nsx api guide 6 - docs.vmware.com · nsx api guide version: 6.4 page 2 table of contents...

NSX API GuideUpdate 8

Modified DEC 2018

VMware NSX Data Center for vSphere 6.4

Page 1

NSX API Guide Version: 6.4 Page 2

Table of Contents14Introduction

18Endpoints

18Working With vSphere Distributed Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Working With vSphere Distributed Switches in a Datacenter

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20Working With a Specific vSphere Distributed Switch

22Working With Segment ID Pools and Multicast Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Working With Segment ID Pools

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23Working With a Specific Segment ID Pool

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Working With Multicast Address Ranges

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Working With a Specific Multicast Address Range

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Working With the VXLAN Port Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Update the VXLAN Port Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27VXLAN Port Configuration Update Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Resume VXLAN Port Configuration Update

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Working With Allocated Resources

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Resolving Missing VXLAN VMKernel Adapters

30Working With Controller Disconnected Operation (CDO) Mode

32Working With Transport Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Working With a Specific Transport Zone

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Working With Transport Zone Attributes

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Working With Transport Zone CDO Mode

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Testing Multicast Group Connectivity

41Working With Logical Switches in a Specific Transport Zone

42Working With Traceflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42Working With a Specific Traceflow

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43Traceflow Observations

47Working With Logical Switches in All Transport Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Working Virtual Machine Connections to Logical Switches

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Working With a Specific Logical Switch

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51Resolving Missing Port Groups for a Logical Switch

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52Testing Host Connectivity

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52Testing Point-to-Point Connectivity

. . . . . . . . . . . . . . . . . . . . 53Working With Hardware Gateway Bindings for a Specific Logical Switch

. . . . . . . . . . . . . . . 54Working With Connections Between Hardware Gateways and Logical Switches

56Working With IP Discovery and MAC Learning for Logical Switches

58Working With NSX Controllers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Working With Controller Upgrade Availability

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Working With of Controller Job Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Working With a Specific Controller

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61Working With NSX Controller System Statistics


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63Working With Controller Tech Support Logs

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63Working With Controller Syslog Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65Working With Controller Cluster Snapshots

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65Working With the NSX Controller Cluster Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66Working With Controller Cluster NTP Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67Working With Controller Cluster DNS Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68Working With Controller Cluster Syslog Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Working With the NSX Controller Password

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Working With Controller Synchronization

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Working with Controller Synchronization Status

72Working With Hypervisor Tunnel Health Status Using BFD . . . . . . . . . . . . . . . . . . . . . . . 72Working with overall information about tunnel health of a hypervisor

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73Working with tunnel health status for a specific host

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74Working with tunnel connections for a specific host

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75Working with remote host status

77Working With BFD Configuration Information

79Working With pNIC Configuration Information

81Working With Services Grouping Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81Retrieve Services from a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81Create a Service on a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81Working With a Specified Service

84Working With Service Groups Grouping Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84Creating Service Groups on a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84Working With Service Groups on a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84Working With a Specific Service Group

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86Working With a Specific Service Group Member

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 86Working With Service Group Members on a Specific Scope

87Working With IP Pool Grouping Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87Working With IP Pools on a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88Working With a Specific IP Pool

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90Working With IP Pool Address Allocations

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91Working With Specific IPs Allocated to an IP Pool

92Working With Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92Working With Licensing Capacity

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93Working With Licensing Status

94Working With Security Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94Managing Security Tags

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96Delete a Security Tag

. . . . . . . . . . . . . . . . . . . . . . . . . . . 96Working With Virtual Machines on a Specific Security Tag

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97Manage a Security Tag on a Virtual Machine

. . . . . . . . . . . . . . . . . . . . . . . 98Working With Virtual Machine Details for a Specific Security Tag

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 99Working With Security Tags on a Specific Virtual Machine

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 100Working With Security Tags Unique ID Selection Criteria


102Working With NSX Manager SSO Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102Working With SSO Configuration Status

