PowerCLI to modify firewall policy for allowed ip's

[Jon_Drake]

I need to change the ESXi firewall setting from Allow connections from any IP address to a list of networks.

Using the get-esxcli cmdlet I can set the ip's to use.

(Get-VMHost $esxhost )

$esxcli = Get-EsxCli -VMHost $esxhost

$esxcli.network.firewall.ruleset.allowedip.add("172.16.29.0/24", "sshServer")

The issue I have is that to run the above, I first need to go into vcenter and manually change the firewall setting from all ip's to only these ip's.

When I set my $esxcli and run: $esxcli.network.firewall.ruleset.set

this is the output:

TypeNameOfValue     : VMware.VimAutomation.ViCore.Util10Ps.EsxCliExtensionMethod

OverloadDefinitions : {boolean set(boolean allowedall, boolean enabled, string rulesetid)}

MemberType          : CodeMethod

Value               : boolean set(boolean allowedall, boolean enabled, string rulesetid)

Name                : set

IsInstance          : True

I think its possible to change the allowed all to disabled, but I can't figure out what they mean by this set(boolean allowedall, boolean enabled, string rulesetid).  I understand that the string rulesetid is sshServer, but what do they mean with boolean allowedall ?

Has anyone ever done this before ?

[LucD · Accepted solution]

You pass a Boolean value ($true or $false) and for allowedall this means

• $true : all IP addresses are allowed
• $false : only the IP addresses in the IP list are allowed

See the esxcli network Commands documentation for the meaning of these parameters.

[MRoushdy]

Could you please give me more info? .. I couldn't figure out (nor my search returned a useful) the correct syntax to disable the "allowedall"

I tried this:

$esxcli.network.firewall.ruleset.allowed-all.set($false)

it returns a "non-value" error.

Thanks,

[LucD]

When you use the V2 switch on the Get-EsxCli cmdlet, you could do

$esx = Get-VMHost -Name MyEsx

$esxcli = Get-Esxcli -VMHost $esx -V2

$arguments = @{

    rulesetid = 'sshServer'

    enabled = $true

    allowedall = $false

}

$esxcli.network.firewall.ruleset.set.Invoke($arguments)

[MRoushdy]

I used this:

$esx = Get-VMHost -Name <Myhost>
$esxcli = Get-Esxcli -VMHost $esx -V2

$arguments = @{

    rulesetid = 'syslog'

    allowedall = $false

}

$esxcli.network.firewall.ruleset.set.Invoke($arguments)

$esxcli.network.firewall.ruleset.allowedip.add("10.10.23.171", "syslog")

but I get this error

Cannot find an overload for "Set" and the argument count: "1".
At C:\Users\u981021\Documents\Commands\allowedip.ps1:12 char:1
+ $esxcli.network.firewall.ruleset.set.Invoke($arguments)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodException
    + FullyQualifiedErrorId : MethodCountCouldNotFindBest

Cannot find an overload for "add" and the argument count: "2".
At C:\username\Documents\Commands\allowedip.ps1:15 char:1
+ $esxcli.network.firewall.ruleset.allowedip.add("10.10.23.171", "syslo ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodException
    + FullyQualifiedErrorId : MethodCountCouldNotFindBest

[MRoushdy]

The option was disabled, but it fails to add IPs, I tried this, is it incorrect?

$esx = Get-VMHost -Name HOST
$esxcli = Get-Esxcli -VMHost $esx -V2

$arguments = @{
rulesetid = 'syslog'
allowedall = $false
allowedip = "10.10.23.171"
}

$esxcli.network.firewall.ruleset.set.Invoke($arguments)

[LucD]

You can add allowed IP addresses like this

$esx = Get-VMHost -Name HOST

$esxcli = Get-Esxcli -VMHost $esx -V2

$arguments = @{

    rulesetid = 'syslog'

    ipaddress = '10.10.23.171'

}

$esxcli.network.firewall.ruleset.allowedip.add.Invoke($arguments)

[MRoushdy]

Thank you!

