Automate NSX-T with PowerCLI

While working on an NSX-T project I got the question from the customer to deliver some firewall and network automation based on PowerShell. This to help them ramp up the creation of networks and firewall rules. I pointed them to the PowerCLI Preview for NSX-T, but I wasn’t aware that this fling only was able to retrieve information from NSX-T and not create items/objects. So, how can we do this then? I knew we were able to manage NSX-T since PowerCLI version 6.5.3, but how does this work?

After some google-fu I came across a blog post of Kyle Ruddy named: Getting Started with the PowerCLI Module for VMware NSX-T. This article describes how the NSX-T PowerShell Module works and which cmdlets where available:

Connect-NsxtServer

Disconnect-NsxtServer

Get-NsxtService

Only 3 commands? Yes, only 3 commands! Because of the simple reason that with the 3rd command you have full access to NSX-T’s public API! And therefore you’re able to retrieve and create items/objects. In the blog article Kyle also gives some examples on how to Retrieve Transport Zone Information or perform Logical Switch and IP Pool Management. But how do we create an NSGroup or a Distributed Firewall Section? This post contains some additional examples and I’ll update this post as new scripts will come along.

The first thing we need to do is connect to the NSX-T Manager:

Connect-NsxtServer -Server <NSX-T FQDN/IP> -User <Username> -Password <Password>

1	Connect-NsxtServer -Server <NSX-T FQDN/IP> -User <Username> -Password <Password>

NSGroups

Create a NSGroup based on a Security Tag

#Variables
$nsgroupname = "NS-Test"
$nstagname = "ST-Test"
#Create NSGroup
$nsgroupsvc = Get-NsxtService -Name com.vmware.nsx.ns_groups
$nsgroupspec = $nsgroupsvc.Help.create.ns_group.Create()
$nsgroupmemberspec = $nsgroupsvc.Help.create.ns_group.membership_criteria.Element.NS_group_tag_expression.create()
$nsgroupspec.display_name = $nsgroupname
$nsgroupmemberspec.tag_op = "EQUALS"
$nsgroupmemberspec.tag = $nstagname
$nsgroupmemberspec.target_type = "VirtualMachine"
$nsgroupspec.membership_criteria.Add($nsgroupmemberspec)
$nsgroupsvc.create($nsgroupspec)

#Variables

$nsgroupname = "NS-Test"

$nstagname = "ST-Test"

#Create NSGroup

$nsgroupsvc = Get-NsxtService -Name com.vmware.nsx.ns_groups

$nsgroupspec = $nsgroupsvc.Help.create.ns_group.Create()

$nsgroupmemberspec = $nsgroupsvc.Help.create.ns_group.membership_criteria.Element.NS_group_tag_expression.create()

$nsgroupspec.display_name = $nsgroupname

$nsgroupmemberspec.tag_op = "EQUALS"

$nsgroupmemberspec.tag = $nstagname

$nsgroupmemberspec.target_type = "VirtualMachine"

$nsgroupspec.membership_criteria.Add($nsgroupmemberspec)

$nsgroupsvc.create($nsgroupspec)

Delete a NSGroup

#Variables
$deletensgroupname = "NS-Test"
#Delete NSGroup
$nsgroupsvc = Get-NsxtService -Name com.vmware.nsx.ns_groups
$nsgroups = $nsgroupsvc.list()
$nsgroup = $nsgroups.results | Where-Object {$_.display_name -eq $deletensgroupname}
$nsgroupsvc.delete($nsgroup.id)

#Variables

$deletensgroupname = "NS-Test"

#Delete NSGroup

$nsgroupsvc = Get-NsxtService -Name com.vmware.nsx.ns_groups

$nsgroups = $nsgroupsvc.list()

$nsgroup = $nsgroups.results | Where-Object {$_.display_name -eq $deletensgroupname}

$nsgroupsvc.delete($nsgroup.id)

List all NSGroups

#List all NSGroups
$nsgroupsvc = Get-NsxtService -Name com.vmware.nsx.ns_groups
$nsgroups = $nsgroupsvc.list()
$nsgroups.results | Format-Table -Autosize -Property id, display_name, members

#List all NSGroups

$nsgroupsvc = Get-NsxtService -Name com.vmware.nsx.ns_groups

$nsgroups = $nsgroupsvc.list()

