Scripts on SneakU

VMware Configuration Maximums PowerShell Module

Tue, 01 Dec 2020 00:00:00 +0000

A couple of weeks ago when I was helping a colleague out with a script to count the number of DFW rules on a host , I needed to see what other (if any) configuration maximums had changed between 2 releases of NSX-T.

If you take a look at the configmax site https://configmax.vmware.com , there is a link which will “Compare Limits” for you.

And this allows you to choose the releases that you want to compare

Monitoring NSX FW Rules per host

Wed, 18 Nov 2020 00:00:00 +0000

Today I was asked for some help in figuring out the number of NSX-T Distributed Firewall rules configured for all filters on a given ESXi host.

Why do we need to figure out this value? If you take a look at the configurations maximums page at configmax.vmware.com, you’ll see one of the NSX-T Configuration Maximums is the number of Distributed Firewall Rules per Hypervisor Host.

Up until recently (NSX-T 3.0.2), this number had always remained the same at 10,000 and was something that you should monitor to make sure you remained within this (soft) limit.

Counting Exploded NSX-v DFW Rules

Tue, 09 Jun 2020 00:00:00 +0000

When working with a customer recently, there was a question raised about how to calculate the actual number of NSX-v distributed firewall rules configured for a given VM on the dataplane of an ESXi host.

Whilst the short answer was to jump onto the console of the hypervisor or SSH into the host and look at the rules configured on the filter with the following command:

vsipioctl getrules -f <filtername>

Looks easy enough right? However, It didn’t really work in this specific customers environment as SSH and console access to the hypervisors was managed by a 3rd party and hence it was impossible for the customer to run the above command.

How to sync a dynamic NSX-T group to an external system

Mon, 02 Mar 2020 00:00:00 +0000

One of the things that makes NSX-T such a flexible platform when it comes to creating security policy is the ability to group membership defined by dynamic criteria, or based on objects such as a logical segment.

Once a group has been defined in NSX-T based on dynamic criteria, its membership can grow and shrink based on the specified criteria, which is awesome, and allows for virtual workloads to be added/removed from groups based on other attributes (e.g tags, amongst other attributes). But one of the sticking points of this extremely dynamic behaviour is that the groups are only available within the specific NSX-T environment for which they are configured.

NSX-v: Where is my object used that I am trying to delete?

Thu, 07 Sep 2017 00:00:00 +0000

Over the past few years of working with NSX vSphere, one of the more frustrating things that would happen is that you would try to delete an object of some description (IP Set, Security Group, Service etc) and you would get the annoying message in the UI which says the object is in use, but it doesn’t give you any more information or any context of where to even start looking to find out where it is being used.

Log Insight & NSX-v DFW

Fri, 05 May 2017 00:00:00 +0000

I was recently asked by a customer who is running NSX vSphere (NSX-v) and Log Insight, is there a way they can export data from Log Insight that will give them the unique source/destination/protocol/destinationPort from the DFW logs for a given ruleId over a given time period. This exported data could then be fed into a PowerNSX (Get it on GitHub) script to create the required firewall rules.

My initial response to the question was “buggered if I know, but I will send an email to some people that will know”.

My Python Virtual Env Setup Instructions

Thu, 17 Nov 2016 00:00:00 +0000

Seeing as though I am always building different Ubuntu virtual machines to perform various python actions on (often on different customer sites), I find myself setting up the same things over and over again.

My notes for this process are normally scattered between Notepad/TextEdit and Evernote, so its about time to put them all in the one spot so I can reference them easily.

Depending on the environment I am working in, I may need to do an upgrade of the Ubuntu OS.

NSX-v - How to find Object IDs for almost everything!

Tue, 12 Jul 2016 00:00:00 +0000

When starting out with the NSX-v API, you will quickly learn that there are times where you are required to reference an object, like when you want to add a member to a security group, you are required to know the object ID of the object you want to add as a member to the security group, as well as the object ID of the security group itself.

When using the NSX-v UI, you can try as hard as you want, but your aren’t going to be able to find the security group object ID. So how do you find it?

NSXRAMLCLIENT on Ubuntu Issues

Wed, 30 Sep 2015 00:00:00 +0000

Following on from my last post about the NSXRAMLCLIENT, I decided to setup an Ubuntu machine dedicated to being able to run the NSXRAMLCLIENT in my home lab.

Using my own instructions that I had written previously to get it up and running on my OSX 10.10.5 machine, I came across a peculiar issue when trying to initiate a connection to the nsx manager.

