Security Group

Security Group provides micro-segmentation capabilities on NX-OS by classifying endpoints into security groups based on IP address, VLAN, or external subnets. Traffic between groups is controlled by security contracts applied per VRF, which reference policy maps containing class-map-based filtering rules. Security Group requires the security-group feature to be enabled and system routing template-security-groups to be configured.

Diagram

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
security_group	Class	security_group	No

security_group (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
mac_segmentation	Choice	enabled, disabled	No
security_groups	List	security_groups	No
class_maps	List	class_maps	No
policy_maps	List	policy_maps	No

security_groups (nxos.devices.configuration.security_group)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 65535	Yes
name	String		No
type_layer4_7	Boolean	true, false	No
intra_group_isolation	Boolean	true, false	No
match_connected_endpoints_ipv4	List	match_connected_endpoints_ipv4	No
match_connected_endpoints_ipv6	List	match_connected_endpoints_ipv6	No
match_external_subnets_ipv4	List	match_external_subnets_ipv4	No
match_external_subnets_ipv6	List	match_external_subnets_ipv6	No
match_interfaces	List	match_interfaces	No
match_vlans	Class	match_vlans	No
match_vlan_macs	List	match_vlan_macs	No
match_vlan_interfaces	List	match_vlan_interfaces	No

security_groups (nxos.devices.configuration.security_group)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 65535	Yes
name	String		No
match_connected_endpoints_ipv4	List	match_connected_endpoints_ipv4	No
match_connected_endpoints_ipv6	List	match_connected_endpoints_ipv6	No
match_vlans	Class	match_vlans	No

class_maps (nxos.devices.configuration.security_group)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
filter_entries	List	filter_entries	No

policy_maps (nxos.devices.configuration.security_group)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
description	String		No
classes	List	classes	No

match_connected_endpoints_ipv4 (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
vrf	String		Yes
address	IP		Yes

match_connected_endpoints_ipv6 (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
vrf	String		Yes
address	IP		Yes

match_external_subnets_ipv4 (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
vrf	String		Yes
address	IP		Yes
route_inject	Boolean	true, false	No
nexthop_ipv4	IP		No
encap_type	Choice	mpls-vpn	No

match_external_subnets_ipv6 (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
vrf	String		Yes
address	IP		Yes
route_inject	Boolean	true, false	No
nexthop_ipv4	IP		No
nexthop_ipv6	IP		No
encap_type	Choice	mpls-vpn	No

match_interfaces (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	Yes
interface_id	Any	String or Integer[min: 0]	Yes

match_vlans (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: 1, max: 4094]	No
ranges	List	ranges	No

match_vlan_macs (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
vlan	Integer	min: 1, max: 4094	Yes
mac	MAC		Yes

match_vlan_interfaces (nxos.devices.configuration.security_group.security_groups)

Name	Type	Constraint	Mandatory	Default Value
vlan	Integer	min: 1, max: 4094	Yes
interface_type	Choice	ethernet, loopback, mgmt, port-channel, vlan, vni	Yes
interface_id	Any	String or Integer[min: 0]	Yes

filter_entries (nxos.devices.configuration.security_group.class_maps)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
ether_type	Choice	ipv4, ipv6	No
protocol	Any	Choice[icmp, igmp, tcp, egp, igp, udp, icmpv6, eigrp, ospfigp, pim, l2tp] or Integer[min: 0, max: 255] or String[Regex: ^.*[\$\%]\{.*$]	No
stateful	Boolean	true, false	No
sport	Integer	min: 1, max: 65535	No
sport_to	Integer	min: 1, max: 65535	No
dport	Integer	min: 1, max: 65535	No
dport_to	Integer	min: 1, max: 65535	No
session_rule	List	Choice[ack, est, fin, rst, syn]	No
dscp	Integer	min: 0, max: 63	No
fragments	Boolean	true, false	No
icmpv4_type	Integer	min: 0, max: 255	No
icmpv6_type	Integer	min: 0, max: 255	No

filter_entries (nxos.devices.configuration.security_group.class_maps)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
dscp	Integer	min: 0, max: 63	No
fragments	Boolean	true, false	No
icmpv4_type	Integer	min: 0, max: 255	No
icmpv6_type	Integer	min: 0, max: 255	No

classes (nxos.devices.configuration.security_group.policy_maps)

Name	Type	Constraint	Mandatory	Default Value
class	String		Yes
action	Choice	deny, permit	No
count	Boolean	true, false	No
log	Boolean	true, false	No
redirect	String		No

ranges (nxos.devices.configuration.security_group.security_groups.match_vlans)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: 1, max: 4094	Yes
to	Integer	min: 1, max: 4094	Yes

Examples

Example 1: Security groups with connected endpoint and VLAN selectors, and intra-group isolation (requires NX-OS 10.6(3) or later)

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          security_group: true
        security_group:
          security_groups:
            - id: 2681
              name: web_sg
              intra_group_isolation: true
              match_connected_endpoints_ipv4:
                - vrf: galactic_vrf
                  address: 172.17.101.0/24
            - id: 2682
              name: mail_sg
              match_connected_endpoints_ipv4:
                - vrf: galactic_vrf
                  address: 172.17.102.0/24
            - id: 5000
              name: monitoring-net
              match_vlans:
                ids: [2402]