$nsgroups.results | Format-Table -Autosize -Property id, display_name, members

DFW Sections

Search for DFW Section

#Variables
$fwsectionname = "3 Tier-App" 
#Search for DFW Section
$fwsectsvc = Get-NsxtService -Name com.vmware.nsx.firewall.sections
$fwsections = $fwsectsvc.list()
$fwsection = $fwsections.results | Where-Object {$_.display_name -eq $fwsectionname}

#Variables

$fwsectionname = "3 Tier-App"

#Search for DFW Section

$fwsectsvc = Get-NsxtService -Name com.vmware.nsx.firewall.sections

$fwsections = $fwsectsvc.list()

$fwsection = $fwsections.results | Where-Object {$_.display_name -eq $fwsectionname}

Create Firewall Rule in DFW Section

#Variables
$fwrulename = "Test Rule"
$fwruleaction = "ALLOW"
#Create Firewall Rule in DFW Section
$fwrulesvc = Get-NsxtService -Name com.vmware.nsx.firewall.sections.rules
$fwrulespec = $fwrulesvc.Help.create.firewall_rule.Create()
$fwrulespec.display_name = $fwrulename
$fwrulespec.action = $fwruleaction
$fwrulespec.logged = $true
$fwrulespec.revision = $fwsection.revision
$fwrule = $fwrulesvc.create($fwsection.id, $fwrulespec)

#Variables

$fwrulename = "Test Rule"

$fwruleaction = "ALLOW"

#Create Firewall Rule in DFW Section

$fwrulesvc = Get-NsxtService -Name com.vmware.nsx.firewall.sections.rules

$fwrulespec = $fwrulesvc.Help.create.firewall_rule.Create()

$fwrulespec.display_name = $fwrulename

$fwrulespec.action = $fwruleaction

$fwrulespec.logged = $true

$fwrulespec.revision = $fwsection.revision

$fwrule = $fwrulesvc.create($fwsection.id, $fwrulespec)

Create DFW Section

#Variables
$fwsectname = "New Section"
#Create DFW Section
$fwsectspec = $fwsectsvc.Help.create.firewall_section.Create()
$fwsectspec.section_type = "LAYER3"
$fwsectspec.display_name = $fwsectname
$fwsectspec.stateful = $true
$fwsection = $fwsectsvc.create($fwsectspec, $fwsection.id, "insert_after")

#Variables

$fwsectname = "New Section"

#Create DFW Section

$fwsectspec = $fwsectsvc.Help.create.firewall_section.Create()

$fwsectspec.section_type = "LAYER3"

$fwsectspec.display_name = $fwsectname

$fwsectspec.stateful = $true

$fwsection = $fwsectsvc.create($fwsectspec, $fwsection.id, "insert_after")

IP Sets

Create IP Set

#Variables
$ipsetname = "IP-Google"
$ipsetips = "8.8.8.8,8.8.4.4"
#Create IP Set
$ipsetsvc = Get-NsxtService -Name com.vmware.nsx.ip_sets
$ipsetspec = $ipsetsvc.Help.create.ip_set.Create()
$ipsetspec.ip_addresses = New-Object System.Collections.Generic.List[string]
$ipsetspec.display_name = $ipsetname
$ipsetips.Split(",") | ForEach { $ipsetspec.ip_addresses.Add($_) }
$ipsetsvc.create($ipsetspec)

#Variables

$ipsetname = "IP-Google"

$ipsetips = "8.8.8.8,8.8.4.4"

#Create IP Set

$ipsetsvc = Get-NsxtService -Name com.vmware.nsx.ip_sets

$ipsetspec = $ipsetsvc.Help.create.ip_set.Create()

$ipsetspec.ip_addresses = New-Object System.Collections.Generic.List[string]

$ipsetspec.display_name = $ipsetname

$ipsetips.Split(",") | ForEach { $ipsetspec.ip_addresses.Add($_) }

$ipsetsvc.create($ipsetspec)

Delete IP Set

#Variables
$ipsetname = "IP-Google"
#Delete IP Set
$ipsets = $ipsetsvc.list()
$ipsetid = $ipsets.results | Where-Object {$_.display_name -eq $ipsetname}
$ipsetsvc.delete($ipsetid.id)

#Variables

$ipsetname = "IP-Google"

#Delete IP Set

$ipsets = $ipsetsvc.list()

$ipsetid = $ipsets.results | Where-Object {$_.display_name -eq $ipsetname}

$ipsetsvc.delete($ipsetid.id)

List all IP Sets

#List all IP Sets
$ippoolsvc = Get-NsxtService -Name com.vmware.nsx.pools.ip_pools
$ippoolsvc.list().results | Format-Table -Autosize -Property id, display_name,@{Name="subnets";Expression={$_.subnets.cidr}}

