VCloud: vShield Edge FW Rules

Question

Hi all
I'm looking for a way to get and set firewall rules on a vShield Edge firewall in a vCloud environment.  My final target is to write two scripts; one that will export the firewall rules from a given vShield Edge firewall to CSV and another script that will import them from CSV into another vShield Edge firewall.  This is to help with a DR scenario where we'll shift a public IP block from a public facing vShield Edge in one vCloud environment to one in another environment.
I need to do this through the vCloud API or PowerCLI because, if I do it directly at the vShield Manager, vCloud won't know about the changes that have been made.  I'm not a Powershell expert by any means but I'm picking things up as I have a need for them.  I've looked through several blog posts people have written and it looks as though I need to dig down into ExtensionData as there aren't get and sets for the info I'm after.  I've found some info which is really close to what I'm after in this post:
Deepdive: vCloud vApp Networks | Geek after Five
This covers pulling the information from the GetNetworkConfigSection method in the Extensiondata of a vApp.  The issue I have is that the vShield Edge / network I'm after information from, isn't actually in a vApp.  It's a bit of a funny setup but I've got a vShield Edge firewall connected to the Internet and to an Org Network.  No VMs or vApps are connected to the Org Network.  Instead, I have about a dozen vApps, each with a vApp network and a vShield Edge connecting the vApp network to the Org Network.  This was a strategy recommended by VMware to overcome the limitation of 10 networks on the public facing vShield Edge and works brilliantly in that respect.  However... the public facing vShield Edge and Org Network are not in a vApp I can't use $vapp.ExtensionData.GetNetworkConfigSection()
Thinking about it while writing this, I guess one option would be to create another vApp and add the Org Network to it, then I might be able to get the info using GetNetworkConfigSection() but I wonder if there is a better/proper/prettier way to do it.
thanks in advance!
Dave

Answer 1

So one of my more skilled colleagues matured this script and incorporated forcing you to specify both the OrgName and the VSE name to reduce errors as well as input from a CSV. I'll have a go at incorporating existing rules via VSM api soon.
# Replaces all rules for a given vshield with the ones from a CSV file.
# CSV header is: Num,Descr,Proto,SrcIP,SrcPort,DstIP,DstPortRange,Policy,Direction,isEnabled,EnableLogging
# http://pubs.vmware.com/vcd-51/index.jsp?topic=%2Fcom.vmware.vcloud.api.reference.doc_51%2Fdoc%2Ftypes%2FFirewallRuleType.html
# Note: SrcPort can be -1 (for any), any or a port number. DstPortRange can be any or a port number range (ex: 22-26)
param (
[parameter(Mandatory = $true, HelpMessage="vCD Server")][alias("-server","s")][ValidateNotNullOrEmpty()][string[]]$CIServer,
[parameter(Mandatory = $true, HelpMessage="Org")][alias("-vOrg","o")][ValidateNotNullOrEmpty()][string[]]$orgName,
[parameter(Mandatory = $true, HelpMessage="OrgNet")][alias("-orgNet","n")][ValidateNotNullOrEmpty()][string[]]$orgNet,
[parameter(Mandatory = $true, HelpMessage="CSV Path")][alias("-file","f")][ValidateNotNullOrEmpty()][string[]]$csvFile
# Add in the VI Toolkit
if ( (Get-PSSnapin -Name VMware.VimAutomation.Core -ErrorAction SilentlyContinue) -eq $null ) {
Add-PSsnapin VMware.VimAutomation.Core
if ( (Get-PSSnapin -Name VMware.VimAutomation.Cloud -ErrorAction SilentlyContinue) -eq $null ) {
Add-PSsnapin VMware.VimAutomation.Cloud
try {
Connect-CIServer -Server $CIServer 2>&1 | out-null
} catch {
Exit
#Search EdgeGW
try {
  $myOrgNet = Get-Org -Name $orgName | Get-OrgNetwork -Name $orgNet
  $edgeHREF = $myOrgNet.ExtensionData.EdgeGateway.Href
  $edgeView = Search-Cloud -QueryType EdgeGateway -ErrorAction Stop | Get-CIView | where {$_.href -eq $edgeHREF}
} catch {
[System.Windows.Forms.MessageBox]::Show("Exception: " + $_.Exception.Message + " - Failed item:" + $_.Exception.ItemName ,"Error.",0,[System.Windows.Forms.MessageBoxIcon]::Exclamation)
  Exit
#Item to Configure Services
$edgeView.Configuration.EdgeGatewayServiceConfiguration
$fwService = New-Object vmware.vimautomation.cloud.views.firewallservice
$fwService.DefaultAction = "drop"
$fwService.LogDefaultAction = $false
$fwService.IsEnabled = $true
$fwService.FirewallRule = @()
Ipcsv -path $csvFile |
foreach-object `
$fwService.FirewallRule += New-Object vmware.vimautomation.cloud.views.firewallrule
$rowNum = $_.Num -as [int]
$fwService.FirewallRule[$rowNum].description = $_.Descr
$fwService.FirewallRule[$rowNum].protocols = New-Object vmware.vimautomation.cloud.views.firewallRuleTypeProtocols
switch ($_.Proto)
"tcp" { $fwService.FirewallRule[$rowNum].protocols.tcp = $true }
"udp" { $fwService.FirewallRule[$rowNum].protocols.udp = $true }
"any" { $fwService.FirewallRule[$rowNum].protocols.any = $true }
default { $fwService.FirewallRule[$rowNum].protocols.any = $true }
$fwService.FirewallRule[$rowNum].sourceip = $_.SrcIP
if ($_.SrcPort -eq "any" ) { $srcPort = "-1" } else { $srcPort = $_.SrcPort }
$fwService.FirewallRule[$rowNum].sourceport = $srcPort
$fwService.FirewallRule[$rowNum].destinationip = $_.DstIP
$fwService.FirewallRule[$rowNum].destinationportrange = $_.DstPortRange
$fwService.FirewallRule[$rowNum].policy = $_.Policy
$fwService.FirewallRule[$rowNum].direction = $_.Direction
$fwService.FirewallRule[$rowNum].MatchOnTranslate = [System.Convert]::ToBoolean($_.MatchOnTranslate)
$fwService.FirewallRule[$rowNum].isenabled = [System.Convert]::ToBoolean($_.isEnabled)
$fwService.FirewallRule[$rowNum].enablelogging = [System.Convert]::ToBoolean($_.EnableLogging)
#configure Edge
$edgeView.ConfigureServices($fwService)
Example of the csv file:
Num,Descr,Proto,SrcIP,SrcPort,DstIP,DstPortRange,Policy,Direction,MatchOnTranslate,isEnabled,EnableLogging
0,Allow incoming 80 to webS,tcp,any,any,172.31.31.100,80,allow,in,true,true,false
1,Allow incoming 22 to webS,tcp,any,any,172.31.31.100,22,allow,in,true,true,false
2,Allow all outgoing,any,any,any,any,any,allow,out,true,true,false
Example of invocation:
.\load_firewall_rules.ps1 -s 10.16.1.229 -o "Org" -n "DmzNet" -f .\test_csv.csv