COMPLETE VSHIELD EDGE DEPLOYMENT AND CONFIGURATION AUTOMATION

For my day job I worked on automating the deployment and configuration of the vShield Edge appliance.

To an untrained eye this can be quite complicated and has been fun to work on. I ran into a lot of documentation gaps and issues with the entire deployment and VMware SDK support has been notified about these gaps.

The Script allows you to deploy vShield Edge Appliance to a vCenter and also configures. The script configures the following for the edge appliance,

Deployes it with three uplinks for External,internal and heartbeat networks
Configures firewall rules
Configures object-groups
Configures static routes
Configures LB rules

The script is missing HA configuration and LB service enable parts. I have these done but looks like VMware issue is preventing these to run properly. VMware is investigating so sit tight!

In my home lab I had deployed the edge appliance a whopping 200 times before I got the script right! This was mostly due to the gaps and issues in the API.

The community script has been edited to protect my product information and I haven’t had a chance to test the formatted script but it should work just fine.

The read me for the file is here. You can get my script at my github repo!

Here is the script for quick reference, click Read more below for the script.

Add-PSSnapin Vmware.vimautomation.core
Add-PSSnapin VMware.VimAutomation.Vds
Set-StrictMode -Version 2.0
 
#Reading the XML and copying all the info.
 
$xml = [XML](Get-Content edge-config.xml)
 
$vsmip = $xml.MasterConfig.vShieldAppConfig.vshield_ip
$edge_app_name = $xml.MasterConfig.Edgeconfig.Edge_app_name
$edge_app_description = $xml.MasterConfig.Edgeconfig.Edge_app_description
$core_root_password = $xml.MasterConfig.Edgeconfig.Edge_password
 
$vcenteruser = $xml.MasterConfig.vcenterconfig.vcenteruser
$vcenterpassword = $xml.MasterConfig.vcenterconfig.vcenterpassword
$vcenter = $xml.MasterConfig.vcenterconfig.vcenterfqdn
$cluster_name = $xml.MasterConfig.vcenterconfig.Edge_cluster
$datacentername = $xml.MasterConfig.vcenterconfig.Edge_datacenter
$internalportgroupname = $xml.MasterConfig.vcenterconfig.InternalDVportgroup_name
$externalportgroupname = $xml.MasterConfig.vcenterconfig.ExternalDVportgroup_name 
$heartbeatportgroupname = $xml.MasterConfig.vcenterconfig.HeartbeatDVportgroup_name
$Edge_datastore = $xml.MasterConfig.vcenterconfig.Edge_datastore
 
 
 
 
 
$INTERNAL_network = $xml.MasterConfig.routes.INTERNAL_network
$INTERNAL_network2 = $xml.MasterConfig.routes.INTERNAL_network2
$gatewayaddr = $xml.MasterConfig.routes.gatewayaddr
$nexthop = $xml.MasterConfig.routes.nexthop
 
$vcd_INTERNAL_web_vip = $xml.MasterConfig.EdgeIPConfig.VCD_INTERNAL_web_vip
$vcd_INTERNAL_console_vip = $xml.MasterConfig.EdgeIPConfig.VCD_INTERNAL_console_vip
$vcenter_INTERNAL_web_vip = $xml.MasterConfig.EdgeIPConfig.vcenter_INTERNAL_web_vip
$vcenter_INTERNAL_websvcs_vip = $xml.MasterConfig.EdgeIPConfig.vcenter_INTERNAL_websvcs_vip
$vcd_exnet_console_vip = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_console_vip
$vcd_exnet_web_vip = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_web_vip
$external_edge_ip = $xml.MasterConfig.EdgeIPConfig.Edge_exnet_ip
$vcenter_exnet_ip = $xml.MasterConfig.EdgeIPConfig.vcenter_exnet_ip
$vcd_exnet_console_ip1 = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_console_ip1
$vcd_exnet_console_ip2 = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_console_ip2
$vcd_exnet_web_ip1 = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_web_ip1
$vcd_exnet_web_ip2 = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_web_ip2
 
$vshieldDefaultUser = $xml.MasterConfig.vShieldAppConfig.vshielduser
$vShieldDefaultPass = $xml.MasterConfig.vShieldAppConfig.vshieldpass
 
$DC_Terminal_Ipaddress = $xml.MasterConfig.EdgeIPConfig.DC_terminal_ip
$DC_Name = $xml.MasterConfig.EdgeIPConfig.DC_Name
 
#vShield API Url
$vsm_edge_url = "https://"+$vsmip+"/api/3.0/edges"
 
#Building the headers
$auth = $vshieldDefaultUser + ':' + $vShieldDefaultPass
$Encoded = [System.Text.Encoding]::UTF8.GetBytes($auth)
$EncodedPassword = [System.Convert]::ToBase64String($Encoded)
$headers = @{"Authorization"="Basic $($EncodedPassword)";}
 
#Decalre the PUT function
Function Calling-Put($url,$Body){
try {
Invoke-RestMethod -Headers $headers -Uri $url -Body $Body -Method Put -ContentType Application/xml 
} 
            catch { $_.Exception
            Write-Host "Put Failed at - " $url }
}
 