#List all IP Sets

$ippoolsvc = Get-NsxtService -Name com.vmware.nsx.pools.ip_pools

$ippoolsvc.list().results | Format-Table -Autosize -Property id, display_name,@{Name="subnets";Expression={$_.subnets.cidr}}

NS Services

Create NS Service

#Variables
$servicename = "NSS-80-TCP" 
$serviceport = "80"
$serviceprot = "TCP"
#Create NS Service
$servicesvc = Get-NsxtService -Name com.vmware.nsx.ns_services
$servicespec = $servicesvc.Help.create.ns_service.Create()
$servicespec.display_name = $servicename
$servicedetailspec = $servicesvc.Help.create.ns_service.nsservice_element.l4_port_set_NS_service.Create()
$servicedetailspec.destination_ports = New-Object System.Collections.Generic.List[string]
$servicedetailspec.destination_ports.add($serviceport)
$servicedetailspec.l4_protocol = $serviceprot
$servicedetailspec.resource_type = "L4PortSetNSService"
$servicespec.nsservice_element = $servicedetailspec
$servicesvc.create($servicespec)

#Variables

$servicename = "NSS-80-TCP"

$serviceport = "80"

$serviceprot = "TCP"

#Create NS Service

$servicesvc = Get-NsxtService -Name com.vmware.nsx.ns_services

$servicespec = $servicesvc.Help.create.ns_service.Create()

$servicespec.display_name = $servicename

$servicedetailspec = $servicesvc.Help.create.ns_service.nsservice_element.l4_port_set_NS_service.Create()

$servicedetailspec.destination_ports = New-Object System.Collections.Generic.List[string]

$servicedetailspec.destination_ports.add($serviceport)

$servicedetailspec.l4_protocol = $serviceprot

$servicedetailspec.resource_type = "L4PortSetNSService"

$servicespec.nsservice_element = $servicedetailspec

$servicesvc.create($servicespec)

Delete NS Service

#Variables
$servicename = "NSS-80-TCP"
#Delete Service
$servicesvc = Get-NsxtService -Name com.vmware.nsx.ns_services
$service = $services.results | Where-Object {$_.display_name -eq $servicename}
$servicesvc.delete($service.id)

#Variables

$servicename = "NSS-80-TCP"

#Delete Service

$servicesvc = Get-NsxtService -Name com.vmware.nsx.ns_services

$service = $services.results | Where-Object {$_.display_name -eq $servicename}

$servicesvc.delete($service.id)

List all NS Services

#List NS Services
$servicesvc = Get-NsxtService -Name com.vmware.nsx.ns_services
$services = $servicesvc.list()
$services.results | Where-Object {$_.nsservice_element.l4_protocol -ne $null} | Format-Table -Autosize -Property id, display_name,@{Name="l4_protocol";Expression={$_.nsservice_element.l4_protocol}},@{Name="destination_ports";Expression={$_.nsservice_element.destination_ports}}

#List NS Services

$servicesvc = Get-NsxtService -Name com.vmware.nsx.ns_services

$services = $servicesvc.list()

$services.results | Where-Object {$_.nsservice_element.l4_protocol -ne $null} | Format-Table -Autosize -Property id, display_name,@{Name="l4_protocol";Expression={$_.nsservice_element.l4_protocol}},@{Name="destination_ports";Expression={$_.nsservice_element.destination_ports}}

Logical Switches

Create Logical Switch

#Variables
$tzoneoverlayname = "TZ-Overlay"
$logswitchname = "PowerCLI Created LS"
#Get Transport Zone 
$tzonesvc = Get-NsxtService -Name com.vmware.nsx.transport_zones
$tzones = $tzonesvc.list()
$tzoneoverlay = $tzones.results | Where-Object {$_.display_name -eq $tzoneoverlayname}
#Create Logical Switch
$logswitchsvc = Get-NsxtService -Name com.vmware.nsx.logical_switches 
$logswitchspec = $logswitchsvc.Help.create.logical_switch.Create()
$logswitchspec.admin_state = "UP"
$logswitchspec.display_name = $logswitchname
$logswitchspec.replication_mode = "MTEP"
$logswitchspec.transport_zone_id = $tzoneoverlay.id
$logswitchsvc.create($logswitchspec)

#Variables

$tzoneoverlayname = "TZ-Overlay"

$logswitchname = "PowerCLI Created LS"