[nicholas1982]

Luc, I'm now trying ESXCLI -V2 as it may solve another issue i'm having but when i specify an IP in the $argument i get the following error

$esx = Get-VMHost -Name vesxi01*

$esxcli = Get-Esxcli -VMHost $esx -V2

$arguments = @{

    rulesetid = 'sshServer'

    enabled = $true

    allowedall = $false

    allowedip = '192.168.1.157'

}

----------------------Result of running command here-------------------------------

$esxcli.network.firewall.ruleset.set.Invoke($arguments)

PS C:\scripts\hostfw> $esx = Get-VMHost -Name vesxi01*

PS C:\scripts\hostfw> $esxcli = Get-Esxcli -VMHost $esx -V2

PS C:\scripts\hostfw> $arguments = @{

    rulesetid = 'sshServer'

    enabled = $true

    allowedall = $false

    allowedip = '192.168.1.157'

}

PS C:\scripts\hostfw> $arguments

Name                           Value                                                                                                                                 

----                           -----                                                                                                                                 

rulesetid                      sshServer                                                                                                                             

allowedip                      192.168.1.157                                                                                                                         

allowedall                     False                                                                                                                                 

enabled                        True                                                                                                                                  

PS C:\scripts\hostfw> $esxcli.network.firewall.ruleset.set.Invoke($arguments)

Index (zero based) must be greater than or equal to zero and less than the size of the argument list.

At line:1 char:1

+ $esxcli.network.firewall.ruleset.set.Invoke($arguments)

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : OperationStopped: (:) [], FormatException

    + FullyQualifiedErrorId : System.FormatException

[markdjones82]

Is there a way to take an existing host and save an argument list out so I can add it to a script?   IE something that can create the argument list for me with the hashtable?

[LucD]

All the V2 functions, except the ones without parameters, have a CreateArgs() method that will generate a hash table.

For example

[markdjones82]

LUC,

  But does it actually export values?

IE I want to make a static list from this list that I can put in a script and then loop through and set all of them:

PowerCLI C:\> $esxcli.network.firewall.ruleset.list.Invoke()

Enabled Name

------- ----

true    sshServer

false   sshClient

false   nfsClient

false   nfs41Client

true    dhcp

true    dns

true    snmp

true    ntpClient

true    CIMHttpServer

true    CIMHttpsServer

true    CIMSLP

false   iSCSI

true    vpxHeartbeats

true    updateManager

true    faultTolerance

true    webAccess

true    vMotion

true    vSphereClient

true    activeDirectoryAll

true    NFC

true    HBR

false   ftpClient

false   httpClient

false   gdbserver

false   DVFilter

true    DHCPv6

true    DVSSync

true    syslog

true    WOL

false   vSPC

false   remoteSerialPort

false   rdt

false   cmmds

false   vsanvp

true    rabbitmqproxy

false   ipfam

false   vvold

true    iofiltervp

false   esxupdate

false   vsanEncryption

false   pvrdma

false   vsanhealth-multicasttest

[Karthikeyan_R]

The below command to not work for me when trying to allow all IPs under "SSH client"

$ESX= (Get-VMHost -Name 10.xx.xxx.xx | Get-VMHostFirewallException -Name "SSH client").ExtensionData

I'm unable to set allowed hosts.

$ESX.ExtensionData.AllowedHosts.AllIp = $true

[LucD]

What cmdlet or method did you actually call?
Just setting a property doesn't change anything.

[Karthikeyan_R]

I'm trying to achieve this with the above command.

[LucD]

You didn't answer my question.
Did you actually use PowerShell or PowerCLI before?

[Dharzhak]

This is an example of updating the SSH Server firewall exception. You have to use the invoke() method to make changes.

        if ((Get-VMHostFirewallException -VMHost $VMHost -Name "SSH Server").ExtensionData.AllowedHosts.AllIp -eq $true ) {

            $EsxCli = Get-EsxCli -V2 -VMHost $VMHost

            $EsxCli.network.firewall.ruleset.set.invoke(@{allowedall = $false; rulesetid = "sshServer" }) > $null

            $EsxCli.network.firewall.refresh.invoke() > $null

        }

[Karthikeyan_R]

I used Powershell.

[Karthikeyan_R]

I had used PowerCLI