#Declare the POST function
Function Calling-Post($url,$Body){
try {
Invoke-RestMethod -Headers $headers -Uri $url -Body $Body -Method Post -ContentType Application/xml 
} 
            catch { $_.Exception 
            Write-Host "Post Failed at - " $url }              
}
 
#Connect to the vcenter where vSM will be deployed
Write-host "Connecting to vcenter..."
connect-viserver -server $vcenter -protocol https -username $vcenteruser -password $vcenterpassword | Out-Null
 
#Getting the MOID for datacenter, resourcepool, networks and datastore
$datastore_full_id = get-cluster $cluster_name | Get-Datastore $edge_datastore | Select-Object -ExpandProperty Id | Out-String
$resource_full_id = Get-ResourcePool -Location $cluster_name | Select-Object -ExpandProperty Id | Out-String 
$datacenter_full_id = get-datacenter $datacentername | Select-Object -ExpandProperty Id | Out-String
$internal_network_full_id = get-vdportgroup -Name $internalportgroupname | Select-Object -ExpandProperty Id | Out-String
$external_network_full_id = get-vdportgroup -Name $externalportgroupname | Select-Object -ExpandProperty Id | Out-String
$heartbeat_network_full_id = Get-VDPortgroup -Name $heartbeatportgroupname | Select-Object -ExpandProperty Id | Out-String
 
#Cleaning up and prepping the variables
$datastoremoid = $datastore_full_id.Replace("Datastore-datastore","datastore")
$resourcemoid = $resource_full_id.Replace("ResourcePool-resgroup","resgroup")
$datacentermoid= $datacenter_full_id.Replace("Datacenter-datacenter","datacenter")
$internal_networkmoid = $internal_network_full_id.Replace("DistributedVirtualPortgroup-dvportgroup","dvportgroup")
$external_networkmoid = $external_network_full_id.Replace("DistributedVirtualPortgroup-dvportgroup","dvportgroup")
$heartbeat_networkmoid = $heartbeat_network_full_id.Replace("DistributedVirtualPortgroup-dvportgroup","dvportgroup")
 
$datastoremoid = $datastoremoid.Trim()
$resourcemoid = $resourcemoid.Trim()
$datacentermoid = $datacentermoid.Trim()
$internal_networkmoid = $internal_networkmoid.Trim()
$external_networkmoid = $external_networkmoid.Trim()
$heartbeat_networkmoid = $heartbeat_networkmoid.Trim()
 
#Ignore selfsigned cert
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
 
#Function to deploy the Edge    
Function Deploy-Edge () {
    $Body = @"
 
${datacentermoid}
${edge_app_name} 
${edge_app_description} 
org1
${edge_app_name} 
info
 
        large 
 
        ${resourcemoid}
        ${datastoremoid}
 
 
 
 
    0
    <label>vNic0</label>
    true 
    ${externalportgroupname} 
    uplink
    ${external_networkmoid}
    ${externalportgroupname}
 
 
        ${external_edge_ip} 
 
        ${vcd_exnet_web_vip}
        ${vcd_exnet_console_vip}
 
        255.255.252.0
 
 
 
 
    1
    <label>vNic1</label>
    true 
    ${internalportgroupname} 
    uplink
    ${internal_networkmoid}
    ${internalportgroupname}
 
 
        ${vcd_INTERNAL_web_vip} 
 
        ${vcd_INTERNAL_console_vip}
        ${vcenter_INTERNAL_web_vip}
        ${vcenter_INTERNAL_websvcs_vip}
 
        255.255.248.0
 
 
 
 
    2
    <label>vNic2</label>
true
    ${heartbeatportgroupname} 
    Internal
    ${heartbeat_networkmoid}
    ${heartbeatportgroupname}
 
 
 
 
 
    admin 
    ${core_root_password} 
    true 
 
 
    true
    high 
 
 
"@
   Calling-Post -url $vsm_edge_url -Body $Body
}
 
 
#Function to grab the Edge ID after its deployed - this is needed to configure LB, FW and Edge HA
Function Get-Edge-Id(){
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
$auth = 'Basic ' + [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($vshieldDefaultUser+':'+$vShieldDefaultPass))
 
#GET all edges
$req = [System.Net.WebRequest]::Create($vsm_edge_url)
$req.Method ="GET"
$req.Headers.add("AUTHORIZATION", $auth);
$resp = $req.GetResponse()
$reader = new-object System.IO.StreamReader($resp.GetResponseStream())
[xml]$xmloutput = $reader.ReadToEnd()
 
#here you find all edges:
foreach($edge in $xmloutput.pagedEdgeList.edgePage.edgeSummary){
if($edge.name -eq $edge_app_name){
       return $edge.objectId
       }
    }
}
 
#Function to check if the Edge is in "deployed" state
Function Check-Edge-State(){
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
$auth1 = 'Basic ' + [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($vshieldDefaultUser+':'+$vShieldDefaultPass))
 
#GET all edges
$req1 = [System.Net.WebRequest]::Create($vsm_edge_url)
$req1.Method ="GET"
$req1.Headers.add("AUTHORIZATION", $auth1);
$resp1 = $req1.GetResponse()
$reader1 = new-object System.IO.StreamReader($resp1.GetResponseStream())
[xml]$xmloutput1 = $reader1.ReadToEnd()
 
