65 lines
2.2 KiB
Markdown
65 lines
2.2 KiB
Markdown
# EPIC EHR — NSX Security Blueprint
|
|
|
|
Automates NSX tags, security groups, and Distributed Firewall (DFW) policy for an EPIC Electronic Health Records deployment.
|
|
|
|
## Application Overview
|
|
|
|
EPIC is a multi-tier healthcare EHR platform. This blueprint segments the EPIC workloads into distinct security zones using NSX micro-segmentation.
|
|
|
|
## Tiers & Tags
|
|
|
|
| Tag | Scope | Purpose |
|
|
|---|---|---|
|
|
| `EPIC\|Web` | `AppName` | EPIC web/presentation tier |
|
|
| `EPIC\|App` | `AppName` | EPIC application tier |
|
|
| `EPIC\|DB` | `AppName` | EPIC database tier |
|
|
| `EPIC\|Mgmt` | `AppName` | EPIC management/Hyperspace servers |
|
|
|
|
## Security Groups
|
|
|
|
| Group | Membership Criteria | Purpose |
|
|
|---|---|---|
|
|
| `SG-EPIC-Web` | Tag: `EPIC\|Web` | Web-tier VMs |
|
|
| `SG-EPIC-App` | Tag: `EPIC\|App` | Application-tier VMs |
|
|
| `SG-EPIC-DB` | Tag: `EPIC\|DB` | Database-tier VMs |
|
|
| `SG-EPIC-Mgmt` | Tag: `EPIC\|Mgmt` | Management/Hyperspace VMs |
|
|
| `SG-EPIC-All` | Tag: `EPIC\|*` (all above) | All EPIC workloads — used in lockdown rules |
|
|
|
|
## DFW Policy: `Policy-EPIC`
|
|
|
|
| # | Rule Name | Source | Destination | Service | Action |
|
|
|---|---|---|---|---|---|
|
|
| 1 | Allow-HTTPS-Web | Any | SG-EPIC-Web | HTTPS (443) | Allow |
|
|
| 2 | Allow-App-to-DB | SG-EPIC-App | SG-EPIC-DB | MSSQL (1433) | Allow |
|
|
| 3 | Allow-SSH-DB | SG-EPIC-Mgmt | SG-EPIC-DB | SSH (22) | Allow |
|
|
| 4 | Allow-Web-to-App | SG-EPIC-Web | SG-EPIC-App | HTTP/HTTPS | Allow |
|
|
| 5 | Lockdown-EPIC | Any | SG-EPIC-All | Any | Deny |
|
|
|
|
> Rule 5 (Lockdown) has **Applied To** set to `SG-EPIC-All` to scope the deny to EPIC workloads only.
|
|
|
|
## Files
|
|
|
|
```
|
|
epic/
|
|
├── README.md
|
|
├── deploy.py # Main entry point — orchestrates tags, groups, policy
|
|
├── tags.py # Tag creation logic
|
|
├── security_groups.py # Security group creation logic
|
|
└── policy.py # DFW policy and rule creation logic
|
|
```
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python epic/deploy.py \
|
|
--nsx-manager <IP_OR_FQDN> \
|
|
--username <admin_user> \
|
|
--password <password>
|
|
```
|
|
|
|
### Optional flags
|
|
| Flag | Default | Description |
|
|
|---|---|---|
|
|
| `--dry-run` | False | Print planned changes without applying them |
|
|
| `--verify-ssl` | True | Disable with `--no-verify-ssl` for lab environments |
|