#Get Transport Zone

$tzonesvc = Get-NsxtService -Name com.vmware.nsx.transport_zones

$tzones = $tzonesvc.list()

$tzoneoverlay = $tzones.results | Where-Object {$_.display_name -eq $tzoneoverlayname}

#Create Logical Switch

$logswitchsvc = Get-NsxtService -Name com.vmware.nsx.logical_switches

$logswitchspec = $logswitchsvc.Help.create.logical_switch.Create()

$logswitchspec.admin_state = "UP"

$logswitchspec.display_name = $logswitchname

$logswitchspec.replication_mode = "MTEP"

$logswitchspec.transport_zone_id = $tzoneoverlay.id

$logswitchsvc.create($logswitchspec)

Delete Logical Switch

$logswitchname = "PowerCLI Created LS"
#Delete Logical Switch
$logswitchsvc = Get-NsxtService -Name com.vmware.nsx.logical_switches 
$logswitches = $logswitchsvc.list().results
$logswitch = $logswitches | Where-Object {$_.display_name -eq $logswitchname}
$logswitchsvc.delete($logswitch.id)

$logswitchname = "PowerCLI Created LS"

#Delete Logical Switch

$logswitchsvc = Get-NsxtService -Name com.vmware.nsx.logical_switches

$logswitches = $logswitchsvc.list().results

$logswitch = $logswitches | Where-Object {$_.display_name -eq $logswitchname}

$logswitchsvc.delete($logswitch.id)

Fabric

Update vCenter Compute Manager Credentials

#Variables
$compmanagerusername = "administrator@vsphere.local"
$compmanagerpassword = "VMware1!"
$compmanagername = "<vCenter FQDN / IP>"
#Update vCenter Credentials
$compmanagersvc = Get-NsxtService -Name com.vmware.nsx.fabric.compute_managers
$compmanagers = $compmanagersvc.list()
$compmanager = $compmanagers.results | Where-Object {$_.server -eq $compmanagername} 
$compmanagerspec = $compmanagersvc.help.update.compute_manager.Create()
$compmanagerspec.server = $compmanager.server
$compmanagerspec.origin_type = $compmanager.origin_type
$compmanagerspec.revision = $compmanager.revision
$compmanagercredspec = $compmanagersvc.Help.update.compute_manager.credential.username_password_login_credential.Create()
$compmanagercredspec.username = $compmanagerusername
$compmanagercredspec.password = $compmanagerpassword
$compmanagercredspec.thumbprint = $compmanager.credential.thumbprint
$compmanagercredspec.credential_type = "UsernamePasswordLoginCredential"
$compmanagerspec.credential = $compmanagercredspec
$compmanagersvc.update($compmanager.id, $compmanagerspec)

#Variables

$compmanagerusername = "administrator@vsphere.local"

$compmanagerpassword = "VMware1!"

$compmanagername = "<vCenter FQDN / IP>"

#Update vCenter Credentials

$compmanagersvc = Get-NsxtService -Name com.vmware.nsx.fabric.compute_managers

$compmanagers = $compmanagersvc.list()

$compmanager = $compmanagers.results | Where-Object {$_.server -eq $compmanagername}

$compmanagerspec = $compmanagersvc.help.update.compute_manager.Create()

$compmanagerspec.server = $compmanager.server

$compmanagerspec.origin_type = $compmanager.origin_type

$compmanagerspec.revision = $compmanager.revision

$compmanagercredspec = $compmanagersvc.Help.update.compute_manager.credential.username_password_login_credential.Create()

$compmanagercredspec.username = $compmanagerusername

$compmanagercredspec.password = $compmanagerpassword

$compmanagercredspec.thumbprint = $compmanager.credential.thumbprint

$compmanagercredspec.credential_type = "UsernamePasswordLoginCredential"

$compmanagerspec.credential = $compmanagercredspec

$compmanagersvc.update($compmanager.id, $compmanagerspec)

The examples above should be used with care and are on your own risk!

And if you have any cool new scripts or additions please let me know in the comments section below!

7 thoughts to “Automate NSX-T with PowerCLI”

Stéphane says:

April 10, 2019 at 11:40

Hello Marco,

Thank you very much for sharing this valuable lines of code ! I am now able to mass create lot of Logical Switches from a csv file with TransportZone/vlan/LS name.

The very different approach of NSX-T powershell commands compairing to VDS ones are really time consumming !

