NSX-T Security Group Automation with PowerCLI: Static, Dynamic, and Tag-Based Membership

Introduction

NSX-T security groups form the foundation for microsegmentation, dynamic firewalling, and tiered access. Manual group management is error-prone and inefficient. With PowerCLI and the NSX-T API modules, you can automate security group operations across thousands of workloads.

This article includes:

• Creating static and dynamic groups
• Managing tag-based group membership
• Auditing group content and effective scope
• Exporting group relationships for documentation

My Personal Repository on GitHub

VMware Repository on GitHub

Prerequisites

Connect to both vCenter and NSX Manager.
Ensure NSX-T PowerCLI module is loaded or use REST method fallback.

Import-Module VMware.Sdk.Nsx.Policy
Connect-NsxServer -Server "nsxmgr.lab.local" -Credential (Get-Credential)

Step 1: Create a Static Security Group

New-NsxPolicyGroup -Name "Web-Tier-Static" `
    -Domain "default" `
    -Description "Static group for web servers"

Assign VMs using their path or object ID:

$vm = Get-VM -Name "WebApp01"
Add-NsxPolicyGroupMember -GroupName "Web-Tier-Static" -Members $vm.ExtensionData.MoRef.Value

Step 2: Create a Dynamic Membership Group (Tag-Based)

New-NsxPolicyGroup -Name "App-Tier-Dynamic" `
    -Domain "default" `
    -Expression @(
        New-NsxPolicyCondition -MemberType "VirtualMachine" -Key "Tag" -Operator "EQUALS" -Value "App"
    )

This group auto-includes all VMs with the tag App.

Step 3: Tag VMs Using PowerCLI

$tag = Get-Tag -Name "App"
Get-VM -Name "AppServer*" | New-TagAssignment -Tag $tag

NSX-T must be configured to sync vCenter tags.

Step 4: List Group Members and Relationships

Get-NsxPolicyGroup -Name "App-Tier-Dynamic" | Get-NsxPolicyGroupMember

Export the mapping:

Get-NsxPolicyGroup -Name "App-Tier-Dynamic" | Get-NsxPolicyGroupMember | Export-Csv "C:\Reports\AppTierGroupMembers.csv" -NoTypeInformation

Diagram: Security Group Automation Flow

Use Case: Enforcing Tier-Based DFW Rules

Three security groups:

• Web-Tier
• App-Tier
• DB-Tier

Example rule:

New-NsxPolicyFirewallRule -Name "Allow Web to App" `
    -SourceGroup "Web-Tier" `
    -DestinationGroup "App-Tier" `
    -Service "HTTPS" `
    -Action "ALLOW" `
    -SequenceNumber 100

Combine with dynamic groups for full microsegmentation automation.

Troubleshooting Group Logic

Scheduled Group Audit Script

Run this weekly to log all members of key NSX groups:

$groups = "Web-Tier", "App-Tier", "DB-Tier"

foreach ($group in $groups) {
    Get-NsxPolicyGroup -Name $group | Get-NsxPolicyGroupMember | Export-Csv "C:\Reports\NSX_$group.csv" -NoTypeInformation
}

What’s Next

Next article will focus on:

• Using PowerCLI to run guest OS customization and scripting inside VMs
• Deploying application stacks with post-clone automation