103Working With User Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103Manage Users on NSX Manager

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103Working With User Account State

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103Manage NSX Roles for Users

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105Working With NSX Manager Role Assignment

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105Working With Available NSX Manager Roles

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105Working With Scoping Objects

107Working with API Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107Working with Basic Authentication

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108Working with API Tokens

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108Working With API Token Expiration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109Working With Token Invalidation

111Working with API Authentication

112Working With Security Group Grouping Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112Creating New Security Groups With Members

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114Creating New Security Groups Without Members

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 115Updating a Specific Security Group Including Membership

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116Working With a Specific Security Group

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117Working With Members of a Specific Security Group

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118Working With Virtual Machines in a Security Group

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Working With IP Addresses in a Security Group

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Working With MAC Addresses in a Security Group

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Working With vNICs in a Security Group

. . . . . . . . . . . . . . . . . . . . . . . . . . . 119Working With Virtual Machine Security Group Membership

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120Working With IP Address in a Security Group

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121Working With Internal Security Groups

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121Working With Security Groups on a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122Working With Security Group Member Types

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122Working With a Specific Security Group Member Type

123Working With IP Set Grouping Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123Working With IP Sets on a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123Creating New IP Sets

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123Working With a Specific IP Set

125Configuring NSX Manager with vCenter Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126Connection Status for vCenter Server

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126Working with vCenter Server Connection

127Configuring Index Maintainance

129Configuring the High CPU Usage Reporting Tool

131Working with the CPU Usage Monitoring Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131Working With CPU Usage Indicator

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131Working With CPU Usage Details


133Working With Universal Sync Configuration in Cross-vCenter NSX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133Working With Universal Sync Configuration Roles

. . . . . . . . . . . . . . . . . . . . . . . . . . 133Working With Universal Sync Configuration of NSX Managers

. . . . . . . . . . . . . . . . . . . . . . . . . . . 134Universal Sync Configuration of a Specific NSX Manager

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135NSX Manager Synchronization

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135Working With Universal Sync Entities

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135Working With Universal Sync Status

136Working With the Appliance Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136Global Information for NSX Manager

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136Summary Information for NSX Manager

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137Component Information for NSX Manager

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139Reboot NSX Manager

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139NSX Manager Appliance CPU Information

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140NSX Manager Appliance CPU Details

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140NSX Manager Appliance Uptime Information

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141NSX Manager Appliance Memory Information

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141NSX Manager Appliance Storage Information

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141NSX Manager Appliance Network Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143Working With DNS Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143Working With Security Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144Working With TLS Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145Working With Time Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146Working With NTP Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146Configure System Locale

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147Working With Syslog Server

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148Working With Multiple Syslog Servers

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149Working With Components

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151Working With a Specific Component

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151Working With Component Dependencies

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152Working With Component Dependents

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152Working With Component Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153Toggle Component Status

. . . . . . . . . . . . . . . . . . . . . . . . . . 153Working With the Appliance Management Web Application

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153NSX Manager Appliance Backup Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156NSX Manager Appliance Backup FTP Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156NSX Manager Appliance Backup Exclusion Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157NSX Manager Appliance Backup Schedule Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157NSX Manager Appliance On-Demand Backup

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158Working With NSX Manager Appliance Backup Files

. . . . . . . . . . . . . . . . . . . . . . . . . . 158Restoring Data from an NSX Manager Appliance Backup File

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159Working With Tech Support Logs by Component

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159Working With Tech Support Log Files

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159Working With Support Notifications

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159Acknowledge Notifications

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160Upgrading NSX Manager Appliance

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160Upload an NSX Manager Upgrade Bundle

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160Upload an NSX Manager Upgrade Bundle from URL

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161Prepare for NSX Manager Upgrade


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162Start the NSX Manager Upgrade

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163NSX Manager Upgrade Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 163Working With Certificates on the NSX Manager Appliance

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163Working With Keystore Files

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164NSX Manager Certificate Manager

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164Working With Certificate Signing Requests

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165Working With Certificate Chains

167Working with NSX Manager Debug APIs

168Working With NSX Manager System Events

170Working with Host Event Notifications

171Working With NSX Manager Audit Logs

173Working With the VMware Customer Experience Improvement Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173Working With the VMware CEIP Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174Working With Proxy Setting for VMware CEIP

176Working With Network Fabric Configuration . . . . . . . . . . . . . . . . . . . . . . . . . 176Working With Network Virtualization Components and VXLAN

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180Resolving Host Preparation Issues

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180Working With Network Fabric Features

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180Working With Network Fabric Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 182Working With Network Fabric Status of Child Resources

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183Working With Status of Resources by Criterion

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185Working With Locale ID Configuration For Clusters

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186Working With Locale ID Configuration for Hosts

187Working With Security Fabric and Security Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188Working With a Specified Service

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189Working With Service Dependencies

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189Working With Installed Services on a Cluster

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191Working With a Specific Service on a Cluster

192Working With Data Collection for Activity Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . 192Working With Data Collection on a Specific Virtual Machine

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192Override Data Collection

. . . . . . . . . . . . . . . . . . . . . . 193Retrieve Data Collection Configuration for a Specific Virtual Machine

195Working With Activity Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195Working With Aggregated User Activity

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197Working With User Details

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199Working With a Specific User

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199Working With Applications

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200Working With a Specific Application

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200Working With Discovered Hosts

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200Working With a Specific Discovered Host

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200Working With Desktop Pools

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201Working With a Specific Desktop Pool

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201Working With Virtual Machines


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201Working With a Specific Virtual Machine

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201Working With LDAP Directory Groups

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202Working With a Specific LDAP Directory Group

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 202Working With a Specific User's Active Directory Groups

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202Working With Security Groups

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202Working With a Specific Security Group

204Working With Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204Registering Domains

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206Retrieve LDAP Domains

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206Delete a Specific Domain

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206Working with Root Distinguished Names

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207Delete DomainRootDN

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208Create LDAP Server

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208Query LDAP Servers for a Domain

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208Update AD Sync Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209Start LDAP Full Sync

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209Start LDAP Delta Sync

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210Delete LDAP Server

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210EventLog Server

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210Working With EventLog Servers for a Domain

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210Delete EventLog Server

212Working With Mapping Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212Working With User to IP Mappings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212Working With Host to IP Mappings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212Working With IP to User Mappings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213Working With User Domain Groups

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214Working With a Specific Static User Mapping

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214Working With Static User Mappings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 214Working With Static User IP Mappings for a Specific User

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215Working With Static User IP Mappings for a Specific IP

216Working With Activity Monitoring Syslog Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216Enable Syslog Support

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216Disable Syslog Support

217Working With Solution Integrations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217Working With Agents on a Specific Host

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218Working With a Specific Agent

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219Working With Agents on a Specific Deployment

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220Working With Conflicting Agencies

222Working With MAC Address Set Grouping Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222Working With a Specific MAC Address Set

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223Working With MAC Address Sets on a Specific Scope

226Working With ESX Agent Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226Working With EAM Status

227Working With Alarms


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230Working With a Specific System Alarm

232Working With Alarms from a Specific Source

235Working With System Scale (Capacity Parameter) Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235System Scale (Capacity Parameter) Dashboard Report

. . . . . . . . . . . . . . . . . . . . . . . . . . . 236System Scale (Capacity Parameter) Dashboard Threshold

238Working With Custom Dashboard Widget . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248Working With a Specific Widget

252Working With the Task Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252Working With a Specific Job Instance

253Working With Guest Introspection and Third-party Endpoint Protection (Anti-virus)Solutions

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 253Register a Vendor and Solution with Guest Introspection

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 254Working With Registered Guest Introspection Vendors

. . . . . . . . . . . . . . . . 254Working With Guest Introspection Vendors and Endpoint Protection Solutions