#here you find all edges:
foreach($edge1 in $xmloutput1.pagedEdgeList.edgePage.edgeSummary){
if($edge1.name -eq $edge_app_name){
        do {
        write-host "Waiting for edge to be in deployed state"
        sleep(10)
        }
        until ($edge1.state -eq 'deployed')
       }
    }
}
 
#Adding Static Routes
Function Adding_static_routes(){
 $Body = @"
 
 
 
1
${INTERNAL_network}
${nexthop}
 
 
1
${INTERNAL_network2}
${nexthop}
 
 
 
0
${gatewayaddr}
 
 
"@
 
Calling-Put -URL $url_static_routes -Body $Body
 
}
 
#Adding grouping Objects
Function Adding_grouping_objects1(){
    $Body = @"
 
 
 
 
 
 
 Virtual Center NAT INTERNAL IP
 
 Virtual Center Nat IP 
 0 
 
 ${vcenter_INTERNAL_web_vip} 
 
"@
    Calling-post -URL $url_grouping_objects -Body $Body
}
 
#Adding more grouping objects
Function Adding_grouping_objects2(){
    $Body = @"
 
 
 
 
 
 
 Nat INTERNAL Security Groups
 
 ${DC_name} Terminal Servers 
 0 
 
 ${DC_Terminal_Ipaddress} 
 
"@
    Calling-post -URL $url_grouping_objects -Body $Body
}
 
#Getting the FW application ids which need to be used while configuring the fw
 Function get_fw_app_id(){
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
$auth = 'Basic ' + [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($vshieldDefaultUser+':'+$vShieldDefaultPass))
 
#GET all edges
$req = [System.Net.WebRequest]::Create($app_scope_url)
$req.Method ="GET"
$req.Headers.add("AUTHORIZATION", $auth);
$resp = $req.GetResponse()
$reader = new-object System.IO.StreamReader($resp.GetResponseStream())
[xml]$xmloutput = $reader.ReadToEnd()
 
#Parsing the XML and Grabbing the Application id's here
 
foreach($Appname in $xmloutput.list.application){
if($Appname.name -eq 'ICMP Echo'){
       $global:icmp_id = $Appname.objectId
 
       }
if($Appname.name -eq 'VMware-VC-Webaccess'){
       $global:vmware_vc_webaccess_id = $Appname.objectId
      # return $vmware_vc_webaccess_id
    }
if($Appname.name -eq 'HTTPS'){
    $global:https_id = $Appname.objectId
    #return $https_id
    }
    }
}
 
#Adding FW rules
Function Adding_Firewall_rules(){
    $Body = @"
 <!--?xml version="1.0"?-->
 
 
 
ICMP 
 
${icmp_id}
 
accept
true
 
 
VMware VC WebAccess 
 
${terminal_server_grouping_object_id}
 
 
${vcenter_grouping_object_id}
 
 
${vmware_vc_webaccess_id}
 
accept
true
 
 
VI Client 
 
${terminal_server_grouping_object_id}
 
 
${vcenter_grouping_object_id}
 
 
${https_id}
 
accept
true
 
 
 
"@
    Calling-Put -URL $Firewall_url -Body $Body
}
 
#Adding HA edge - function setup but not called due to inherent timeout issue vmware investigating
 Function Adding_HA_Edge(){
    $Body = @"
 
2 
6
true
 
"@
       Calling-Put -url $HA_url -Body $Body
}
 
#LB service enable function but not called due to inherent time out issue vmware investigating
 Function Enable_LB_Service(){
    $Body = @"
 
true
true
 
"@
       Calling-Put -url $LB_enable_url -Body $Body
}
 
##Adding LB pool functions begin here
Function Adding_Edge_LB_Pool1(){
  $Body_1 = @"
<!--?xml version="1.0" encoding="UTF-8"?--> 
 
    1
    VCENTER-INTERNAL-WEBSERVICES
 
    HTTP 
    LEAST_CONN
    80
    80
 
    HTTP
    2
    3
    5
    /
    15
 
 
 
    TCP 
    LEAST_CONN
    443
    443
 
    TCP
    2
    3
    5
    /
    15
 
 
 
    ${vcenter_exnet_ip} 
    1
 
    TCP
    443 
    443
 
 
 
"@
   Calling-Post-LB -url1 $LB_pool_url -Body1 $Body_1
}
 
Function Adding_Edge_LB_Pool2(){
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?--> 
 
2
VCENTER-INTERNAL-WEBCLIENT
 
HTTPS 
LEAST_CONN
9443
9443
 
SSL
2
3
5
/
15
 
 
 
${vcenter_exnet_ip} 
1
 
HTTPS
9443 
9443
 
 
 
"@
 
    Calling-Post-LB -url1 $LB_pool_url -Body1 $Body
}
 
 
Function Adding_Edge_LB_Pool3(){
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?--> 
 
3
VCD-INTERNAL-CONSOLE
 
TCP 
LEAST_CONN
443
443
 
TCP
2
3
5
/
15
 
 
 