Example 2: Security groups with external subnet, interface, VLAN/MAC and VLAN/interface selectors

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          security_group: true
        security_group:
          security_groups:
            - id: 3001
              name: external_sg
              match_external_subnets_ipv4:
                - vrf: galactic_vrf
                  address: 10.100.0.0/16
                  route_inject: true
                - vrf: galactic_vrf
                  address: 10.200.0.0/16
                  nexthop_ipv4: 172.16.0.1
                - vrf: galactic_vrf
                  address: 10.201.0.0/16
                  nexthop_ipv4: 172.16.0.2
                  encap_type: mpls-vpn
              match_external_subnets_ipv6:
                - vrf: galactic_vrf
                  address: 2001:db8:100::/48
                - vrf: galactic_vrf
                  address: 2001:db8:200::/48
                  nexthop_ipv6: 2001:db8::1
                - vrf: galactic_vrf
                  address: 2001:db8:201::/48
                  nexthop_ipv4: 172.16.0.2
                  encap_type: mpls-vpn
            - id: 3002
              name: firewall_sg
              type_layer4_7: true
              match_interfaces:
                - interface_type: vlan
                  interface_id: 3002
            - id: 3003
              name: hosts_sg
              match_vlan_macs:
                - vlan: 3003
                  mac: 00:1b:63:84:45:e6
              match_vlan_interfaces:
                - vlan: 3003
                  interface_type: ethernet
                  interface_id: 1/10
                - vlan: 3003
                  interface_type: port-channel
                  interface_id: 10

Example 3: Class maps and policy maps for security filtering

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          security_group: true
        security_group:
          class_maps:
            - name: icmp
              description: Match ICMP (auto generated)
            - name: tcp_443
              description: Match TCP port 443
              filter_entries:
                - name: tcp_443_entry
                  ether_type: ipv4
                  protocol: tcp
                  stateful: true
                  dport: 443
            - name: tcp_80
              description: Match TCP port 80
              filter_entries:
                - name: tcp_80_entry
                  ether_type: ipv4
                  protocol: tcp
                  dport: 80
            - name: dns
              description: Match DNS from ephemeral ports
              filter_entries:
                - name: dns_entry
                  ether_type: ipv4
                  protocol: udp
                  sport: 1024
                  sport_to: 65535
                  dport: 53
            - name: tcp_established
              description: Match established TCP sessions with DSCP AF11
              filter_entries:
                - name: tcp_est_entry
                  ether_type: ipv4
                  protocol: tcp
                  session_rule: [est]
                  dscp: 10
          policy_maps:
            - name: any-to-any_icmp
              description: Any to Any traffic
              classes:
                - class: icmp
                  action: permit
            - name: mail_web_tcp_443
              description: Mail to Web traffic
              classes:
                - class: tcp_443
                  action: permit
                  count: true
                  log: false

Example 4: VRF security enforcement and security contracts

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          routing: template-security-groups
        feature:
          security_group: true
        vrfs:
          - name: galactic_vrf
            vni: 560000
            security_enforce_tag: 11905
            security_enforce_default: deny
            security_contracts:
              - source: 2682
                destination: 2681
                policy: mail_web_tcp_443
                unidir: true
              - source: any
                destination: any
                policy: any-to-any_icmp

Examples

Example 1: Security groups with connected endpoint and VLAN selectors

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          security_group: true
        security_group:
          security_groups:
            - id: 2681
              name: web_sg
              match_connected_endpoints_ipv4:
                - vrf: galactic_vrf
                  address: 172.17.101.0/24
            - id: 2682
              name: mail_sg
              match_connected_endpoints_ipv4:
                - vrf: galactic_vrf
                  address: 172.17.102.0/24
            - id: 5000
              name: monitoring-net
              match_vlans:
                ids: [2402]

Example 2: Class maps and policy maps for security filtering

nxos:
  devices:
    - name: LEAF1
      configuration:
        feature:
          security_group: true
        security_group:
          class_maps:
            - name: icmp
              description: Match ICMP (auto generated)
            - name: tcp_443
              description: Match TCP port 443
              filter_entries:
                - name: tcp_443_entry
            - name: tcp_80
              description: Match TCP port 80
              filter_entries:
                - name: tcp_80_entry
          policy_maps:
            - name: any-to-any_icmp
              description: Any to Any traffic
              classes:
                - class: icmp
                  action: permit
            - name: mail_web_tcp_443
              description: Mail to Web traffic
              classes:
                - class: tcp_443
                  action: permit
                  count: true
                  log: false

Example 3: VRF security enforcement

nxos:
  devices:
    - name: LEAF1
      configuration:
        system:
          routing: template-security-groups
        feature:
          security_group: true
        vrfs:
          - name: galactic_vrf
            vni: 560000
            security_enforce_tag: 11905
            security_enforce_default: deny