. . . . . . . . . . . . . . . . . . . . . . . . . 255Information About Registered Endpoint Protection Solutions

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 255Endpoint Protection Solution Registration Information

. . . . . . . . . . . . . . . . . . . . . . . . . . 256IP Address and Port For an Endpoint Protection Solution

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257Activate an Endpoint Protection Solution

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258Activated Security Virtual Machines

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258Activate a Registered Endpoint Protection Solution

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259Working With Solution Activation Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . 260Working With Guest Introspection SVM Health Thresholds

262Working With Distributed Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262Default Firewall Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262Working with Distributed Firewall Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267Working With Layer 3 Sections in Distributed Firewall

. . . . . . . . . . . . . . . . . . . . . . . . . 271Working With a Specific Layer 3 Distributed Firewall Section

. . . . . . . . . . . . . . . . . . . . . . . . 276Working With Distributed Firewall Rules in a Layer 3 Section

. . . . . . . . . . . . . . . . . . . . . . . . 278Working With a Specific Rule in a Specific Layer 3 Section

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279Working With Layer 2 Sections in Distributed Firewall

. . . . . . . . . . . . . . . . . . . . . . . . . 281Working With a Specific Layer 2 Distributed Firewall Section

. . . . . . . . . . . . . . . . . . . . . . . . 284Working With Distributed Firewall Rules in a Layer 2 Section

. . . . . . . . . . . . . . . . . . . . . . . . 285Working With a Specific Rule in a Specific Layer 2 Section

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287Layer 3 Redirect Sections and Rules

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288Layer 3 Redirect Section

. . . . . . . . . . . . . . . . . . . . . . . . 289Working With Layer 3 Redirect Rules for a Specific Section

. . . . . . . . . . . . . . . . . . . 290Working With a Specific Layer 3 Redirect Rule for a Specific Section

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291Service Insertion Profiles and Layer 3 Redirect Rules

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291Enable Distributed Firewall After Upgrade

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292Working With Distributed Firewall Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294Working With a Specific Layer 3 Section Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294Working With a Specific Layer 2 Section Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294Import and Export Firewall Configurations

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295Working With a Specific Saved Firewall Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296Export a Firewall Configuration


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297Import a Firewall Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298Working With Distributed Firewall Session Timers

. . . . . . . . . . . . . . . . . . . 300Working With a Specific Distributed Firewall Session Timer Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302Working With Distributed Firewall Event Thresholds

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303Working With Distributed Firewall Thresholds

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305Working With Distributed Firewall Rule Hit Counts

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306Working with Rule Hit Counts for a Specific Rule

. . . . . . . . . . . . . . . . . . . . . . . . . . . 306Working With the Distributed Firewall Global Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . 307Working With the Distributed Firewall Universal Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308Synchronize Firewall

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308Enable Firewall

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308Working With IPFIX

. . . . . . . . . . . . . . . . . . . . . . . . . . . 309Distributed Firewall State Realization for Grouping Objects

312Working With SpoofGuard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312Working With SpoofGuard Policies

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312Working With a Specific SpoofGuard Policy

. . . . . . . . . . . . . . . . . . . . . . 313Perform SpoofGuard Operations on IP Addresses in a Specific Policy

315Working With Flow Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315Working With Flow Monitoring Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316Working With Flow Monitoring Meta-Data

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317Working With Flow Monitoring Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319Working With Flow Configuration for a Specific Context

320Exclude Virtual Machines from Firewall Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321Working With the Exclusion List

323Working With NSX Edge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333Working With a Specific NSX Edge

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338Working With DNS Client Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338Working With AESNI

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339Working With Core Dumps

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339Working With FIPS on NSX Edge

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340Working With NSX Edge Logs

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340Working With NSX Edge Summary

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347Working With NSX Edge Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349Working With NSX Edge Health Summary

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351Working With NSX Edge Tech Support Logs

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352Working With NSX Edge CLI Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353Working With NSX Edge Remote Access

