[AppName] — NSX Security Blueprint Template

Generic template for creating NSX tags, security groups, and a Distributed Firewall (DFW) policy for a new application. Copy this directory and replace [AppName] throughout.

Application Overview

Describe the application, its role in the environment, and the tiers that need to be segmented.

Tiers & Tags

Tag	Scope	Purpose
`[AppName]\|Web`	`AppName`	Web / presentation tier
`[AppName]\|App`	`AppName`	Application tier
`[AppName]\|DB`	`AppName`	Database tier

Add or remove tiers as needed.

Security Groups

Group	Membership Criteria	Purpose
`SG-[AppName]-Web`	Tag: `[AppName]\|Web`	Web-tier VMs
`SG-[AppName]-App`	Tag: `[AppName]\|App`	Application-tier VMs
`SG-[AppName]-DB`	Tag: `[AppName]\|DB`	Database-tier VMs
`SG-[AppName]-All`	All groups above	All app workloads — used in lockdown rule

DFW Policy: `Policy-[AppName]`

#	Rule Name	Source	Destination	Service	Action	Applied To
1	Allow-HTTPS-Web	Any	SG-[AppName]-Web	HTTPS (443)	Allow	DFW
2	Allow-MSSQL-DB	SG-[AppName]-App	SG-[AppName]-DB	MSSQL (1433)	Allow	DFW
3	Allow-SSH-DB	SG-[AppName]-Mgmt	SG-[AppName]-DB	SSH (22)	Allow	DFW
4	Lockdown-[AppName]	Any	SG-[AppName]-All	Any	Deny	SG-[AppName]-All

Lockdown rule (last rule): set Applied To to SG-[AppName]-All so the deny is scoped to this application's workloads only and does not affect other traffic on the DFW.

Infrastructure Policy

An infrastructure-category policy (Policy-Infra-[AppName]) should be used for cross-cutting concerns such as:

DNS / NTP access from app workloads
AD/LDAP access
Monitoring and backup agent traffic
Syslog forwarding

This policy lives under the Infrastructure DFW category and is documented separately.

Files

_template/
├── README.md
├── deploy.py          # Main entry point — orchestrates tags, groups, policy
├── tags.py            # Tag creation logic
├── security_groups.py # Security group creation logic
└── policy.py          # DFW policy and rule creation logic

Usage

python <appname>/deploy.py \
  --nsx-manager <IP_OR_FQDN> \
  --username <admin_user> \
  --password <password>

Optional flags

Flag	Default	Description
`--dry-run`	False	Print planned changes without applying them
`--verify-ssl`	True	Disable with `--no-verify-ssl` for lab environments

Customization Checklist

Replace all [AppName] placeholders
Add/remove tiers to match actual application architecture
Adjust services/ports in the policy table
Define which group gets SSH admin access (Rule 3 source)
Review lockdown rule — confirm Applied To is correct
Add infrastructure policy rules as needed

README.md