Create a Dynamic Security Group in a Data Center Group with NSX Network Provider Type

You can define dynamic security groups of virtual machines based on specific criteria to which to apply distributed firewall rules.

Procedure

In the top navigation bar, click Networking and then click the Data Center Groups tab.
The list of data center groups appears.
Click the target data center group.
Under Security, click Dynamic Groups and click New.
Enter a name and, optionally, a description for the dynamic security group.

To create a criterion for inclusion in the group, add up to four rules that apply either to a VM name or to a VM security tag.

Option	Description
VM name	You can create a rule that applies to VM names which contain or start with a term that you specify. From the drop-down menu for the rule type, select VM name. Select an operator for the rule. Select Containsto apply the rule to VM names that contain a specific term. Select Starts with to apply the rule to VM names that start with a specific term. Enter the defining term for the rule.
VM tag	You can create a rule that applies to VM tags which equal, contain, start with, or end with a term that you specify. From the drop-down menu for the rule type, select VM tag. Select an operator for the rule. To apply the rule to VM tags that are equal to a specific term, select Equals. To apply the rule to VM tags that start with a specific term, select Starts with. To apply the rule to VM tags that end with a specific term, select Ends with. To apply the rule to VM tags that contain a specific term, select Contains. Enter the defining term for the rule.

Option

Description

VM name

You can create a rule that applies to VM names which contain or start with a term that you specify.

From the drop-down menu for the rule type, select VM name.
Select an operator for the rule.
- Select Containsto apply the rule to VM names that contain a specific term.
- Select Starts with to apply the rule to VM names that start with a specific term.
Enter the defining term for the rule.

VM tag

You can create a rule that applies to VM tags which equal, contain, start with, or end with a term that you specify.

From the drop-down menu for the rule type, select VM tag.
Select an operator for the rule.
- To apply the rule to VM tags that are equal to a specific term, select Equals.
- To apply the rule to VM tags that start with a specific term, select Starts with.
- To apply the rule to VM tags that end with a specific term, select Ends with.
- To apply the rule to VM tags that contain a specific term, select Contains.
Enter the defining term for the rule.

To add another criterion, click Add Criterion and add up to four rules to it.
You can include up to three criteria in a dynamic security group.
Click Save.

What to do next

You can use the dynamic group that you created to add distributed firewall rules to the data center group or to add firewall rules to an NSX edge gateway that is scoped to the data center group. See: