Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Updated script by Shane White
<#
Created by Tony Sangha
July 2017
tonysangha.com
version 0.1
Modified by Shane White
October 2017
Version 1.0
####################################
macOS PowerCLI specific commands
Get-Module -ListAvailable PowerCLI* | Import-Module
Get-Module -ListAvailable PowerNSX* | Import-Module
Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false
#>
param( [string[]] $param)
$networkno = $param.Count -3
$networkno = $networkno /2
$log_path = "c:\scripts\"
$log_name = $param[1] + ".bubble"
$log_file = $log_path + $log_name
if ((Test-Path $log_file)) {
Write-Output "That bubble exists"
throw "That bubble network exists"
}
#######################################
### Edit any parameters here only ###
#######################################
if ($param[0] -eq "NSX-1") {
write-output "Connecting to NSX Site 1"
Connect-NsxServer -NsxServer vsnsxmgr01.vsnsx-1.local -Username "admin" -Password "VMware1!" -VIUserName "administrator@vsphere.local" -VIPassword "VMware1!"
$nsx_manager_ip = '10.10.10.111'
$transport_zone_name = "NSX-Site1"
$datastore = "ReadyNAS_NFS_NSX"
$edge_cluster = "NSX"
$esg_uplink_ls = "Transit"
}
ElseIF ($param[0] -eq "NSX-2") {
write-output "Connecting to NSX Site 2"
Connect-NsxServer -NsxServer vsnsxmgr02.vsnsx-1.local -Username "admin" -Password "VMware1!" -VIUserName "administrator@vsphere.local" -VIPassword "VMware1!"
$nsx_manager_ip = '10.10.20.101'
$transport_zone_name = "NSX-Site-2"
$datastore = "ReadyNAS_NFS"
$edge_cluster = "Site-2"
$esg_uplink_ls = "Transit"
}
ElseIF ($param[0] -eq "NSX-3") {
write-output "Connecting to NSX Site 3"
Connect-NsxServer -NsxServer vsnsxmgr00.vsphere.local -Username "admin" -Password "VMware1!" -VIUserName "administrator@vsphere.local" -VIPassword "VMware1!"
$nsx_manager_ip = '10.10.30.101'
$transport_zone_name = "vSoft"
$datastore = "ReadyNAS_NFS"
$edge_cluster = "vSoft"
$esg_uplink_ls = "Transit"
}
# DLR, ESG and Sec & Grp names, will be created randomly if not changed here
$bubble_name = $param[1]
$dlr_name = "DLR-" + $bubble_name.toString()
$esg_name = "ESG-" + $bubble_name.toString()
$sg_name = "SG-BUBBLE-" + $bubble_name.toString()
$sec_name = "BUBBLE-NETWORK-" + $bubble_name.toString()
<# Logical Switch and IP Addressing for the Edge Services Gateway Bubble Router
Logical Switch, IP and Next Hop IP's are required for Uplink and Internal
Interfaces. Uplink logical switch should already be available in NSX-v and
will not be dynamically created by this script #>
$esg_uplink_ls = "Transit"
$esg_uplink_ip = $param[2]
$esg_uplink_next_hop = "192.168.1.1"
$esg_internal_ip = "192.168.0.254/24"
<# Logical Switch and IP Information for Internal networks and for HA/Uplink
interfaces on the DLR. Variable $logical_switch_name_ip can be appended to
with interfaces and IP Addresses as required #>
$dlr_uplink_transit = 'ls_transit ' + $bubble_name
$dlr_uplink_ls_ip = @{$dlr_uplink_transit ='192.168.0.1/24'}
$dlr_ha_mgmt_ls = "ls_ha_mgmt " + $bubble_name
$ls_1 = "ls_" + $param[3] + "-" + $bubble_name
$logical_switch_name_ip= @{$ls_1 =$param[4]}
$networkno--
$paramcount = 5
while ($networkno -ne 0) {
#write-output "I'm in the loop"
$ls_1 = "ls_"+$param[$paramcount] + "-" +$bubble_name
$logical_switch_name_ip.add($ls_1, $param[$paramcount+1])
$paramcount = $paramcount +2
$networkno--
}
# Use a Summary route if possible for logical switches created above or append
$esg_to_dlr_static_routes=@('192.168.0.0/21','10.10.10.0/24')
####################################
### DO NOT EDIT BEYOND THIS LINE ###
####################################
write-host -ForegroundColor Magenta `
" ____ _ _ _ _ _ _ _ `
