topic NSX-T REST APIs with Unique Identifier for Security Groups in VMware NSX Discussions

NSX-T REST APIs with Unique Identifier for Security Groups

sivas1 — Thu, 07 Sep 2023 03:59:12 GMT

Hello,

I am new to VMWare NSX-T. I am exploring the APIs available to query Security Groups, Add/Remove VMs to/from Security Groups. As I understand, the APIs take Security Group names in the URI path, as given below

GET Request to Query Security Group - /policy/api/v1/infra/domains/<domain-id>/groups/<group-id>

PATCH request to Add VM to Security Group - /policy/api/v1/infra/domains/<domain-id>/groups/<group-id>

My Question -

- Are there APIs available that would take the Unique Identifier for the Security Group ?

VMWare NSX-T allows creation of multiple security groups with the same name. Are there APIs to query, Add/Remove VM to security Groups using the Unique Identifier of the security group rather than group name ?

Thanks!

Re: NSX-T REST APIs with Unique Identifier for Security Groups

bmcb555 — Thu, 07 Sep 2023 06:46:37 GMT

The group id is a unique identifier. You can call every group the exact same name but the identifier has to be different. Thats how it's been in my experience.

So for example using the exmaple in the API document

PUT https://<policy-mgr>/policy/api/v1/infra/domains/vmc/groups/webgroup { "expression": [ { "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "resource_type": "Condition" } ], "description": "web group", "display_name": "web group", "_revision":0 }

PUT https://<policy-mgr>/policy/api/v1/infra/domains/vmc/groups/webgroup1 { "expression": [ { "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "resource_type": "Condition" } ], "description": "web group", "display_name": "web group", "_revision":0 }

You need a unique ID for each group you add otherwise it'll overwrite the previous group.

Pretty much every API you query is looking for that ID. Below is the API to add a rule

PUT https://<policy-mgr>/policy/api/v1/infra/domains/vmc/security-policies/application-section-1 { "description": "comm map", "display_name": "application-section-1", "category": "Application", "rules": [ { "description": " comm entry", "display_name": "ce-1", "sequence_number": 1, "source_groups": [ "/infra/domains/vmc/groups/webgroup" ], "destination_groups": [ "/infra/domains/vmc/groups/webgroup1" ], "services": [ "/infra/services/HTTP", "/infra/services/CIM-HTTP" ], "action": "ALLOW" } ] }

If it wasn't unique you'd never be able to reference it since you wouldn't know what you're calling.

Re: NSX-T REST APIs with Unique Identifier for Security Groups

sivas1 — Thu, 07 Sep 2023 14:55:06 GMT

Thank you very much for the detailed response. That helps!

Re: NSX-T REST APIs with Unique Identifier for Security Groups

bmcb555 — Thu, 07 Sep 2023 15:58:50 GMT

No problem, I hope it's clear! Group ID must be unique for the security groups but they can all share the same display_name if you wanted. If this has helped you solve your issue please mark as solved.