A question NSX specific: the Logical Switches are handled by NSX Controllers (until NSX-T 2.3, and handled by NSX Mgr starting from NSX-T 2.4). Looking at NSX Manager GUI meanwhile LS are mass created, there is a “Config State” item per LS showing how it is deployed on each NSX Ctrl nodes. Is there a way to get this info from Powershell in order to monitor proper configuration ?

Thank you !

Stéphane

Dion Rowney says:

September 18, 2019 at 18:43

Thanks for this.

I have noticed there is not a lot of updating of existing nsgroups and IPset examples which would be helpful.

Dion

Dion says:

September 19, 2019 at 22:44

I was finally able to do a simple update:

Connect-NsxtServer virttest.local
$ipsetsvc = Get-NsxtService -Name com.vmware.nsx.ip_sets
$ipset_guid = $ipsetsvc.list().results | Where-Object -Property display_name -eq ‘mydisplayname’
$ipsetspec = $ipsetsvc.Help.create.ip_set.Create()
$ipsetips = “8.8.8.8,8.8.4.4”
$ipsetspec.display_name = “theupdatedname”
$ipsetspec.revision = $ipset_guid.revision #This Line was important and wouldnt update without it
$ipsetips.Split(“,”) | ForEach { $ipsetspec.ip_addresses.Add($_) }
$ipsetsvc.update($ipset_guid.id, $ipsetspec)

Key seemed to be the revision variable.

Dion

Gautam Johar says:

May 4, 2020 at 20:08

All the above lines are good and very informative but I don’t see any service name to create Tier-0 and Tier-1 router. Please suggest.

1. Ray Brittner says:
  
  April 14, 2021 at 01:19
  
  response a little late but here you go. This PS creates T0’s. Please let me know if you have questions.
  
  # PowerCLI to create NSX-T T0’s
  # Created 3/22/2021
  # by Ray Brittner
  
  $newt0 = import-csv C:\temp\t0s.csv
  ForEach($t0 in $newt0){
  
  $newlrt0 = Get-NsxtPolicyService com.vmware.nsx_policy.infra.tier0s
  
  $lrid = $t0.id
  $lrha_mode = $t0.ha_mode
  $lrfail = $t0.failover_mode
  $lrresource = $t0.resource_type
  
  $newlrt0spec = $newlrt0.Help.patch.tier0.Create()
  
  $newlrt0spec[0].id = $lrid
  $newlrt0spec[0].ha_mode = $lrha_mode
  $newlrt0spec[0].failover_mode = $lrfail
  
  $newlrt0spec[0].resource_type = $lrresource
  
  $newlrt0.patch($newlrt0spec[0].id, $newlrt0spec[0])
  write-host(“Teir0 “+ $lrid + ” created.”)
  
  }
  
  CSV:
  Help transit_subnets internal_transit_subnets ha_mode failover_mode ipv6_profile_paths force_whitelisting default_rule_logging disable_firewall resource_type id display_name path relative_path parent_path marked_for_delete create_user create_time last_modified_user last_modified_time system_owned protection revision links schema self description tags children dhcp_config_paths
  @{Documentation=Tier-0 configuration for external connectivity.; links=; schema=; self=; revision=; create_time=; create_user=; last_modified_time=; last_modified_user=; protection=; system_owned=; description=; display_name=; id=; resource_type=; tags=; parent_path=; path=; relative_path=; children=; marked_for_delete=; default_rule_logging=; dhcp_config_paths=; disable_firewall=; failover_mode=; force_whitelisting=; ha_mode=; internal_transit_subnets=; ipv6_profile_paths=; transit_subnets=} System.Collections.Generic.List1[System.String] System.Collections.Generic.List1[System.String] ACTIVE_STANDBY PREEMPTIVE System.Collections.Generic.List`1[System.String] FALSE FALSE FALSE Tier0 t0-tnt06 t0-tnt06 /infra/tier-0s/t0-tnt06 t0-tnt06 /infra/tier-0s/t0-tnt06 FALSE admin 1.61E+12 admin 1.61E+12 FALSE NOT_PROTECTED 2
  
GJ says:

April 23, 2021 at 16:53

The list all NS Groups actually won’t work as the result is paginated and limited to 50 results.

Gautam says:

September 5, 2022 at 13:31

Hi Marco,

Please help me with $fwrulespec.sources.add and $fwrulespec.destinations.add while adding dfw rules. I am getting how to feed them.

Automate NSX-T with PowerCLI

Marco van Baggum

7 thoughts to “Automate NSX-T with PowerCLI”

Leave a Reply Cancel reply