While working on an NSX-T project I got the question from the customer to deliver some firewall and network automation based on PowerShell. This to help them ramp up the creation of networks and firewall rules. I pointed them to the PowerCLI Preview for NSX-T, but I wasn’t aware that this fling only was able to retrieve information from NSX-T and not create items/objects. So, how can we do this then? I knew we were able to manage NSX-T since PowerCLI version 6.5.3, but how does this work?
After some google-fu I came across a blog post of Kyle Ruddy named: Getting Started with the PowerCLI Module for VMware NSX-T. This article describes how the NSX-T PowerShell Module works and which cmdlets where available:
Only 3 commands? Yes, only 3 commands! Because of the simple reason that with the 3rd command you have full access to NSX-T’s public API! And therefore you’re able to retrieve and create items/objects. In the blog article Kyle also gives some examples on how to Retrieve Transport Zone Information or perform Logical Switch and IP Pool Management. But how do we create an NSGroup or a Distributed Firewall Section? This post contains some additional examples and I’ll update this post as new scripts will come along.
The first thing we need to do is connect to the NSX-T Manager:
Connect-NsxtServer -Server <NSX-T FQDN/IP> -User <Username> -Password <Password>
Create a NSGroup based on a Security Tag
$nsgroupname = "NS-Test"
$nstagname = "ST-Test"
$nsgroupsvc = Get-NsxtService -Name com.vmware.nsx.ns_groups
$nsgroupspec = $nsgroupsvc.Help.create.ns_group.Create()
$nsgroupmemberspec = $nsgroupsvc.Help.create.ns_group.membership_criteria.Element.NS_group_tag_expression.create()
$nsgroupspec.display_name = $nsgroupname
$nsgroupmemberspec.tag_op = "EQUALS"
$nsgroupmemberspec.tag = $nstagname
$nsgroupmemberspec.target_type = "VirtualMachine"