83 lines
2.9 KiB
Markdown
83 lines
2.9 KiB
Markdown
# [AppName] — NSX Security Blueprint Template
|
|
|
|
Generic template for creating NSX tags, security groups, and a Distributed Firewall (DFW) policy for a new application. Copy this directory and replace `[AppName]` throughout.
|
|
|
|
## Application Overview
|
|
|
|
_Describe the application, its role in the environment, and the tiers that need to be segmented._
|
|
|
|
## Tiers & Tags
|
|
|
|
| Tag | Scope | Purpose |
|
|
|---|---|---|
|
|
| `[AppName]\|Web` | `AppName` | Web / presentation tier |
|
|
| `[AppName]\|App` | `AppName` | Application tier |
|
|
| `[AppName]\|DB` | `AppName` | Database tier |
|
|
|
|
_Add or remove tiers as needed._
|
|
|
|
## Security Groups
|
|
|
|
| Group | Membership Criteria | Purpose |
|
|
|---|---|---|
|
|
| `SG-[AppName]-Web` | Tag: `[AppName]\|Web` | Web-tier VMs |
|
|
| `SG-[AppName]-App` | Tag: `[AppName]\|App` | Application-tier VMs |
|
|
| `SG-[AppName]-DB` | Tag: `[AppName]\|DB` | Database-tier VMs |
|
|
| `SG-[AppName]-All` | All groups above | All app workloads — used in lockdown rule |
|
|
|
|
## DFW Policy: `Policy-[AppName]`
|
|
|
|
| # | Rule Name | Source | Destination | Service | Action | Applied To |
|
|
|---|---|---|---|---|---|---|
|
|
| 1 | Allow-HTTPS-Web | Any | SG-[AppName]-Web | HTTPS (443) | Allow | DFW |
|
|
| 2 | Allow-MSSQL-DB | SG-[AppName]-App | SG-[AppName]-DB | MSSQL (1433) | Allow | DFW |
|
|
| 3 | Allow-SSH-DB | SG-[AppName]-Mgmt | SG-[AppName]-DB | SSH (22) | Allow | DFW |
|
|
| 4 | Lockdown-[AppName] | Any | SG-[AppName]-All | Any | Deny | SG-[AppName]-All |
|
|
|
|
> **Lockdown rule** (last rule): set **Applied To** to `SG-[AppName]-All` so the deny is scoped to this application's workloads only and does not affect other traffic on the DFW.
|
|
|
|
## Infrastructure Policy
|
|
|
|
An infrastructure-category policy (`Policy-Infra-[AppName]`) should be used for cross-cutting concerns such as:
|
|
- DNS / NTP access from app workloads
|
|
- AD/LDAP access
|
|
- Monitoring and backup agent traffic
|
|
- Syslog forwarding
|
|
|
|
_This policy lives under the **Infrastructure** DFW category and is documented separately._
|
|
|
|
## Files
|
|
|
|
```
|
|
_template/
|
|
├── README.md
|
|
├── deploy.py # Main entry point — orchestrates tags, groups, policy
|
|
├── tags.py # Tag creation logic
|
|
├── security_groups.py # Security group creation logic
|
|
└── policy.py # DFW policy and rule creation logic
|
|
```
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python <appname>/deploy.py \
|
|
--nsx-manager <IP_OR_FQDN> \
|
|
--username <admin_user> \
|
|
--password <password>
|
|
```
|
|
|
|
### Optional flags
|
|
| Flag | Default | Description |
|
|
|---|---|---|
|
|
| `--dry-run` | False | Print planned changes without applying them |
|
|
| `--verify-ssl` | True | Disable with `--no-verify-ssl` for lab environments |
|
|
|
|
## Customization Checklist
|
|
|
|
- [ ] Replace all `[AppName]` placeholders
|
|
- [ ] Add/remove tiers to match actual application architecture
|
|
- [ ] Adjust services/ports in the policy table
|
|
- [ ] Define which group gets SSH admin access (Rule 3 source)
|
|
- [ ] Review lockdown rule — confirm Applied To is correct
|
|
- [ ] Add infrastructure policy rules as needed
|