vSphere 5.5 vDS traffic filter automation

[erickmiller]

Not sure if this is available through any means, but having the ability to automate (preferably through PowerCLI) the creation/modification/deletion of the new traffic filter rules in 5.5 would be extremely handy.


Basically, we would like to emulate the IP Source Guard feature of the v1000 switch by automating the filtering to prevent VMs from sending traffic from an invalid IP.


Eric

[knikolov]

We will consider adding this functionality. Since it's in the public API you can access it through the PowerCLI views if you are familiar with them.

[erickmiller]

Much appreciated!

I have been reviewing PowerCLI views and some of our existing scripts that use them, but for the life of me, I can't quite figure out how to traverse the API object properties to get to the DvsFilterConfig object.

It seems like the PowerCLI command:

Get-VDPort -VDPortgroup (Get-VDPortGroup -Name "dvPortGroup") -Key 1

returns a port object that probably comes from the method "FetchDVPorts".

I'm hoping to get the "DistributedVirtualPort" object from this command (by referencing the MoRef of the VDPort, which doesn't appear to exist), then its "config" property (type "DVPortConfigInfo"), then the "setting" property (type "DVPortSetting"), and finally the "filterPolicy" property (type "DvsFilterPolicy").

Then I can start working on creating the appropriate DvsFilterConfig objects.

Any help would be appreciated.

Thanks!

Eric

[RvdNieuwendijk]

The "DistributedVirtualPort" object can be found in the ExtensionData property of the objects return by the Get-VDPort cmdlet. You can use the code in the following example to retrieve the FilterPolicy of a distributed virtual port:

PowerCLI C:\> $VDPort = Get-VDSwitch | Get-VDPort -Key 1

PowerCLI C:\> $VDPort.ExtensionData.Config.Setting.FilterPolicy

FilterConfig Inherited DynamicType DynamicProperty

------------ --------- ----------- ---------------

                  True

[erickmiller]

Thanks for the help!


I believe the next steps are to create a FilterPolicy object, which will be used by the port, using:


$spec = new-object VMware.Vim.DvsFilterPolicy


and then a new DVSFilterConfig object for its FilterConfig:


$spec.FilterConfig = new-object VMware.Vim.DvsFilterConfig


However, I'm not sure how to set the TrafficRuleset property seen when running:


$spec.FilterConfig[0] | gm


There are properties shown on:


http://pubs.vmware.com/vsphere-55/index.jsp#com.vmware.wssdk.apiref.doc/vim.dvs.DistributedVirtualPo...


but it's not obvious how to use the classes for the qualifiers and actions.


It's very difficult to understand how to use the API.  Is there good documentation on the web, a book, or other that is available to better understand the constructs of the API?


Thanks!


Eric

[RvdNieuwendijk]

The easiest way is to use the VMware Fling Onyx. Onyx can generate PowerCLI code for actions you do in the vSphere client. You can download Onyx from http://labs.vmware.com/flings/onyx.

[erickmiller]

Ah - I have used Onyx before, but didn't realize it would work with vSphere 5.5 and the web client (since the vDS filtering function isn't available in the thick client).


I'll check out the latest version and report back.


Eric

[erickmiller]

Looks like as of now, the web client is not supported by Onyx, which is a shame since Onyx was extremely helpful in the past.

Eric

[erickmiller]

Is there consulting available that might be able to help provide this functionality?  Or consulting that would "accelerate" the PowerCLI development?

Thanks!

Eric

[astardjiev]

Hi Eric,

I am not aware of a consulting service provided by VMware that would write or test a PowerCLI script for you.

There is a consulting service that will help you write PowerCLI scripts. The service is called "SDK Support Program" and is provided by a dedicated API development group within VMware Global Support Services.

An overview, the program's scope and a FAQ can be found at -

SDK Support Program for vSphere APIs, SDKs, PowerCLI -

https://www.vmware.com/support/services/sdk.html

Hope this helps,

Hristo

[erickmiller]

Thanks Hristo!  I suspect the SDK support program is a bit overkill for what we are looking to do.  We were just trying to avoid going the Cisco 1000v route, but it seems like it is the most cost effective approach for something immediate.

Eric

[uswbnc53]

Curious if anyone was able to develop a script that will enable traffic filtering and create rules?