Objective 1.1- Deploy VMware NSX Infrastructure Components

Deploy the NSX Manager Virtual Appliance

Deploying NSX Manager is a straight forward task like deploying any other appliance from ova file. I have already covered the steps of deployment in one of my old post so I am not repeating the steps of deployment again.

Integrate the NSX Manager with vCenter Server

Once NSX Manager is deployed, next task is to integrate it with vCenter server. To do so, login to NSX Manager UI (https://NSX-FQDN) and from home page click on Manage vCenter Registration. 

Under ‘NSX Management Service’, click on edit button for vCenter Server.

vc-nsx-0 Read More

Getting Started With NSX REST API

What is REST API?

if you are new to Rest API and wondering what exactly it is and what do we do using API, then I would recommend reading this article first before moving down further in this post. Also I found this article very useful to understand how Rest API works.

Before starting the topics of objective 8.1, I want to pen down few facts about Rest API.

  • The NSX Manager accepts API requests on TCP port 443 over HTTP application protocol.
  • You need a rest client to execute Rest API calls. There are plenty of clients available such as Postman and CURL (linux based). You can also integrate the Rest client in your browser. For mozilla firefox you can add this extension and for chrome you can add this
  • Rest API’s are usually used when you can’t do something from GUI (because there is no option available) or when you want to automate stuffs using scripting or some other tools.
  • The REST API utilises HTTP requests and allow you to programmatically create, retrieve, modify or delete NSX objects.
  • You can use HTTP GET commands to read and retrieve objects, HTTP PUT or POST to create or update objects and HTTP DELETE to delete objects.

Construct and execute an API call using correct syntax and formatting

There are a couple of things which you need to construct an API request.

1: Basic Authentication: Credentials which the REST client will use to authenticate against NSX manager. This can be NSX admin user or any AD user. Read More

Troubleshoot VMware NSX Edge Services Issues

Troubleshoot VPN service issues

There are 3 types of VPN which you can configure on NSX edges:

  • SSL-VPN Plus
  • IPSec VPN
  • L2 VPN

Lets start with troubleshooting IPSec VPN.

To troubleshoot any VPN issues, you should have knowledge of how to configure a VPN service so that you can verify that issue is not because of a mis-configured settings. To review the implementation and configuration of the IPSec VPN service refer to article

To run troubleshooting commands on the ESG where IPSec VPN service is configured, connect to the edge via SSH.

To view full list of commands for ipsec, run command: show service ipsec ?  Read More

Troubleshoot VMware NSX Connectivity Issues

Monitor and analyze virtual machine traffic with Flow Monitoring

Flow monitoring is used to capture ingress/egress traffic of VM’s in a NSX environment. Flow monitoring is disabled by default and you need to enable it before you can use this tool. Once Flow monitoring is enabled, you need to wait for some time to let this tool gather data about your vSphere environment (much like how vROPS gather data before generating reports/recommendations etc)

Flow monitoring can be enabled by navigating to Networking & Security > Flow Monitoring > Configuration and clicking on Enable.  Read More

Troubleshoot Common VMware NSX Installation/Configuration Issues

Troubleshoot NSX Manager Services

If you are facing any NSX related issues, then NSX manager UI is the first place to verify which service or services are impacted. Typically you can check status of following services from NSX Manager UI (https://NSX-FQDN/login.jsp)

  • vPostgres 
  • RabbitMQ: 
  • NSX Management Service
  • NSX Universal Synchronization Service (Only when you have Cross vCenter NSX Configured)

If any service is in stopped state, try to start or restart it.


You can also check logs from NSX manager CLI to determine what is broken. The two important logs you can check are: NSX Manager log and the System log. These logs can be viwed by firing commands: show log manager & show log system. You can append the word follow to watch the logs in real time (similar to linux tail command) Read More

Configure and Manage Universal Logical Security Objects in NSX

Configure Universal MAC Sets

In NSX version lower than 5.4, Mac sets can be created by navigating to Networking and Security, Select the Primary NSX Manager > Manage > Grouping Objects > MAC Sets.

In NSX 6.4 this is available under Networking & Security > Groups and Tags > MAC Sets.

Click on + button to add a new MAC Set.


Provide a name for the MAC set and add the mac addresses that will be part of the universal MAC set. Make sure to check mark the option “Mark this object for Universal Synchronisation”. Read More

Configuring VMware Cross vCenter NSX-Part 2

Create/configure Universal Logical Switches (ULS)

Any Logical Switches created in a Universal Transport Zone are Universal Logical Switches and it provides Layer 2 connectivity across VC boundaries. You can connect 2 VM’s that are running in different vCenter instance to a ULS and can ping across.

Universal Logical Switches can only be created on the Primary NSX Manager and once created, they are Synced to secondary NSX Manager . 

