups.py` | `SG-Infra-` | Prefix on all group names and IDs |
+| `TAG_SCOPE` | top of `security_groups.py` | `Infra` | NSX tag scope for infrastructure tags |
+| `DOMAIN` | top of `security_groups.py` | `default` | NSX Policy domain |