“Security cannot be an afterthought added after infrastructure is deployed. Security rules must be injected automatically on Day 0.”

At NTT Data, we created automated Day-0 Firewall Rule Injection pipelines using the NSX-T Policy API.

Day-0 Compliance Injection

Whenever a new segment is created by an automated pipeline, an automated hook applies mandatory security baseline rules:

• Block Inbound SSH from Untrusted Subnets.
• Allow Internal Monitoring & Log Ingestion Telemetry.
• Restrict Cross-Tenant Inter-VLAN Routing.

// # NSX-T Policy API Day-0 Rule Payload
{
  "display_name": "Day-0-Default-Sec-Baseline",
  "sequence_number": 10,
  "rules": [
    {
      "display_name": "Allow-NTP-Telemetry",
      "action": "ALLOW",
      "services": ["/infra/services/NTP"]
    }
  ]
}

The Verdict

Key Takeaway

Inject Security Baselines at Provisioning Time.

Ensure newly provisioned logical networks automatically inherit Day-0 Security Rules at instantiation to guarantee continuous compliance.