Security Group

Security Group provides micro-segmentation capabilities on NX-OS by classifying endpoints into security groups based on IP address, VLAN, or external subnets. Traffic between groups is controlled by security contracts applied per VRF, which reference policy maps containing class-map-based filtering rules. Security Group requires the security-group feature to be enabled and system routing template-security-groups to be configured.

Diagram

Classes

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
security_group	Class	[security_group]	No

security_group (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
mac_segmentation	Choice	enabled, disabled	No
security_groups	List	[security_groups]	No
class_maps	List	[class_maps]	No
policy_maps	List	[policy_maps]	No

security_groups (nxos.devices.configuration.security_group)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 65535	Yes
name	String		No
match_connected_endpoints_ipv4	List	[match_connected_endpoints_ipv4]	No
match_connected_endpoints_ipv6	List	[match_connected_endpoints_ipv6]	No
match_vlans	Class	[match_vlans]	No

class_maps (nxos.devices.configuration.security_group)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
filter_entries	List	[filter_entries]	No

policy_maps (nxos.devices.configuration.security_group)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
classes	List	[classes]	No

match_connected_endpoints_ipv4 (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
vrf	String		Yes
address	IP		Yes

match_connected_endpoints_ipv6 (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
vrf	String		Yes
address	IP		Yes

match_vlans (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	[ranges]	No

filter_entries (nxos.devices.configuration.security_group.class_maps)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
dscp	Integer	min: 0, max: 63	No
fragments	Boolean	true, false	No
icmpv4_type	Integer	min: 0, max: 255	No
icmpv6_type	Integer	min: 0, max: 255	No

classes (nxos.devices.configuration.security_group.policy_maps)

Name	Type	Constraint	Mandatory	Default Value
class	String		Yes
action	Choice	deny, permit	No
count	Boolean	true, false	No
log	Boolean	true, false	No
redirect	String		No

ranges (nxos.devices.configuration.security_group.security_groups.match_vlans)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: 1, max: 4094	Yes
to	Integer	min: 1, max: 4094	Yes

Examples

Example 1: Security groups with connected endpoint and VLAN selectors

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          security_group: true
        security_group:
          security_groups:
            - id: 2681
              name: web_sg
              match_connected_endpoints_ipv4:
                - vrf: galactic_vrf
                  address: 172.17.101.0/24
            - id: 2682
              name: mail_sg
              match_connected_endpoints_ipv4:
                - vrf: galactic_vrf
                  address: 172.17.102.0/24
            - id: 5000
              name: monitoring-net
              match_vlans:
                ids: [2402]

Example 2: Class maps and policy maps for security filtering

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          security_group: true
        security_group:
          class_maps:
            - name: icmp
              description: Match ICMP (auto generated)
            - name: tcp_443
              description: Match TCP port 443
              filter_entries:
                - name: tcp_443_entry
            - name: tcp_80
              description: Match TCP port 80
              filter_entries:
                - name: tcp_80_entry
          policy_maps:
            - name: any-to-any_icmp
              description: Any to Any traffic
              classes:
                - class: icmp
                  action: permit
            - name: mail_web_tcp_443
              description: Mail to Web traffic
              classes:
                - class: tcp_443
                  action: permit
                  count: true
                  log: false

Example 3: VRF security enforcement

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          routing: template-security-groups
        feature:
          security_group: true
        vrfs:
          - name: galactic_vrf
            vni: 560000
            security_enforce_tag: 11905
            security_enforce_default: deny