VM-Series
Deployment
Guide
53
Set Up a VM-Series NSX Edition Firewall
VM-Series NSX Edition Firewall Overview
If, for example, you have a multi-tier architecture for web applications, on the NSX Manager you create three
security groups for the WebFrontEnd servers, Application servers and the Database servers. The NSX Manager
updates Panorama with the name of the security groups and the IP address of the guests that are included in
each security group.
On Panorama, you can then create three Dynamic Address Groups to match objects that are tagged as
Database, Application and WebFrontEnd. Then, in security policy you can use the Dynamic Address Groups
as source or destination objects, define the applications that are permitted to traverse these servers, and push
the rules to the VM-Series firewalls.
Each time a guest is added or modified in the ESXi cluster or a security group is updated or created, the NSX
Manager uses the PAN-OS REST-based XML API to update Panorama with the IP address, and the security
group to which the guest belongs.
To ensure that the name of each security group is unique, the vCenter server assigns a Managed
Object Reference (MOB) ID to the name you define for the security group. The syntax used to
display the name of a security group on Panorama is
specified_name-securitygroup-number
; for
example,
WebFrontEnd-securitygroup-47
.