| _ \ | | | | | | | \ | | | | | | `
| |_) |_ _| |__ | |__ | | ___ | \| | ___| |___ _____ _ __| | __ `
| _ <| | | | '_ \| '_ \| |/ _ \ | . ` |/ _ \ __\ \ /\ / / _ \| '__| |/ / `
| |_) | |_| | |_) | |_) | | __/ | |\ | __/ |_ \ V V / (_) | | | < `
|____/ \__,_|_.__/|_.__/|_|\___| |_| \_|\___|\__| \_/\_/ \___/|_| |_|\_\ `
`
"
write-host -ForegroundColor DarkYellow "Starting Execution of PowerNSX Script"
#######################################
### Create Local Logical Switches ###
#######################################
# Get and Store Transport Zone object in a variable
$tz = get-nsxtransportzone $transport_zone_name
<# Create NSX Logical switches in the designated transport zone, by looping
though the $logical_switch_name_ip hash table #>
foreach($item in $logical_switch_name_ip.keys){
$ls = new-nsxlogicalswitch -name $item -transportzone $tz `
-Description "Created with PowerNSX"
write-host -ForegroundColor cyan "Created Switch:" $ls.name
}
# Create Logical Switch for DLR HA/MGMT network and Bubble Internal Transit
$ls = new-nsxlogicalswitch -name $dlr_uplink_ls_ip.keys -transportzone $tz
write-host -ForegroundColor cyan "Created Switch:" $ls.name
$ls = new-nsxlogicalswitch -name $dlr_ha_mgmt_ls -transportzone $tz
write-host -ForegroundColor cyan "Created Switch:" $ls.name
#######################################
### Create Distributed Logical Router #
#######################################
# Create empty hash table to store internal interface specs for the DLR
$internal_int_specs = New-Object System.Collections.ArrayList
<# Loop over the logical_switch_name_ip hashtable and add interface specs
to empty specs table created above #>
foreach($item in $logical_switch_name_ip.GetEnumerator()){
$ip_address = $item.Value.split('/')
$internal = New-NsxLogicalRouterinterfacespec -Name $item.Name `
-Type internal `
-ConnectedTo (Get-NsxLogicalSwitch -TransportZone $tz `
-name $item.Name) `
-PrimaryAddress $ip_address[0] `
-SubnetPrefixLength $ip_address[1]
$x = $internal_int_specs.Add($internal)
}
# Create Interface Specification for Uplink Interface
$dlr_uplink_int_spec = New-NsxLogicalRouterinterfacespec -Name `
$dlr_uplink_ls_ip.keys -Type uplink `
-ConnectedTo (Get-NsxLogicalSwitch -TransportZone $tz `
-name $dlr_uplink_ls_ip.keys) `
-PrimaryAddress ($dlr_uplink_ls_ip.values.split('/')[0]) `
-SubnetPrefixLength ($dlr_uplink_ls_ip.values.split('/')[1])
<# Create Distributed Logical Router, attach interfaces and configure static
routes.#>
write-host -ForegroundColor cyan "Creating Logical Router (DLR):" $dlr_name
$dlr_rtr = New-NsxLogicalRouter -Name $dlr_name -ManagementPortGroup `
(Get-NsxLogicalSwitch $dlr_ha_mgmt_ls) `
-Interface $dlr_uplink_int_spec `
-Cluster (Get-Cluster $edge_cluster) -Datastore `
(get-datastore $datastore)
# Add Internal interfaces to newly created Distributed Logical Router
write-host -ForegroundColor yellow "Adding Logical Switches to:" $dlr_name
foreach($item in $internal_int_specs){
write-host -ForegroundColor cyan $item.Name "LS added to:" $dlr_name
$x = New-NsxLogicalRouterInterface -LogicalRouter `
(get-nsxlogicalrouter $dlr_name) `
-ConnectedTo (Get-NsxLogicalSwitch $item.Name) `
-Name $item.Name -Type "Internal" `
-PrimaryAddress $item.addressGroups.addressGroup.primaryAddress `
-SubnetPrefixLength $item.addressGroups.addressGroup.subnetPrefixLength
}
# Add static default route to ESG Internal Interface
$route = New-NsxLogicalRouterStaticRoute -LogicalRouter `
(get-nsxlogicalrouter $dlr_name | Get-NsxLogicalRouterRouting) `
-NextHop $esg_internal_ip.split('/')[0] `
-Network '0.0.0.0/0' -confirm:$false
write-host -ForegroundColor yellow $route.network "route created on:" `
$dlr_name
