EPIC EHR — NSX Security Blueprint

Automates NSX tags, security groups, and Distributed Firewall (DFW) policy for an EPIC Electronic Health Records deployment.

Application Overview

EPIC is a multi-tier healthcare EHR platform. This blueprint segments the EPIC workloads into distinct security zones using NSX micro-segmentation.

Tiers & Tags

Tag	Scope	Purpose
`EPIC\|Web`	`AppName`	EPIC web/presentation tier
`EPIC\|App`	`AppName`	EPIC application tier
`EPIC\|DB`	`AppName`	EPIC database tier
`EPIC\|Mgmt`	`AppName`	EPIC management/Hyperspace servers

Security Groups

Group	Membership Criteria	Purpose
`SG-EPIC-Web`	Tag: `EPIC\|Web`	Web-tier VMs
`SG-EPIC-App`	Tag: `EPIC\|App`	Application-tier VMs
`SG-EPIC-DB`	Tag: `EPIC\|DB`	Database-tier VMs
`SG-EPIC-Mgmt`	Tag: `EPIC\|Mgmt`	Management/Hyperspace VMs
`SG-EPIC-All`	Tag: `EPIC\|*` (all above)	All EPIC workloads — used in lockdown rules

DFW Policy: `Policy-EPIC`

#	Rule Name	Source	Destination	Service	Action
1	Allow-HTTPS-Web	Any	SG-EPIC-Web	HTTPS (443)	Allow
2	Allow-App-to-DB	SG-EPIC-App	SG-EPIC-DB	MSSQL (1433)	Allow
3	Allow-SSH-DB	SG-EPIC-Mgmt	SG-EPIC-DB	SSH (22)	Allow
4	Allow-Web-to-App	SG-EPIC-Web	SG-EPIC-App	HTTP/HTTPS	Allow
5	Lockdown-EPIC	Any	SG-EPIC-All	Any	Deny

Rule 5 (Lockdown) has Applied To set to SG-EPIC-All to scope the deny to EPIC workloads only.

Files

epic/
├── README.md
├── deploy.py          # Main entry point — orchestrates tags, groups, policy
├── tags.py            # Tag creation logic
├── security_groups.py # Security group creation logic
└── policy.py          # DFW policy and rule creation logic

Usage

python epic/deploy.py \
  --nsx-manager <IP_OR_FQDN> \
  --username <admin_user> \
  --password <password>

Optional flags

Flag	Default	Description
`--dry-run`	False	Print planned changes without applying them
`--verify-ssl`	True	Disable with `--no-verify-ssl` for lab environments

README.md