${vcd_exnet_console_ip1} 
1
 
TCP
443 
443
 
 
 
${vcd_exnet_console_ip2} 
1
 
TCP
443 
443
 
 
 
"@
 
    Calling-Post-LB -url1 $LB_pool_url -Body1 $Body
}
 
Function Adding_Edge_LB_Pool4(){
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?--> 
 
4
VCD-INTERNAL-WEB
 
HTTPS 
LEAST_CONN
443
443
 
SSL
2
3
5
/
15
 
 
 
${vcd_exnet_web_ip1} 
1
 
HTTPS
443 
443
 
 
 
${vcd_exnet_web_ip2} 
1
 
HTTPS
443 
443
 
 
 
"@
 
    Calling-Post-LB -url1 $LB_pool_url -Body1 $Body
}
 
Function Adding_Edge_LB_Pool5(){
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?--> 
 
5
VCD-EXNET-CONSOLE
 
TCP 
LEAST_CONN
443
443
 
TCP
2
3
5
/
15
 
 
 
${vcd_exnet_console_ip1} 
1
 
TCP
443 
443
 
 
 
${vcd_exnet_console_ip1} 
1
 
TCP
443 
443
 
 
 
"@
 
    Calling-Post-LB -url1 $LB_pool_url -Body1 $Body
}
 
Function Adding_Edge_LB_Pool6(){
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?--> 
 
6
VCD-EXNET-WEB
 
HTTPS 
LEAST_CONN
443
443
 
SSL
2
3
5
/
15
 
 
 
${vcd_exnet_web_ip1} 
1
 
HTTPS
443 
443
 
 
 
${vcd_exnet_web_ip2} 
1
 
HTTPS
443 
443
 
 
 
"@
 
    Calling-Post-LB -url1 $LB_pool_url -Body1 $Body
}
 
#Function to create virtual servers
Function Adding_Edge_VS0() {
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?--> 
 
VCENTER-INTERNAL-PORT902-VIP
VCENTER INTERNAL PORT902 VIP
${vcenter_INTERNAL_websvcs_Vip}  
 
TCP
902
 
 
false
INFO
 
 
1
 
 
"@
    Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body
 }
 
Function Adding_Edge_VS1() {
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?-->
 
VCENTER-INTERNAL-WEBSERVICES-VIP
VCENTER INTERNAL WEBSVCS VIP
${vcenter_INTERNAL_websvcs_vip} 
 
HTTP
80
 
COOKIE 
JSESSIONID
INSERT
 
 
 
TCP
443
 
 
false
INFO
 
 
1
 
 
"@
    Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body
 }
 
Function Adding_Edge_VS2() {
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?-->
 
VCENTER-INTERNAL-WEB-VIP
VCENTER INTERNAL WEB VIP
${vcenter_INTERNAL_web_vip} 
 
HTTPS
443
 
 
false
INFO
 
 
2
 
 
"@
    Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body
 }
 
Function Adding_Edge_VS3() {
 $Body = @"
 <!--?xml version="1.0" encoding="UTF-8"?-->
 
VCD-INTERNAL-CONSOLE-VIP
VCD INTERNAL Console VIP
${vcd_INTERNAL_console_vip} 
 
TCP
443
 
 
false
INFO
 
 
3
 
 
"@
    Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body
 }
 
Function Adding_Edge_VS4() {
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?-->
 
VCD-INTERNAL-WEB-VIP
VCD INTERNAL WEB VIP
${vcd_INTERNAL_web_vip} 
 
HTTPS
443
 
 
false
INFO
 
 
4
 
 
"@
   Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body
 }
 
Function Adding_Edge_VS5() {
 $Body = @"
 <!--?xml version="1.0" encoding="UTF-8"?-->
 
VCD-EXNET-CONSOLE-VIP
VCD ExNet Console VIP
${vcd_exnet_console_vip} 
 
TCP
443
 
 
false
INFO
 
 
5
 
 
"@
    Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body
 }
 
 Function Adding_Edge_VS6() {
 $Body = @"
<!--?xml version="1.0" encoding="UTF-8"?-->
 
VCD-EXNET-WEB-VIP
VCD ExNet WEB VIP
${vcd_exnet_web_vip} 
 
HTTPS
443
 
 
false
INFO
 
 
6
 
 
"@
    Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body
 }
 
 #I just declared a separate function for this post call
 Function Calling-Post-LB($url1,$Body1){
$auth1 = $vshieldDefaultUser + ':' + $vShieldDefaultPass
$Encoded1 = [System.Text.Encoding]::UTF8.GetBytes($auth1)
$EncodedPassword1 = [System.Convert]::ToBase64String($Encoded1)
$headers1 = @{"Authorization"="Basic $($EncodedPassword1)";}
try {Invoke-RestMethod -Headers $headers1 -Uri $url1 -Body $Body1 -Method Post -ContentType "Application/xml" } 
            catch { $_.Exception
                  write-host $url1 } 
}
 
#####Deploying the Edge#####
#First deploy the Edge Appliances
Deploy-Edge
 
#Set the Edge ID of the deployed appliance
Check-Edge-State
$edge_unique_id = Get-Edge-Id
 