Here is the code I was running which works on my OSX machine without issues:

NSX vSphere RAML Client

Fri, 18 Sep 2015 00:00:00 +0000

Up until now, my programmatic interactions with the NSX API have all been hacked together based on the NSX API Guide, due to the lack of a specific NSX API scripting interface.

For typical vSphere scripting, there has been PowerCli and also pyvmomi and I am sure a few more I don’t know about, but nothing created specifically for NSX. This meant that for individuals like myself, who wanted to write scripts to interact with the NSX-v API through python, we would have to create all the API calls from scratch which is time consuming and then learn how to parse the responses and content.

Scripting: NSX-v – Bulk DFW Rule Creation

Wed, 26 Aug 2015 00:00:00 +0000

Recently when doing some performance testing with a customer, we wanted to have the ability to bulk create a number of DFW rules. By leveraging some python scripting and the NSX-v API, I came up with a flexible and re-useable script which can be used to create a new section and populate it with up to 997 DFW rules. The reason for creating a new section is so that when it comes time to delete the test rules, its as simple as just deleting the section, which will delete all rules within the section.

Scripting - Resetting NSX-v objects

Sun, 14 Jun 2015 00:00:00 +0000

On various engagements I am involved with, I often need to produce some code to add or delete objects from NSX-v. These objects in general are things like IP Sets, MAC Sets, Security Groups, Security Tags, Services, Service Groups, Security Policies and even deleting the FW rulebase itself.

Until recently I was doing this manually as I was dealing with relatively small numbers of objects, however on a previous engagement I was working on a script to import up to 33,000 objects and when testing the script in a dev environment, we needed a way to go through and delete everything we had just imported and set it back to “defaults”.

Scripting syslog server configurations on NSX-v Controllers

Thu, 28 May 2015 00:00:00 +0000

Its well documented that the only way to configure syslog settings on NSX-v controllers is via the REST API. One of the things I find myself constantly doing over and over again on customer engagements is configuring syslog servers details on the NSX-v controllers, whether its because I am at a new client, or someone decides to change the destination for their syslog and we need to update them all.

Scripting: NSX-v – Displaying Security Group Members

Fri, 24 Apr 2015 00:00:00 +0000

Often when working in customer environments, there is a requirement to define security group members which are not virtual machines within the visualised environment. To achieve this, these security group members must be defined as an IP Set.

The IP Set can then be included as an object in a security group.

However, within the UI, it doesn’t show you all the non-vm members of a security group.

Scripting: NSX-v - Security Groups with Dynamic membership

Thu, 19 Feb 2015 00:00:00 +0000

NSX-v allows the creation of Security Groups to group objects to be used in DFW rules and security policies. Each security group can have a mix of static and dynamic membership (If you want to get picky, you can also statically exclude objects). One of the possible ways to dynamically include members into the security group is to match on a security tag. This allows a VM to have security tags assigned to them, and based on the security tag, a VM can be dynamically added as a security group member.

Scripting: NSX-v - Importing Checkpoint Objects

Fri, 06 Feb 2015 00:00:00 +0000

When faced with migrating from a Checkpoint installation to a VMware NSX-v installation, at some point someone is going to need to get all the objects across to the new firewall platform. I was recently asked to help add some functionality to a script to take some data from an odumper csv output and pump it into NSX-v.

The following script is a bit of a hack I put together. The script is based off one written by Brett Drayton (www.brettdrayton.com) in this post.

Scripting: Querying NSX-v service objects by port

Thu, 05 Feb 2015 00:00:00 +0000

When using the NSX-v distributed firewall (DFW) have you ever need to find out if a service has already been configured in the system for a particular port number?

Recently I was given a sample ruleset from a client to re-create in the DFW, and one thing that stood out was that when creating NSX firewall rules and faced with a random port number that needed to be configured for a rule, there is no easy way to find out if a service has already been configured using that port.

Scripting, Scripting and more Scripting

Tue, 03 Feb 2015 00:00:00 +0000

Over my years as a network engineer there has always been some element of scripting required. Whether it was formally required by a project, a particular situation or whether it was because i was sick of doing the same thing over and over again and wanted to make my life easier.

As part of my new role at VMware, I get to play with NSX for vSphere or NSX-v, and one thing that becomes apparent, is that if you don’t learn how to use the REST API, there will be certain situations where you will not be able to achieve your desired outcome. The NSX REST API, can be used to configure items which are not exposed in the UI, or you can use your favourite scripting language and script repetitive tasks.