Create a Distributed Firewall Policy

You can create a distributed firewall policy for an NSX server system by using the Invoke-PatchSecurityPolicyForDomain cmdlet.

Prerequisites

Verify that you are connected to an NSX server system.

Procedure

Create lookup object variables.

$serviceList = @("SSH", "HTTP")
$sourceGroups = @("ANY")
$destinationGroups = @("MyGroupName")

Look up groups and services.

$allServices = Invoke-ListServicesForTenant
$ServicePathList = @()
foreach ($serv in $serviceList) {
    $s = $allServices.Results | where {$_.DisplayName -eq $serv}
    $ServicePathList += $s.Path
}
 
$allGroups = Invoke-ListGroupForDomain -DomainId default
$sourceGroupList = @()
foreach ($gp in $sourceGroups) {
    if ($gp -eq "ANY") {
        $SourceGroupList += "ANY"
    } else {
        $g = $AllGroups.Results | where {$_.DisplayName -eq $gp}
        $SourceGroupList += $g.Path
    }
}
 
$destinationGroupList = @()
foreach ($gp in $destinationGroups) {
    if ($gp -eq "ANY") {
        $DestinationGroupList += "ANY"
    } else {
        $g = $AllGroups.Results | where {$_.DisplayName -eq $gp}
        $DestinationGroupList += $g.Path
    }
}

Prepare the input for the policy rule.

$rule = Initialize-Rule -DisplayName $ruleName -Id $ruleName -SourceGroups $sourceGroupList -DestinationGroups $destinationGroupList -Services $servicePathList -Action "ALLOW"

Prepare the input for the security policy.

$securityPolicy = Initialize-SecurityPolicy -DisplayName $policyName -Rules @($rule)

Invoke the operation.

Invoke-PatchSecurityPolicyForDomain -DomainId default -SecurityPolicyId $policyName -SecurityPolicy $securityPolicy