#######################################
### Edge Services Gateway ###
#######################################
$esg_uplink_int_spec = New-NsxEdgeInterfaceSpec -Name $esg_uplink_ls `
-Type Uplink `
-ConnectedTo (Get-NsxLogicalSwitch $esg_uplink_ls) `
-PrimaryAddress $esg_uplink_ip.split('/')[0] `
-SubnetPrefixLength $esg_uplink_ip.split('/')[1] -Index 0
$esg_internalint_spec = New-NsxEdgeInterfaceSpec -Name $dlr_uplink_ls_ip.keys `
-Type Internal `
-ConnectedTo (Get-NsxLogicalSwitch $dlr_uplink_ls_ip.keys) `
-PrimaryAddress $esg_internal_ip.split('/')[0] `
-SubnetPrefixLength $esg_internal_ip.split('/')[1] -Index 1
write-host -ForegroundColor cyan "Creating Edge Services Router:" $esg_name
$esg_rtr = New-NsxEdge -Name $esg_name -Datastore (get-datastore $datastore) `
-cluster (get-cluster $edge_cluster) -Username admin `
-Password VMware1!VMware1! -FormFactor compact -AutoGenerateRules `
-FwEnabled -Interface $esg_uplink_int_spec,$esg_internalint_spec
# Create static routes back to the DLR
write-host -ForegroundColor cyan "Creating Routes on ESG:" $esg_name
foreach($item in $esg_to_dlr_static_routes){
$x = Get-NsxEdge $esg_name | Get-NsxEdgeRouting | New-NsxEdgeStaticRoute `
-Network $item -NextHop $dlr_uplink_ls_ip.Values.split('/')[0] `
-confirm:$false
write-host -ForegroundColor yellow $item "route created on:" `
$esg_name
}
# Create Default Route 0/0 to Perimeter Edge Services Gateway
$route = Get-NsxEdge $esg_name | Get-NsxEdgeRouting | New-NsxEdgeStaticRoute `
-Network '0.0.0.0/0' -NextHop $esg_uplink_next_hop -confirm:$false
write-host -ForegroundColor yellow $route.network "route created on:" `
$esg_name
#######################################
### DFW Firewall Rules ###
#######################################
# Create Security Group containing all logical switches
write-host -ForegroundColor cyan "Creating Security Group"
$sg = New-NsxSecurityGroup -name $sg_name
write-host -ForegroundColor yellow "Security Group " $sg.name " created"
foreach($item in $internal_int_specs){
Add-NsxSecurityGroupMember (Get-NsxSecurityGroup $sg_name) `
-Member (Get-NsxLogicalSwitch $item.Name)
}
# Create new NSX Firewall Section
write-host -ForegroundColor cyan "Creating Firewall Section" $sec_name
$section = New-NsxFirewallSection -name $sec_name
write-host -ForegroundColor cyan "Creating Rules in Section" $sec_name
$rule = Get-NsxFirewallSection $section.name | New-NsxFirewallRule -Name `
"$sg_name -> any - deny" -Source $sg `
-Action 'deny'
write-host -ForegroundColor yellow "Rule ID" $rule.id "created"
$rule = Get-NsxFirewallSection $section.name | New-NsxFirewallRule -Name `
"any -> $sg_name - deny" `
-Destination $sg `
-Action 'deny'
write-host -ForegroundColor yellow "Rule ID" $rule.id "created"
$rule = Get-NsxFirewallSection $section.name | New-NsxFirewallRule -Name `
"$sg_name -> $sg_name - allow" -Source $sg `
-Destination $sg `
-Action 'allow'
write-host -ForegroundColor yellow "Rule ID" $rule.id "created"
Disconnect-NsxServer
$logical_switch_name_ip.add($dlr_name, "DLR")
$logical_switch_name_ip.add($esg_name, "ESG")
$logical_switch_name_ip.add($sg_name,"Security_group")
$logical_switch_name_ip.add($Sec_name,"Firewall_rules")
$logical_switch_name_ip.add($dlr_ha_mgmt_ls,"LS")
$logical_switch_name_ip.add($dlr_uplink_transit,"LS")
#$log_name = $bubble_name.ToString() + '.bubble'
$log_path = "c:\scripts\"
#$log_name = $Bubble_name + ".bubble"
$log_file = $log_path + $log_name
$logical_switch_name_ip | out-file $log_file
$bubble_name | Add-Content $log_file
$param[0] | add-content $log_file
write-host -ForegroundColor yellow "Settings saved to file" $log_name
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.