nsx_blueprints/infra

Infrastructure — NSX Security Blueprint

Automates NSX security groups and DFW policies for shared infrastructure services used across all application blueprints. Lives under the NSX Infrastructure DFW category.

Scope

Infrastructure groups and policies cover cross-cutting services that every application needs to reach — DNS, NTP, Active Directory, monitoring, backup, syslog, etc. By placing these rules in the Infrastructure category they evaluate before application-level policies and remain centrally managed.

Tag Convention

Scope	Value	Purpose
Infra	DNS Server	Authoritative / recursive DNS servers
Infra	NTP Server	NTP time sources
Infra	Domain Controller	Active Directory Domain Controllers

Apply these tags to VMs in NSX (or via vCenter tag sync) so that new servers are automatically picked up by the dynamic group membership criteria.

Security Groups

Managed by security_groups.py. Each group uses a union of three member sources so the groups can be built up incrementally:

Group	Dynamic (Tag)	Static IPs	Explicit VMs
SG-Infra-DNS-Servers	Infra:DNS Server	✓	✓
SG-Infra-NTP-Servers	Infra:NTP Server	✓	✓
SG-Infra-Domain-Controllers	Infra:Domain Controller	✓	✓

The GROUP_PREFIX (SG-Infra-) is configurable at the top of each script.

DFW Policy: Policy-Infra

Defined in policy.py — coming soon.

Planned rules (Infrastructure category, evaluated before application policies):

#	Rule Name	Source	Destination	Service	Action
1	Allow-DNS-UDP	Any	SG-Infra-DNS-Servers	DNS/UDP (53)	Allow
2	Allow-DNS-TCP	Any	SG-Infra-DNS-Servers	DNS/TCP (53)	Allow
3	Allow-NTP	Any	SG-Infra-NTP-Servers	NTP/UDP (123)	Allow
4	Allow-LDAP	Any	SG-Infra-Domain-Controllers	LDAP (389), LDAPS (636)	Allow
5	Allow-Kerberos	Any	SG-Infra-Domain-Controllers	Kerberos (88/UDP+TCP)	Allow
6	Allow-SMB-DC	Any	SG-Infra-Domain-Controllers	SMB (445)	Allow

Files

infra/
├── README.md
├── security_groups.py   # Creates/updates infrastructure security groups
└── policy.py            # DFW policy and rules  (coming soon)

Usage

Prerequisites

pip install requests

Populate member data

Open security_groups.py and edit the GROUPS dictionary:

• ip_addresses — static IPs or CIDRs for servers not yet tagged
• vm_ext_ids — vCenter MoRef IDs (e.g. "vm-1042") for explicit VM membership
• tag_value — already set; drives dynamic membership via NSX tag conditions

Dry run (no changes)

python infra/security_groups.py \
  --nsx-manager <IP_OR_FQDN> \
  --username admin \
  --password <password> \
  --dry-run

Apply

python infra/security_groups.py \
  --nsx-manager <IP_OR_FQDN> \
  --username admin \
  --password <password>

Lab / self-signed cert environments

Add --no-verify-ssl to either command above.

Customization

Variable	Location	Default	Purpose
GROUP_PREFIX	top of security_groups.py	SG-Infra-	Prefix on all group names and IDs
TAG_SCOPE	top of security_groups.py	Infra	NSX tag scope for infrastructure tags
DOMAIN	top of security_groups.py	default	NSX Policy domain