Skip to content
This repository has been archived by the owner on Oct 28, 2022. It is now read-only.

how to define multiple service in firewall rule for nsx edge firewall #635

Open
sheetjai opened this issue Oct 14, 2020 · 6 comments
Open

how to define multiple service in firewall rule for nsx edge firewall #635

sheetjai opened this issue Oct 14, 2020 · 6 comments

Comments

@sheetjai
Copy link

Trying adding multiple server like ssh, http, https, rdp for a firewall rule. Getting below error. Any suggestion?

C:\Users\SheetalJain> $serviceRDP = Get-NsxService -Name "RDP"
C:\Users\SheetalJain> $serviceHTTP = Get-NsxService -Name "HTTP"
C:\Users\SheetalJain> $serviceHTTPS = Get-NsxService -Name "HTTPS"
C:\Users\SheetalJain> $serviceSSH = Get-NsxService -Name "SSH"
C:\Users\SheetalJain> $service = $serviceHTTP, $serviceHTTPS, $serviceRDP, $serviceSSH
C:\Users\SheetalJain> Get-NsxEdge customer-nsx-edge | Get-NsxEdgeFirewall | New-NsxEdgeFirewallRule -name "testrule0" -source "1.2.3.4" -destination "1.2.3.4" -service $service -action accept
invoke-nsxwebrequest : Invoke-NsxWebRequest : The NSX API response received indicates a failure. 400 : Bad Request : Response Body: {"errors":[{"errorCode":12009,"details":"[Firewall]
Invalid groupingObjectId application-93 application-f5553a5e-bfe9-45a3-a768-ed6d432ddb71. This object does not exist or is not available for NSX Edge
edge-3.","rootCauseString":null,"moduleName":"vShield Edge","errorData":null},{"errorCode":12009,"details":"[Firewall] Invalid groupingObjectId application-105
application-c7d6f2bd-1c96-439b-9fe7-d987ec5ee062. This object does not exist or is not available for NSX Edge edge-3.","rootCauseString":null,"moduleName":"vShield
Edge","errorData":null},{"errorCode":12009,"details":"[Firewall] Invalid groupingObjectId application-54 application-dbcb5f40-4f07-4e12-8b8d-1de678d6cc71. This object does not exist or is
not available for NSX Edge edge-3.","rootCauseString":null,"moduleName":"vShield Edge","errorData":null},{"errorCode":12009,"details":"[Firewall] Invalid groupingObjectId application-247
application-af0f13e5-5a03-4d69-b814-0e24a6a32d5a. This object does not exist or is not available for NSX Edge edge-3.","rootCauseString":null,"moduleName":"vShield
Edge","errorData":null}]}
At C:\Users\SheetalJain\Documents\WindowsPowerShell\Modules\PowerNSX\PowerNSX.psm1:14170 char:21

  • ... $response = invoke-nsxwebrequest -method "post" -uri $URI -body $body ...
  •             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    • CategoryInfo : InvalidResult: (Invoke-NsxWebRequest:String) [Invoke-NsxWebRequest], InternalNsxApiException
    • FullyQualifiedErrorId : NsxAPIFailureResult,Invoke-NsxWebRequest

The property 'Headers' cannot be found on this object. Verify that the property exists.
At C:\Users\SheetalJain\Documents\WindowsPowerShell\Modules\PowerNSX\PowerNSX.psm1:14172 char:9

  •     $ruleid = $response.Headers.Location -replace "/api/4.0/edges ...

  •     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    • CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException
    • FullyQualifiedErrorId : PropertyNotFoundStrict

invoke-nsxwebrequest : Invoke-NsxWebRequest : The NSX API response received indicates a failure. 405 : Method Not Allowed : Response Body: <!doctype html><title>HTTP
Status 405 – Method Not Allowed</title><style type="text/css">h1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} h2
{font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} h3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;}
body {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} b {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} p
{font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;} a {color:black;} a.name {color:black;} .line
{height:1px;background-color:#525D76;border:none;}</style>

HTTP Status 405 – Method Not Allowed

Type Status Report

Message
Request method 'GET' not supported

Description The method received in the request-line is known by the origin server but not supported by the target resource.


At C:\Users\SheetalJain\Documents\WindowsPowerShell\Modules\PowerNSX\PowerNSX.psm1:14174 char:21

  • ... $response = invoke-nsxwebrequest -method "get" -uri "/api/4.0/edges/$ ...
  •             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    • CategoryInfo : InvalidResult: (Invoke-NsxWebRequest:String) [Invoke-NsxWebRequest], InternalNsxApiException
    • FullyQualifiedErrorId : NsxAPIFailureResult,Invoke-NsxWebRequest

The property 'content' cannot be found on this object. Verify that the property exists.
At C:\Users\SheetalJain\Documents\WindowsPowerShell\Modules\PowerNSX\PowerNSX.psm1:14175 char:9

  •     [system.xml.xmlDocument]$responserule = $response.content

  •     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    • CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException
    • FullyQualifiedErrorId : PropertyNotFoundStrict

The property 'firewallRule' cannot be found on this object. Verify that the property exists.
At C:\Users\SheetalJain\Documents\WindowsPowerShell\Modules\PowerNSX\PowerNSX.psm1:14176 char:9

  •     Add-XmlElement -xmlRoot $responserule.firewallRule -xmlElemen ...

  •     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    • CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException
    • FullyQualifiedErrorId : PropertyNotFoundStrict

The property 'firewallRule' cannot be found on this object. Verify that the property exists.
At C:\Users\SheetalJain\Documents\WindowsPowerShell\Modules\PowerNSX\PowerNSX.psm1:14177 char:9

  •     $responserule.firewallRule

  •     ~~~~~~~~~~~~~~~~~~~~~~~~~~
    • CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException
    • FullyQualifiedErrorId : PropertyNotFoundStrict

C:\Users\SheetalJain>
@dcoghlan
Copy link
Contributor

The error is due to the fact that when you are doing Get-NSXService -Name "RDP" its actually returning both the global and universal service objects. And you cannot use a universal object on an Edge.

You can see the universal object ID in this part of the message.
application-105 application-c7d6f2bd-1c96-439b-9fe7-d987ec5ee062. This object does not exist or is not available for NSX Edge edge-3.

You need to make it so that your service variables only contain the global objects and NOT the universal objects.

$localServices = Get-NsxService -LocalOnly
$serviceRDP = $localServices | Where-Object {$_.name -eq "RDP"}
$serviceHTTP = $localServices | Where-Object {$_.name -eq "HTTP"}
$serviceHTTPS = $localServices | Where-Object {$_.name -eq "HTTPS"}
$serviceSSH = $localServices | Where-Object {$_.name -eq "SSH"}
$service = $serviceHTTP, $serviceHTTPS, $serviceRDP, $serviceSSH

@sheetjai
Copy link
Author

sheetjai commented Oct 14, 2020 via email

@dcoghlan
Copy link
Contributor

You need to break it down, and figure out which command is not working.

Do you see all the services from globalroot-0 when you run the following

$localServices = Get-NsxService -LocalOnly
$localServices

And then what do you see when you do the following?

$localServices | Where-Object {$_.name -eq "RDP"}

@sheetjai
Copy link
Author

sheetjai commented Oct 14, 2020 via email

@dcoghlan
Copy link
Contributor

When creating a service, you need to supply a scope of the edge-id.

New-NsxService -Name TestService -Description "Test creation of a service" -Protocol TCP -port 50000 -scopeid edge-5

@sheetjai
Copy link
Author

sheetjai commented Oct 14, 2020 via email

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dcoghlan @sheetjai