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 353Working With NSX Edge System Control Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354Working With NSX Edge Firewall Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357Working With Firewall Rules

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358Working With a Specific Firewall Rule

. . . . . . . . . . . . . . . . . . . . . . . . . . 359Working With the NSX Edge Global Firewall Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361Working With the Default Firewall Policy for an Edge

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361Working With Statistics for a Specific Firewall Rule

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361Working With NAT Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366Working With NAT Rules


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367Working With a Specific NAT Rule

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368Working With the NSX Edge Routing Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377Working With the NSX Edge Global Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379Working With Static and Default Routes

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380Working with Static Routes for a Specific Network

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382Working With OSPF Routing for NSX Edge

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386Working With BGP Routes for NSX Edge

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389Working With Multicast Routing

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392Working With GRE Tunnels

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396Working With a Specific GRE Tunnel

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398Working With Layer 2 Bridging

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399Working With NSX Edge Load Balancer

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407Working With Application Profiles

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409Working With a Specific Application Profile

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410Working With Application Rules

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411Working With a Specific Application Rule

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412Working With Load Balancer Monitors

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414Working With a Specific Load Balancer Monitor

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415Working With Virtual Servers

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416Working With a Specific Virtual Server

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417Working With Server Pools

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420Working With a Specific Server Pool

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421Working With a Specific Load Balancer Member

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422Working With Load Balancer Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425Working With Load Balancer Acceleration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426Working With NSX Edge DNS Server Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427Get DNS server statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428Configure DHCP for NSX Edge

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432Working With DHCP IP Pools

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433Working With a Specific DHCP IP Pool

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433Working With DHCP Static Bindings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435Working With a Specific DHCP Static Binding

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436Working With DHCP Relays

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438Working With DHCP Leases

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438Working With NSX Edge High Availability

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440Working With Remote Syslog Server on NSX Edge

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441Working With SSL VPN

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442Working With SSL VPN Server

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442Working With Private Networks

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 443Working With a Specific Private Network

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444Working With IP Pools for SSL VPN

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446Working With a Specific IP Pool for SSL VPN

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447Working With Network Extension Client Parameters

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448Working With SSL VPN Client Installation Packages

. . . . . . . . . . . . . . . . . . . . . . . 449Working With a Specific SSL VPN Client Installation Package

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450Working With Portal Layout

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451Working With Image Files for SSL VPN

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452Working With Portal Users


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453Working With a Specific Portal User

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453Working With Authentication Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455Working With the RSA Config File

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455SSL VPN Advanced Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456Working With Logon and Logoff Scripts for SSL VPN

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457Working With Uploaded Script Files

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458Uploading Script Files for SSL VPN

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459Working With SSL VPN Users

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459Working With Active Client Sessions

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459Working With a Specific Active Client Session

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 460Working With NSX Edge Firewall Dashboard Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461Working With SSL VPN Dashboard Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461Working With Tunnel Traffic Dashboard Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461Working With Interface Dashboard Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462Working With Interface Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463Working With Uplink Interface Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464Working With Internal Interface Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464Working With L2 VPN Over SSL

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469Working With L2 VPN Over SSL Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470Working with L2 VPN Over IPSec

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472Working With L2 VPN Tunnels

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473Working With a Specific L2 VPN Tunnel

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475Working With Peer Codes for L2 VPN over IPSec

. . . . . . . . . . . . . . . . . . . . . . . . . 476Working With Global Configuration for L2 VPN Over IPSec

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477Working With IPSec VPN

. . . . . . . . . . . . . . . . . . . . . . . . . . 483Downloading IPSec VPN and BGP Neighbor Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486Working With IPSec VPN Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489Automatic Configuration of Firewall Rules

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490Working With NSX Edge Appliance Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . 493Working With NSX Edge Appliance Configuration by Index

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495Working With Edge Services Gateway Interfaces

. . . . . . . . . . . . . . . . . . . . . . . . . . 496Working With a Specific Edge Services Gateway Interface

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498Working With a Sub-Interface of a Backing Type