#setting all the URL's here
$url_grouping_objects = "https://"+$vsmip+"/api/2.0/services/ipset/"+$edge_unique_id
$url_static_routes = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/routing/config"
$app_scope_url = "https://"+$vsmip+"/api/2.0/services/application/scope/"+$edge_unique_id
$firewall_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/firewall/config"
$HA_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/highavailability/config"
$LB_pool_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/loadbalancer/config/pools"
$LB_enable_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/loadbalancer/config"
$LB_virtualserver_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/loadbalancer/config/virtualservers"
 
#######Configuration of the Edge Starts here#######
 
Write-host "Creating LB Pools now.."
Adding_Edge_LB_Pool1 | Out-Null
Adding_Edge_LB_Pool2 | Out-Null
Adding_Edge_LB_Pool3 | Out-Null
Adding_Edge_LB_Pool4 | Out-Null
Adding_Edge_LB_Pool5 | Out-Null
Adding_Edge_LB_Pool6 | Out-Null
 
#Creating Edge LB Virtual Servers
Write-host "Adding LB Virtual Servers now.."
Adding_Edge_VS0
Adding_Edge_VS1
Adding_Edge_VS2
Adding_Edge_VS3
Adding_Edge_VS4
Adding_Edge_VS5
Adding_Edge_VS6
 
 
#Add static routes and default routes
Write-Host "Adding static routes now.."
Adding_static_routes
 
 
#Adding Object groups and getting the IDs which need to be passed over to create firewall rules
Write-host "Creating grouping objects now.."
$vcenter_grouping_object_id = Adding_grouping_objects1
$terminal_server_grouping_object_id = Adding_grouping_objects2
 
#Getting Application ids which need to be passed over to create firewall rules
get_fw_app_id
 
#Creating the Firewall rules 
Write-host "Creating FW rules now.."
Adding_Firewall_rules

