This server provides 20 tools for managing VMware NSX distributed firewall (DFW) microsegmentation, security groups, VM tags, packet tracing, and intrusion detection (IDPS).

DFW Policy Management

• List, get, create, update (partial PATCH), and delete DFW security policies (category, priority, stateful settings)

• Delete includes a safety check: rules must be removed first

DFW Rule Management

• List, create, update, and delete rules within a policy

• Full control over sources, destinations, services, action (ALLOW/DROP/REJECT/JUMP_TO_APPLICATION), direction, and logging

• Retrieve per-rule statistics (packet count, byte count, session count)

Security Group Management

• List, get, create, and delete NSX security groups

• Membership criteria: VM tags (scope/value), IP addresses/CIDRs, or segment paths

• Get effective VM members (up to 50); delete blocked if group is referenced by DFW rules

VM Tag Management

• List NSX tags on a VM by display name

• Additively apply a tag (scope + value) to a VM by external ID (existing tags preserved)

Traceflow (Packet Tracing)

• Inject a synthetic probe packet from a source logical port and trace hop-by-hop through the NSX overlay, showing DFW rule hits and drop reasons

• Retrieve status and observations of a previously initiated traceflow

IDPS (Intrusion Detection & Prevention)

• List configured IDPS profiles (severity, criteria, signature overrides)

• Check global IDPS engine status: enable/disable state, signature version, last update, and per-node status

Provides tools for managing VMware NSX security, including distributed firewall (DFW) policies and rules, security groups, VM tags, Traceflow packet tracing, and Intrusion Detection and Prevention Systems (IDPS).