Export NSX-T Firewall Rules

[9990374530]

Hello Experts,

Is there a way I can export the Firewall rules in NSX-T via UI or CLI and replicate the same as NSG in Azure native infrastructure?

Regards

PK

[RolandS]

You can export FW rules of the Distributed Firewall from the GUI but not from the Gateway Firewall. Which one you are looking for and which version you are on? Also by exporting the Ditributed FW rules it does not export the objects, groups, etc. Maybe there's some free script on the internet for this. Just my 2 cents.

[9990374530]

Hi Roland,

Thanks for your response.
I have NSX inside the Azure VMware Solution. However, I will check the exact version.
I am looking to export DFW rules. From the GUI, I did that in excel form but can't seem them in groups, so it is complicated to identify those rules.
Are there any NSXT manager rest API access I can get into?
I am not aware about any scripts and how can I access them in azure VMware solution.


Regards
PK


Business

[NBorba05]

Hi,

I believe this is what you are looking for, it can export the DFW.

DFW: Export or Import a Firewall Configuration

The other option you have is to use API. VMware Documentation might help here.

[9990374530]

Hi Roland,

I have exported the dfw rules however, main issue is it only tells us the name of the ipgroups and the servicegroups. Meaning we can't in detail see the ips and ports. Any idea?



Regards
Pravesh Kaushal



Business

[Ian MacKinnon]

NSX Powerops can export everything into Excel, GitHub - vmware/nsx-powerops: NSX-v Operationalization project. Automate Networking Documentation and HealthCheck.

Ignore that it says -V in the link, it is for -T

[9990374530]

Hi Ian,

Thanks for sharing!
Is this script going to export the DFW firewall rules in Excel?



Regards
PK



Business

[Ian MacKinnon]

Yes, it exports environment summary, routing tables, security groups, firewalls rules amongst others

[9990374530]

Hi Ian,

I haven’t tried this however, I just need dfw firewall rules with details like ips and ports.


Regards
PK



Business

[Bogdan28]

Yes, you can export firewall rules from NSX-T and replicate them as Network Security Groups (NSGs) in Azure. 

Export Firewall Rules in NSX-T via NSX-T CLI for example: get logical-router-firewall rules 

and save the output get firewall rules > firewall_rules.txt

then replicate NSX-T Rules as Azure NSGs (for example you can automate the conversion via python scrip)

import json

# Load NSX-T rules from a JSON file
def load_nsx_rules(file_path):
    with open(file_path, 'r') as file:
        return json.load(file)

# Convert NSX-T rules to Azure CLI commands
def convert_to_azure_nsg(nsx_rules, nsg_name, resource_group):
    azure_commands = []

    # Create the NSG
    azure_commands.append(f"az network nsg create --resource-group {resource_group} --name {nsg_name}")

    # Process each rule
    for index, rule in enumerate(nsx_rules):
        priority = 100 + index  # Ensure unique priority for each rule
        name = rule.get('name', f'rule-{index}')
        direction = 'Inbound' if rule.get('direction', 'in').lower() == 'in' else 'Outbound'
        action = 'Allow' if rule.get('action', '').lower() == 'allow' else 'Deny'
        protocol = rule.get('protocol', 'Any').upper()
        protocol = '*' if protocol == 'ANY' else protocol  # Azure uses '*' for any protocol
        source = ','.join(rule.get('source', ['*']))
        destination = ','.join(rule.get('destination', ['*']))
        destination_ports = ','.join(map(str, rule.get('destination_ports', ['*'])))

        # Create the NSG rule
        azure_command = (
            f"az network nsg rule create "
            f"--resource-group {resource_group} "
            f"--nsg-name {nsg_name} "
            f"--name {name} "
            f"--priority {priority} "
            f"--direction {direction} "
            f"--access {action} "
            f"--protocol {protocol} "
            f"--source-address-prefixes {source} "
            f"--destination-address-prefixes {destination} "
            f"--destination-port-ranges {destination_ports}"
        )
        azure_commands.append(azure_command)

    return azure_commands

# Save the Azure CLI commands to a file
def save_to_file(commands, output_file):
    with open(output_file, 'w') as file:
        file.write('\n'.join(commands))

# Example usage
if __name__ == "__main__":
    # Path to the NSX-T exported JSON file
    nsx_rules_file = 'nsx_rules.json'
    
    # Azure NSG details
    azure_nsg_name = 'MyAzureNSG'
    azure_resource_group = 'MyResourceGroup'
    
    # Output file for Azure CLI commands
    output_file = 'azure_nsg_commands.sh'
    
    # Load and convert the rules
    nsx_rules = load_nsx_rules(nsx_rules_file)
    azure_commands = convert_to_azure_nsg(nsx_rules, azure_nsg_name, azure_resource_group)
    
    # Save the commands to a file
    save_to_file(azure_commands, output_file)
    print(f"Azure CLI commands saved to {output_file}")

Here’s an example of how the NSX-T firewall rules might look in JSON

[
    {
        "name": "Allow-HTTP",
        "direction": "in",
        "action": "allow",
        "protocol": "TCP",
        "source": ["10.0.0.0/24"],
        "destination": ["192.168.1.0/24"],
        "destination_ports": ["80"]
    },
    {
        "name": "Deny-All",
        "direction": "out",
        "action": "deny",
        "protocol": "ANY",
        "source": ["*"],
        "destination": ["*"],
        "destination_ports": ["*"]
    }
]

[9990374530]

Thank you so much for the help.

[9990374530]

Does it convert the groups to IPs etc?