Programmatic Deletion of Inactive NSX Firewall Rules via Policy API IN in VCF Operations for Networks

Products

• VCF Operations for Networks

Issue/Introduction

When using VCF Operations for Networks to identify a large volume of inactive firewall rules (e.g., zero hit counts over 30 days), manual deletion through the NSX Manager UI is time-consuming and prone to human error. Use the NSX Policy API to remove these unused policies programmatically.

 

Environment

VCF Operations for Networks 6.13.x
VCF Operations for Networks 6.14.x
NSX 4.x

Resolution

For a large dataset of unused rules, use the NSX Policy API to perform deletions. Sequential processing is required to avoid API conflicts.

Prerequisites

1. Identify Targets: Run the following query in VCF Operations for Networks: nsx firewall rule where flow is not set.
2. Export Data: Export the results to a CSV file to obtain the Policy ID and Rule ID for each entry.

API Deletion Method

Warning: This command makes changes to your system. Review the targeted Rule IDs carefully before execution.

1. Identify the Endpoint: DELETE https://<nsx-manager-ip>/policy/api/v1/infra/domains/<domain-id>/security-policies/<policy-id>/rules/<rule-id>

   1. Note: The default <domain-id> is typically default. In multi-tenant architectures, replace this with the specific Domain ID.
2. Process Deletions Sequentially: Deleting a rule modifies the parent section. If you attempt concurrent updates on the same section, the API may return an HTTP 409 Conflict. Ensure your script or automation tool iterates through the list one by one.
3. Handle Version Mismatches: If you encounter Error code 500071 ("Has a different version than the current system version"), fetch the latest copy of the policy object or perform a minor edit (like toggling logging) before retrying the deletion (KB_398656).
4. Licensing Check: If the NSX Manager license is expired, you must use the DELETE API as the UI (which uses PATCH) will fail with Error code 500157 (KB_404131).

Important Considerations

1. Sequential Processing: Deleting a rule modifies the parent section. If you attempt concurrent updates on the same section, the API may return an HTTP 409 Conflict.
2. Version Mismatch: If you encounter Error code 500071 ("Has a different version than the current system version"), fetch the latest copy of the policy object or perform a minor edit (like toggling logging) before retrying the deletion KB 398656.
3. Licensing: If the NSX Manager license is expired, you must use the DELETE API as the UI (which uses PATCH) will fail with Error code 500157 KB 404131.