Export All Distributed Firewall (DFW) Rules from NSX-T Manager (Global & Local Manager) Using vRO and vRA

 

Export All Distributed Firewall (DFW) Rules from NSX-T Manager (Global & Local Manager) Using vRO and vRA

Introduction

Managing Distributed Firewall (DFW) policies across multiple NSX-T Managers can become challenging, especially in enterprise environments where hundreds or even thousands of firewall rules are deployed.

Security administrators frequently require firewall rule exports for:

• Security audits
• Compliance reporting
• Rule review and cleanup
• Disaster recovery documentation
• Migration planning
• Change management

Exporting these rules manually from the NSX-T UI is time-consuming and does not provide an efficient way to automate reporting.

In this blog, I'll demonstrate how I automated the entire process using VMware Aria Automation (vRA) and vRealize Orchestrator (vRO). The solution exports all Distributed Firewall rules from either a Global Manager or Local Manager, generates a CSV report, and automatically emails it to the requested recipients.

This automation significantly reduces manual effort while providing a consistent, reusable reporting solution.

 

Use Case

Develop a self-service vRA catalog item that enables administrators to:

• Select an NSX-T Manager
• Export all Distributed Firewall rules
• Generate a CSV report
• Email the report automatically

No manual login to NSX-T Manager is required after the request is submitted.

 

 Solution Architecture

  

vRA Catalog Inputs

The catalog item contains two simple inputs.

1. NSX-T Manager

A drop-down list allows users to select which NSX-T environment they want to export.

Options include:

• Global Manager
• Local Manager – Site A
• Local Manager – Site B

The workflow automatically connects to the selected NSX-T Manager.

 

2. Email Address

Users specify one or more email recipients.

Example:

network.team@company.com

After the workflow completes, the CSV report is automatically sent to the provided email address.

 

 

Workflow Process

The workflow performs the following tasks.

Step 1 – User Submits the Catalog Request

The administrator opens the vRA catalog item.

They simply:

• Select the NSX-T Manager
• Enter the recipient email address
• Submit the request

 

Step 2 – vRO Starts the Workflow

Once the request is approved (if applicable), the vRO workflow starts automatically.

The workflow identifies which NSX-T Manager was selected.

 

Step 3 – Connect to NSX-T REST API

The workflow establishes a secure REST connection to the selected NSX-T Manager.

Depending on the selection, it connects to:

• Global Manager
• Local Manager Site A
• Local Manager Site B

 

Step 4 – Collect DFW Policies

The workflow retrieves all security policies.

Example REST API:

GET /policy/api/v1/infra/domains/default/security-policies

Each policy is processed one by one.

 

Step 5 – Collect Firewall Rules

For every policy, the workflow retrieves all Distributed Firewall rules.

The workflow also collects rule statistics.

 

Step 6 – Collect Rule Statistics

Additional API calls retrieve:

• Rule Hit Count
• Last Hit Time

These values help identify:

• Unused firewall rules
• Frequently used rules
• Candidate rules for cleanup

 

CSV Report

The workflow generates a CSV report containing the following information.

Policy Name,Rule Name,Rule ID,Action,Source,Destination,Applied To,Direction,Disabled,Hit Count,Last Hit Time,Protocol,Ports

Example:

Policy	Rule	Action	Source	Destination	Protocol	Ports
Production	Allow Web	Allow	Web	App	TCP	443
DMZ	Allow SSH	Allow	Admin	Linux	TCP	22

 

Send Email

Once the CSV report is generated, the workflow automatically attaches it to an email.

The recipient receives:

• CSV attachment
• Request information
• Generation timestamp

No manual export is required.

 

High-Level Workflow

 

 

Demo Video

In the demo video, you'll see the complete end-to-end workflow in action.

The demonstration includes:

• Creating a request from the vRA Catalog
• Selecting the target NSX-T Manager
• Entering the recipient email address
• Monitoring workflow execution in vRO
• Connecting to NSX-T using REST APIs
• Collecting all Distributed Firewall policies and rules
• Generating the CSV report
• Automatically sending the report via email
• Reviewing the generated CSV attachment

This demonstrates how firewall reporting can be fully automated with minimal user input.

 

Benefits

• Fully automated DFW rule export
• Supports Global Manager and Local Manager environments
• Self-service through VMware Aria Automation
• Eliminates manual report generation
• CSV format suitable for audits and compliance
• Includes rule statistics such as Hit Count and Last Hit Time
• Automatically emails the report to the requested recipients
• Easily scalable for large NSX-T environments

 

Real-World Use Cases

This solution is particularly useful for:

• Firewall compliance audits
• Quarterly security reviews
• Rule recertification
• Migration planning
• Change management
• Security documentation
• Operational reporting
• Identifying unused firewall rules using Hit Count