To create a universal LS, login to vCenter Web Client and navigate to Networking & Security > Logical Switches and select Primary NSX manager from the drop down and click on + button. Read More

Configuring VMware Cross-vCenter NSX

What is Cross vCenter NSX?

Cross-vCenter NSX feature was introduced in NSX 6.2 and it allows central management of network virtualization and security policies across multiple vCenter Server systems. In a cross-vCenter NSX environment, you can have multiple vCenter Servers, each of which must be paired with its own NSX Manager. One NSX Manager is assigned the role of primary NSX Manager, and the others are assigned the role of secondary NSX Manager.

Cross vCenter NSX components

Cross vCenter NSX introduces universal objects; such as: Read More

Configure Role Based Access Control in NSX

Role Based Access Control is a mechanism for controlling access and restricting actions of users by adding user accounts to groups that have delegated permissions. The NSX Manager has its own authentication database and permission roles you can assign to users.

In this post we will learn how to configure role based access in NSX. 

Implement identity service support for Active Directory, NIS, and LDAP with SSO

To be frank this topic is very confusing and I am not sure what VMware intends us to do here. One use case of associating NSX with Active Directory is that you can use identity based firewall. And may be associating NSX with AD is what VMware might meant by this topic. Read More

Monitor a VMware NSX Implementation

Configure logging for NSX components according to a deployment plan

1: Configure Syslog on NSX Manager

To configure NSX manager to send logs to a centralized syslog server, login to NSX manager UI and click on “Manage Appliance Settings”


Under Syslog server click on Edit button


Punch in your syslog server IP and port 514 and select UDP as protocol and hit OK.


Post configuring syslog on NSX manager, I verified that it is forwarding the logs to syslog manager.


Configure Syslog on NSX Controllers

There is no method available from GUI to set syslog settings on NSX controller and you can only set it via Rest API. The steps of configuring syslog on controllers via Rest API is explained on page 57 of NSX API Guide Read More

Backup and Restore NSX Manager

Like any other infrastructure componet, backup of NSX manager is very critical as it helps in recovering configuration in event of a NSX manager corruption/failure etc.

Before software defined networking was introduced, backup of network configuration was a very cumbersome task as you have many components to backup such as Routers, Switches,Firewalls and what not. 

With introduction of NSX, all the networking intelligence were injected in NSX and this reduced the administrative overhead of backing up each networking components individually. With NSX you only have to worry about backing up NSX manager and the vDS at vCenter level which stores all your virtualwires. In this post we will learn how to backup NSX manager and distributed switches. Read More

Configure and Manage NSX Edge Gateway Services (DHCP, DNS and NAT)

In this post I will be covering objective 3.3 of VCAP6-NV Deploy exam and we will discuss about following topics:

  • Configure DHCP services according to a deployment plan:
    • Create/edit a DHCP IP Pool
    • Create/edit DHCP Static Binding
    • Configure DHCP relay
    Configure DNS services Configure NAT services to provide access to services running on privately addressed virtual machines

    Lets get started.

    Configure DHCP services on NSX Edge

    NSX Edge Service Gateway provides IP addressing  using static address and via DHCP. In general any DHCP server needs a pool of IP which can be distributed to clients which boots over network and ask for IP via DHCP. Edge gateway is not different. Edge gateway DHCP can provide IP address, default gateway, netmask and DNS server to the DHCP clients which boots over network. Read More

Configure and Manage L2 VPN in NSX

What is L2 VPN?

From VMware NSX Administration Guide

With L2 VPN, you can stretch multiple logical networks (both VLAN and VXLAN) across geographical sites. Virtual machines remain on the same subnet when they are moved between sites and their IP addresses do not change.

L2 VPN thus allows enterprises to seamlessly migrate workloads backed by VXLAN or VLAN between physically separated locations. For cloud providers, L2 VPN provides a mechanism to on-board tenants without modifying existing IP addresses for workloads and applications. Read More

Configure and Manage SSL VPN in NSX

SSL VPN on NSX Edge Gateway allows end-user to connect to a private network through a SSL-VPN tunnel so that the end-user can access the application/services which are hosted on remote site, on their local network. Application/services can be accessed via Web-based SSL client or a regular client. 

Below image taken from NSX Administration Guide demonstrates the process of connecting to private network via SSL-VPN


                                           Graphic Thanks to VMware Read More

Configure and Manage IPSec VPN in NSX

NSX Edge Services Gateway supports site to site IPSec VPN. You can create IPSec VPN between an ESG and any other network device (hardware/software) which supports IPSec or you can have ESG at both source and target site for this purpose. 

Using IPSec VPN, you can create a secure connection between two sites and route the internal subnets between those two sites. Just ensure you don’t have an overlapping subnets behind the edge gateway. You can create more than one IPSec tunnel on ESG and number of tunnels is directly dependent on size of NSX edge.  Read More