Add-PSSnapin Vmware.vimautomation.core Add-PSSnapin VMware.VimAutomation.Vds Set-StrictMode -Version 2.0 #Reading the XML and copying all the info. $xml = [XML](Get-Content edge-config.xml) $vsmip = $xml.MasterConfig.vShieldAppConfig.vshield_ip $edge_app_name = $xml.MasterConfig.Edgeconfig.Edge_app_name $edge_app_description = $xml.MasterConfig.Edgeconfig.Edge_app_description $core_root_password = $xml.MasterConfig.Edgeconfig.Edge_password $vcenteruser = $xml.MasterConfig.vcenterconfig.vcenteruser $vcenterpassword = $xml.MasterConfig.vcenterconfig.vcenterpassword $vcenter = $xml.MasterConfig.vcenterconfig.vcenterfqdn $cluster_name = $xml.MasterConfig.vcenterconfig.Edge_cluster $datacentername = $xml.MasterConfig.vcenterconfig.Edge_datacenter $internalportgroupname = $xml.MasterConfig.vcenterconfig.InternalDVportgroup_name $externalportgroupname = $xml.MasterConfig.vcenterconfig.ExternalDVportgroup_name $heartbeatportgroupname = $xml.MasterConfig.vcenterconfig.HeartbeatDVportgroup_name $Edge_datastore = $xml.MasterConfig.vcenterconfig.Edge_datastore $INTERNAL_network = $xml.MasterConfig.routes.INTERNAL_network $INTERNAL_network2 = $xml.MasterConfig.routes.INTERNAL_network2 $gatewayaddr = $xml.MasterConfig.routes.gatewayaddr $nexthop = $xml.MasterConfig.routes.nexthop $vcd_INTERNAL_web_vip = $xml.MasterConfig.EdgeIPConfig.VCD_INTERNAL_web_vip $vcd_INTERNAL_console_vip = $xml.MasterConfig.EdgeIPConfig.VCD_INTERNAL_console_vip $vcenter_INTERNAL_web_vip = $xml.MasterConfig.EdgeIPConfig.vcenter_INTERNAL_web_vip $vcenter_INTERNAL_websvcs_vip = $xml.MasterConfig.EdgeIPConfig.vcenter_INTERNAL_websvcs_vip $vcd_exnet_console_vip = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_console_vip $vcd_exnet_web_vip = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_web_vip $external_edge_ip = $xml.MasterConfig.EdgeIPConfig.Edge_exnet_ip $vcenter_exnet_ip = $xml.MasterConfig.EdgeIPConfig.vcenter_exnet_ip $vcd_exnet_console_ip1 = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_console_ip1 $vcd_exnet_console_ip2 = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_console_ip2 $vcd_exnet_web_ip1 = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_web_ip1 $vcd_exnet_web_ip2 = $xml.MasterConfig.EdgeIPConfig.vcd_exnet_web_ip2 $vshieldDefaultUser = $xml.MasterConfig.vShieldAppConfig.vshielduser $vShieldDefaultPass = $xml.MasterConfig.vShieldAppConfig.vshieldpass $DC_Terminal_Ipaddress = $xml.MasterConfig.EdgeIPConfig.DC_terminal_ip $DC_Name = $xml.MasterConfig.EdgeIPConfig.DC_Name #vShield API Url $vsm_edge_url = "https://"+$vsmip+"/api/3.0/edges" #Building the headers $auth = $vshieldDefaultUser + ':' + $vShieldDefaultPass $Encoded = [System.Text.Encoding]::UTF8.GetBytes($auth) $EncodedPassword = [System.Convert]::ToBase64String($Encoded) $headers = @{"Authorization"="Basic $($EncodedPassword)";} #Decalre the PUT function Function Calling-Put($url,$Body){ try { Invoke-RestMethod -Headers $headers -Uri $url -Body $Body -Method Put -ContentType Application/xml } catch { $_.Exception Write-Host "Put Failed at - " $url } } #Declare the POST function Function Calling-Post($url,$Body){ try { Invoke-RestMethod -Headers $headers -Uri $url -Body $Body -Method Post -ContentType Application/xml } catch { $_.Exception Write-Host "Post Failed at - " $url } } #Connect to the vcenter where vSM will be deployed Write-host "Connecting to vcenter..." connect-viserver -server $vcenter -protocol https -username $vcenteruser -password $vcenterpassword | Out-Null #Getting the MOID for datacenter, resourcepool, networks and datastore $datastore_full_id = get-cluster $cluster_name | Get-Datastore $edge_datastore | Select-Object -ExpandProperty Id | Out-String $resource_full_id = Get-ResourcePool -Location $cluster_name | Select-Object -ExpandProperty Id | Out-String $datacenter_full_id = get-datacenter $datacentername | Select-Object -ExpandProperty Id | Out-String $internal_network_full_id = get-vdportgroup -Name $internalportgroupname | Select-Object -ExpandProperty Id | Out-String $external_network_full_id = get-vdportgroup -Name $externalportgroupname | Select-Object -ExpandProperty Id | Out-String $heartbeat_network_full_id = Get-VDPortgroup -Name $heartbeatportgroupname | Select-Object -ExpandProperty Id | Out-String #Cleaning up and prepping the variables $datastoremoid = $datastore_full_id.Replace("Datastore-datastore","datastore") $resourcemoid = $resource_full_id.Replace("ResourcePool-resgroup","resgroup") $datacentermoid= $datacenter_full_id.Replace("Datacenter-datacenter","datacenter") $internal_networkmoid = $internal_network_full_id.Replace("DistributedVirtualPortgroup-dvportgroup","dvportgroup") $external_networkmoid = $external_network_full_id.Replace("DistributedVirtualPortgroup-dvportgroup","dvportgroup") $heartbeat_networkmoid = $heartbeat_network_full_id.Replace("DistributedVirtualPortgroup-dvportgroup","dvportgroup") $datastoremoid = $datastoremoid.Trim() $resourcemoid = $resourcemoid.Trim() $datacentermoid = $datacentermoid.Trim() $internal_networkmoid = $internal_networkmoid.Trim() $external_networkmoid = $external_networkmoid.Trim() $heartbeat_networkmoid = $heartbeat_networkmoid.Trim() #Ignore selfsigned cert [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} #Function to deploy the Edge Function Deploy-Edge () { $Body = @" ${datacentermoid} ${edge_app_name} ${edge_app_description} org1 ${edge_app_name} info large ${resourcemoid} ${datastoremoid} 0 <label>vNic0</label> true ${externalportgroupname} uplink ${external_networkmoid} ${externalportgroupname} ${external_edge_ip} ${vcd_exnet_web_vip} ${vcd_exnet_console_vip} 255.255.252.0 1 <label>vNic1</label> true ${internalportgroupname} uplink ${internal_networkmoid} ${internalportgroupname} ${vcd_INTERNAL_web_vip} ${vcd_INTERNAL_console_vip} ${vcenter_INTERNAL_web_vip} ${vcenter_INTERNAL_websvcs_vip} 255.255.248.0 2 <label>vNic2</label> true ${heartbeatportgroupname} Internal ${heartbeat_networkmoid} ${heartbeatportgroupname} admin ${core_root_password} true true high "@ Calling-Post -url $vsm_edge_url -Body $Body } #Function to grab the Edge ID after its deployed - this is needed to configure LB, FW and Edge HA Function Get-Edge-Id(){ [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} $auth = 'Basic ' + [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($vshieldDefaultUser+':'+$vShieldDefaultPass)) #GET all edges $req = [System.Net.WebRequest]::Create($vsm_edge_url) $req.Method ="GET" $req.Headers.add("AUTHORIZATION", $auth); $resp = $req.GetResponse() $reader = new-object System.IO.StreamReader($resp.GetResponseStream()) [xml]$xmloutput = $reader.ReadToEnd() #here you find all edges: foreach($edge in $xmloutput.pagedEdgeList.edgePage.edgeSummary){ if($edge.name -eq $edge_app_name){ return $edge.objectId } } } #Function to check if the Edge is in "deployed" state Function Check-Edge-State(){ [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} $auth1 = 'Basic ' + [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($vshieldDefaultUser+':'+$vShieldDefaultPass)) #GET all edges $req1 = [System.Net.WebRequest]::Create($vsm_edge_url) $req1.Method ="GET" $req1.Headers.add("AUTHORIZATION", $auth1); $resp1 = $req1.GetResponse() $reader1 = new-object System.IO.StreamReader($resp1.GetResponseStream()) [xml]$xmloutput1 = $reader1.ReadToEnd() #here you find all edges: foreach($edge1 in $xmloutput1.pagedEdgeList.edgePage.edgeSummary){ if($edge1.name -eq $edge_app_name){ do { write-host "Waiting for edge to be in deployed state" sleep(10) } until ($edge1.state -eq 'deployed') } } } #Adding Static Routes Function Adding_static_routes(){ $Body = @" 1 ${INTERNAL_network} ${nexthop} 1 ${INTERNAL_network2} ${nexthop} 0 ${gatewayaddr} "@ Calling-Put -URL $url_static_routes -Body $Body } #Adding grouping Objects Function Adding_grouping_objects1(){ $Body = @" Virtual Center NAT INTERNAL IP Virtual Center Nat IP 0 ${vcenter_INTERNAL_web_vip} "@ Calling-post -URL $url_grouping_objects -Body $Body } #Adding more grouping objects Function Adding_grouping_objects2(){ $Body = @" Nat INTERNAL Security Groups ${DC_name} Terminal Servers 0 ${DC_Terminal_Ipaddress} "@ Calling-post -URL $url_grouping_objects -Body $Body } #Getting the FW application ids which need to be used while configuring the fw Function get_fw_app_id(){ [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} $auth = 'Basic ' + [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($vshieldDefaultUser+':'+$vShieldDefaultPass)) #GET all edges $req = [System.Net.WebRequest]::Create($app_scope_url) $req.Method ="GET" $req.Headers.add("AUTHORIZATION", $auth); $resp = $req.GetResponse() $reader = new-object System.IO.StreamReader($resp.GetResponseStream()) [xml]$xmloutput = $reader.ReadToEnd() #Parsing the XML and Grabbing the Application id's here foreach($Appname in $xmloutput.list.application){ if($Appname.name -eq 'ICMP Echo'){ $global:icmp_id = $Appname.objectId } if($Appname.name -eq 'VMware-VC-Webaccess'){ $global:vmware_vc_webaccess_id = $Appname.objectId # return $vmware_vc_webaccess_id } if($Appname.name -eq 'HTTPS'){ $global:https_id = $Appname.objectId #return $https_id } } } #Adding FW rules Function Adding_Firewall_rules(){ $Body = @"  ICMP ${icmp_id} accept true VMware VC WebAccess ${terminal_server_grouping_object_id} ${vcenter_grouping_object_id} ${vmware_vc_webaccess_id} accept true VI Client ${terminal_server_grouping_object_id} ${vcenter_grouping_object_id} ${https_id} accept true "@ Calling-Put -URL $Firewall_url -Body $Body } #Adding HA edge - function setup but not called due to inherent timeout issue vmware investigating Function Adding_HA_Edge(){ $Body = @" 2 6 true "@ Calling-Put -url $HA_url -Body $Body } #LB service enable function but not called due to inherent time out issue vmware investigating Function Enable_LB_Service(){ $Body = @" true true "@ Calling-Put -url $LB_enable_url -Body $Body } ##Adding LB pool functions begin here Function Adding_Edge_LB_Pool1(){ $Body_1 = @"  1 VCENTER-INTERNAL-WEBSERVICES HTTP LEAST_CONN 80 80 HTTP 2 3 5 / 15 TCP LEAST_CONN 443 443 TCP 2 3 5 / 15 ${vcenter_exnet_ip} 1 TCP 443 443 "@ Calling-Post-LB -url1 $LB_pool_url -Body1 $Body_1 } Function Adding_Edge_LB_Pool2(){ $Body = @"  2 VCENTER-INTERNAL-WEBCLIENT HTTPS LEAST_CONN 9443 9443 SSL 2 3 5 / 15 ${vcenter_exnet_ip} 1 HTTPS 9443 9443 "@ Calling-Post-LB -url1 $LB_pool_url -Body1 $Body } Function Adding_Edge_LB_Pool3(){ $Body = @"  3 VCD-INTERNAL-CONSOLE TCP LEAST_CONN 443 443 TCP 2 3 5 / 15 ${vcd_exnet_console_ip1} 1 TCP 443 443 ${vcd_exnet_console_ip2} 1 TCP 443 443 "@ Calling-Post-LB -url1 $LB_pool_url -Body1 $Body } Function Adding_Edge_LB_Pool4(){ $Body = @"  4 VCD-INTERNAL-WEB HTTPS LEAST_CONN 443 443 SSL 2 3 5 / 15 ${vcd_exnet_web_ip1} 1 HTTPS 443 443 ${vcd_exnet_web_ip2} 1 HTTPS 443 443 "@ Calling-Post-LB -url1 $LB_pool_url -Body1 $Body } Function Adding_Edge_LB_Pool5(){ $Body = @"  5 VCD-EXNET-CONSOLE TCP LEAST_CONN 443 443 TCP 2 3 5 / 15 ${vcd_exnet_console_ip1} 1 TCP 443 443 ${vcd_exnet_console_ip1} 1 TCP 443 443 "@ Calling-Post-LB -url1 $LB_pool_url -Body1 $Body } Function Adding_Edge_LB_Pool6(){ $Body = @"  6 VCD-EXNET-WEB HTTPS LEAST_CONN 443 443 SSL 2 3 5 / 15 ${vcd_exnet_web_ip1} 1 HTTPS 443 443 ${vcd_exnet_web_ip2} 1 HTTPS 443 443 "@ Calling-Post-LB -url1 $LB_pool_url -Body1 $Body } #Function to create virtual servers Function Adding_Edge_VS0() { $Body = @"  VCENTER-INTERNAL-PORT902-VIP VCENTER INTERNAL PORT902 VIP ${vcenter_INTERNAL_websvcs_Vip} TCP 902 false INFO 1 "@ Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body } Function Adding_Edge_VS1() { $Body = @"  VCENTER-INTERNAL-WEBSERVICES-VIP VCENTER INTERNAL WEBSVCS VIP ${vcenter_INTERNAL_websvcs_vip} HTTP 80 COOKIE JSESSIONID INSERT TCP 443 false INFO 1 "@ Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body } Function Adding_Edge_VS2() { $Body = @"  VCENTER-INTERNAL-WEB-VIP VCENTER INTERNAL WEB VIP ${vcenter_INTERNAL_web_vip} HTTPS 443 false INFO 2 "@ Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body } Function Adding_Edge_VS3() { $Body = @"  VCD-INTERNAL-CONSOLE-VIP VCD INTERNAL Console VIP ${vcd_INTERNAL_console_vip} TCP 443 false INFO 3 "@ Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body } Function Adding_Edge_VS4() { $Body = @"  VCD-INTERNAL-WEB-VIP VCD INTERNAL WEB VIP ${vcd_INTERNAL_web_vip} HTTPS 443 false INFO 4 "@ Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body } Function Adding_Edge_VS5() { $Body = @"  VCD-EXNET-CONSOLE-VIP VCD ExNet Console VIP ${vcd_exnet_console_vip} TCP 443 false INFO 5 "@ Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body } Function Adding_Edge_VS6() { $Body = @"  VCD-EXNET-WEB-VIP VCD ExNet WEB VIP ${vcd_exnet_web_vip} HTTPS 443 false INFO 6 "@ Calling-Post-LB -url1 $LB_virtualserver_url -Body1 $Body } #I just declared a separate function for this post call Function Calling-Post-LB($url1,$Body1){ $auth1 = $vshieldDefaultUser + ':' + $vShieldDefaultPass $Encoded1 = [System.Text.Encoding]::UTF8.GetBytes($auth1) $EncodedPassword1 = [System.Convert]::ToBase64String($Encoded1) $headers1 = @{"Authorization"="Basic $($EncodedPassword1)";} try {Invoke-RestMethod -Headers $headers1 -Uri $url1 -Body $Body1 -Method Post -ContentType "Application/xml" } catch { $_.Exception write-host $url1 } } #####Deploying the Edge##### #First deploy the Edge Appliances Deploy-Edge #Set the Edge ID of the deployed appliance Check-Edge-State $edge_unique_id = Get-Edge-Id #setting all the URL's here $url_grouping_objects = "https://"+$vsmip+"/api/2.0/services/ipset/"+$edge_unique_id $url_static_routes = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/routing/config" $app_scope_url = "https://"+$vsmip+"/api/2.0/services/application/scope/"+$edge_unique_id $firewall_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/firewall/config" $HA_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/highavailability/config" $LB_pool_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/loadbalancer/config/pools" $LB_enable_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/loadbalancer/config" $LB_virtualserver_url = "https://"+$vsmip+"/api/3.0/edges/"+$edge_unique_id+"/loadbalancer/config/virtualservers" #######Configuration of the Edge Starts here####### Write-host "Creating LB Pools now.." Adding_Edge_LB_Pool1 | Out-Null Adding_Edge_LB_Pool2 | Out-Null Adding_Edge_LB_Pool3 | Out-Null Adding_Edge_LB_Pool4 | Out-Null Adding_Edge_LB_Pool5 | Out-Null Adding_Edge_LB_Pool6 | Out-Null #Creating Edge LB Virtual Servers Write-host "Adding LB Virtual Servers now.." Adding_Edge_VS0 Adding_Edge_VS1 Adding_Edge_VS2 Adding_Edge_VS3 Adding_Edge_VS4 Adding_Edge_VS5 Adding_Edge_VS6 #Add static routes and default routes Write-Host "Adding static routes now.." Adding_static_routes #Adding Object groups and getting the IDs which need to be passed over to create firewall rules Write-host "Creating grouping objects now.." $vcenter_grouping_object_id = Adding_grouping_objects1 $terminal_server_grouping_object_id = Adding_grouping_objects2 #Getting Application ids which need to be passed over to create firewall rules get_fw_app_id #Creating the Firewall rules Write-host "Creating FW rules now.." Adding_Firewall_rules

COMPLETE VSHIELD EDGE DEPLOYMENT AND CONFIGURATION AUTOMATION

Leave a Reply Cancel reply

Post Navigation

Recent Posts

COMPLETE VSHIELD EDGE DEPLOYMENT AND CONFIGURATION AUTOMATION

Leave a Reply Cancel reply

Post Navigation

Follow Us!

Recent Posts