95 lines
3.4 KiB
Markdown
95 lines
3.4 KiB
Markdown
# Infrastructure — NSX Security Blueprint
|
|
|
|
Automates NSX security groups and DFW policies for shared infrastructure services used across all application blueprints. Lives under the NSX **Infrastructure** DFW category.
|
|
|
|
## Scope
|
|
|
|
Infrastructure groups and policies cover cross-cutting services that every application needs to reach — DNS, NTP, Active Directory, monitoring, backup, syslog, etc. By placing these rules in the **Infrastructure** category they evaluate before application-level policies and remain centrally managed.
|
|
|
|
## Tag Convention
|
|
|
|
| Scope | Value | Purpose |
|
|
|---|---|---|
|
|
| `Infra` | `DNS Server` | Authoritative / recursive DNS servers |
|
|
| `Infra` | `NTP Server` | NTP time sources |
|
|
| `Infra` | `Domain Controller` | Active Directory Domain Controllers |
|
|
|
|
Apply these tags to VMs in NSX (or via vCenter tag sync) so that new servers are automatically picked up by the dynamic group membership criteria.
|
|
|
|
## Security Groups
|
|
|
|
Managed by `security_groups.py`. Each group uses a **union** of three member sources so the groups can be built up incrementally:
|
|
|
|
| Group | Dynamic (Tag) | Static IPs | Explicit VMs |
|
|
|---|---|---|---|
|
|
| `SG-Infra-DNS-Servers` | `Infra:DNS Server` | ✓ | ✓ |
|
|
| `SG-Infra-NTP-Servers` | `Infra:NTP Server` | ✓ | ✓ |
|
|
| `SG-Infra-Domain-Controllers` | `Infra:Domain Controller` | ✓ | ✓ |
|
|
|
|
> The `GROUP_PREFIX` (`SG-Infra-`) is configurable at the top of each script.
|
|
|
|
## DFW Policy: `Policy-Infra`
|
|
|
|
_Defined in `policy.py` — coming soon._
|
|
|
|
Planned rules (Infrastructure category, evaluated before application policies):
|
|
|
|
| # | Rule Name | Source | Destination | Service | Action |
|
|
|---|---|---|---|---|---|
|
|
| 1 | Allow-DNS-UDP | Any | SG-Infra-DNS-Servers | DNS/UDP (53) | Allow |
|
|
| 2 | Allow-DNS-TCP | Any | SG-Infra-DNS-Servers | DNS/TCP (53) | Allow |
|
|
| 3 | Allow-NTP | Any | SG-Infra-NTP-Servers | NTP/UDP (123) | Allow |
|
|
| 4 | Allow-LDAP | Any | SG-Infra-Domain-Controllers | LDAP (389), LDAPS (636) | Allow |
|
|
| 5 | Allow-Kerberos | Any | SG-Infra-Domain-Controllers | Kerberos (88/UDP+TCP) | Allow |
|
|
| 6 | Allow-SMB-DC | Any | SG-Infra-Domain-Controllers | SMB (445) | Allow |
|
|
|
|
## Files
|
|
|
|
```
|
|
infra/
|
|
├── README.md
|
|
├── security_groups.py # Creates/updates infrastructure security groups
|
|
└── policy.py # DFW policy and rules (coming soon)
|
|
```
|
|
|
|
## Usage
|
|
|
|
### Prerequisites
|
|
```bash
|
|
pip install requests
|
|
```
|
|
|
|
### Populate member data
|
|
Open `security_groups.py` and edit the `GROUPS` dictionary:
|
|
- `ip_addresses` — static IPs or CIDRs for servers not yet tagged
|
|
- `vm_ext_ids` — vCenter MoRef IDs (e.g. `"vm-1042"`) for explicit VM membership
|
|
- `tag_value` — already set; drives dynamic membership via NSX tag conditions
|
|
|
|
### Dry run (no changes)
|
|
```bash
|
|
python infra/security_groups.py \
|
|
--nsx-manager <IP_OR_FQDN> \
|
|
--username admin \
|
|
--password <password> \
|
|
--dry-run
|
|
```
|
|
|
|
### Apply
|
|
```bash
|
|
python infra/security_groups.py \
|
|
--nsx-manager <IP_OR_FQDN> \
|
|
--username admin \
|
|
--password <password>
|
|
```
|
|
|
|
### Lab / self-signed cert environments
|
|
Add `--no-verify-ssl` to either command above.
|
|
|
|
## Customization
|
|
|
|
| Variable | Location | Default | Purpose |
|
|
|---|---|---|---|
|
|
| `GROUP_PREFIX` | top of `security_groups.py` | `SG-Infra-` | Prefix on all group names and IDs |
|
|
| `TAG_SCOPE` | top of `security_groups.py` | `Infra` | NSX tag scope for infrastructure tags |
|
|
| `DOMAIN` | top of `security_groups.py` | `default` | NSX Policy domain |
|