# Infrastructure — NSX Security Blueprint

Automates NSX security groups and DFW policies for shared infrastructure services used across all application blueprints. Lives under the NSX **Infrastructure** DFW category.

## Scope

Infrastructure groups and policies cover cross-cutting services that every application needs to reach — DNS, NTP, Active Directory, monitoring, backup, syslog, etc. By placing these rules in the **Infrastructure** category they evaluate before application-level policies and remain centrally managed.

## Tag Convention

| Scope | Value | Purpose |
|---|---|---|
| `Infra` | `DNS Server` | Authoritative / recursive DNS servers |
| `Infra` | `NTP Server` | NTP time sources |
| `Infra` | `Domain Controller` | Active Directory Domain Controllers |

Apply these tags to VMs in NSX (or via vCenter tag sync) so that new servers are automatically picked up by the dynamic group membership criteria.

## Security Groups

Managed by `security_groups.py`. Each group uses a **union** of three member sources so the groups can be built up incrementally:

| Group | Dynamic (Tag) | Static IPs | Explicit VMs |
|---|---|---|---|
| `SG-Infra-DNS-Servers` | `Infra:DNS Server` | ✓ | ✓ |
| `SG-Infra-NTP-Servers` | `Infra:NTP Server` | ✓ | ✓ |
| `SG-Infra-Domain-Controllers` | `Infra:Domain Controller` | ✓ | ✓ |

> The `GROUP_PREFIX` (`SG-Infra-`) is configurable at the top of each script.

## DFW Policy: `Policy-Infra`

_Defined in `policy.py` — coming soon._

Planned rules (Infrastructure category, evaluated before application policies):

| # | Rule Name | Source | Destination | Service | Action |
|---|---|---|---|---|---|
| 1 | Allow-DNS-UDP | Any | SG-Infra-DNS-Servers | DNS/UDP (53) | Allow |
| 2 | Allow-DNS-TCP | Any | SG-Infra-DNS-Servers | DNS/TCP (53) | Allow |
| 3 | Allow-NTP | Any | SG-Infra-NTP-Servers | NTP/UDP (123) | Allow |
| 4 | Allow-LDAP | Any | SG-Infra-Domain-Controllers | LDAP (389), LDAPS (636) | Allow |
| 5 | Allow-Kerberos | Any | SG-Infra-Domain-Controllers | Kerberos (88/UDP+TCP) | Allow |
| 6 | Allow-SMB-DC | Any | SG-Infra-Domain-Controllers | SMB (445) | Allow |

## Files

```
infra/
├── README.md
├── security_groups.py   # Creates/updates infrastructure security groups
└── policy.py            # DFW policy and rules  (coming soon)
```

## Usage

### Prerequisites
```bash
pip install requests
```

### Populate member data
Open `security_groups.py` and edit the `GROUPS` dictionary:
- `ip_addresses` — static IPs or CIDRs for servers not yet tagged
- `vm_ext_ids` — vCenter MoRef IDs (e.g. `"vm-1042"`) for explicit VM membership
- `tag_value` — already set; drives dynamic membership via NSX tag conditions

### Dry run (no changes)
```bash
python infra/security_groups.py \
  --nsx-manager <IP_OR_FQDN> \
  --username admin \
  --password <password> \
  --dry-run
```

### Apply
```bash
python infra/security_groups.py \
  --nsx-manager <IP_OR_FQDN> \
  --username admin \
  --password <password>
```

### Lab / self-signed cert environments
Add `--no-verify-ssl` to either command above.

## Customization

| Variable | Location | Default | Purpose |
|---|---|---|---|
| `GROUP_PREFIX` | top of `security_groups.py` | `SG-Infra-` | Prefix on all group names and IDs |
| `TAG_SCOPE` | top of `security_groups.py` | `Infra` | NSX tag scope for infrastructure tags |
| `DOMAIN` | top of `security_groups.py` | `default` | NSX Policy domain |