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500Creating a Sub-Interface of a Backing Type

. . . . . . . . . . . . . . . . . . . . . . . . . . . 501Working With Logical Router HA (Management) Interface

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501Working With Logical Router Interfaces

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503Working With a Specific Logical Router Interface

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503Configuring Edge Services in Async Mode

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504Working With a Specific Edge Job Status

506Working With NSX Edge Configuration Publishing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506Working With NSX Edge Tuning Configuration

508Working With Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508Working With Certificates and Certificate Chains

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508Working With Certificate Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509Working With Certificates on a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509Working With Self-Signed Certificates

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510Working With a Specific Certificate


. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510Working With Certificate Signing Requests

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511Working With Self-Signed Certificate for CSR

. . . . . . . . . . . . . . . . . . . . . . . . . 512Working With Certificate Signing Requests on a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . 512Working With Certificate Revocation Lists on a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 512Working With CRL Certificates in a Specific Scope

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513Working With a Specific CRL Certificate

514Working With Service Composer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515Working With Security Policies

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 517Working With all Security Policies

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521Working With a Specific Security Policy

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524Working With Security Group Bindings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525Working With Security Actions on a Security Policy

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525Working with Service Composer Policy Precedence

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525Working With Service Composer Status

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526Working With All Service Composer Alarms

. . . . . . . . . . . . . . . . . . . . . . . . . 527Working With Service Composer Firewall Applied To Setting

. . . . . . . . . . . . . . . . . . . . . . . 528Working With Service Composer Configuration Import and Export

. . . . . . . . . . . . . . . . . . . . . . . . . . 529Working With Virtual Machines with Security Actions Applied

. . . . . . . . . . . . . . . . . . . . . . . . . 530Working With Security Actions Applicable on a Security Group

. . . . . . . . . . . . . . . . . . . . . . . . . 534Working With Security Actions Applicable on a Virtual Machine

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535Working With Service Composer Firewall

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536Working With Service Composer Firewall Information

. . . . . . . . . . . . . . . . . . . . . . . . . . . 536Working With Security Policies Mapped to a Security Group

540Working With SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540Working With SNMP Status Settings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541Working With SNMP Managers

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542Working With a Specific SNMP Manager

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543Working With SNMP Traps

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 544Working With a Specific SNMP Trap

546Working With Translation of Virtual Machines to IP Addresses

547Working With Support Bundle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 548Status of the Technical Support Bundle

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550Download Support Bundle

551Working With the Central CLI

552Communication Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552Communication Status of a Specific Host

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552Communication Status of a List of Hosts

554Working With Hardware Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555Working With a Specific Hardware Gateway

. . . . . . . . . . . . . . . . . . . . . . . . . . . 557Working With Switches on a Specific Hardware Gateway

. . . . . . . . . . . . . . . . . . . . . . 557Working With a Specific Switch on a Specific Hardware Gateway

. . . . . . . . . . . . . . . . . 557Working With Ports on a Specific Switch on a Specific Hardware Gateway

. . . . . . . . . . . . . . . . . . . . . . . . . . . . 558Working With All Hardware Gateway Replication Clusters

. . . . . . . . . . . . . . . . . . . . . . . . . 559Working With a Specific Hardware Gateway Replication Cluster


563Working With Hardware Gateway Bindings and BFD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563Working With Hardware Gateway Bindings

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564Working With a Specific Hardware Gateway Binding

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565Working With Hardware Gateway Binding Statistics

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565Working With Hardware Gateway Binding Objects

. . . . . . . . . . . . . . . . . . 566Working With Hardware Gateway BFD (Bidirectional Forwarding Detection)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567Working With Hardware Gateway BFD Configuration

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567Working With Hardware Gateway BFD Tunnel Status

570Appendix


IntroductionThis manual, the NSX API Guide, describes how to install, configure, monitor, and maintain the VMware NSX DataCenter for vSphere system by using REST API requests.

Important: NSX for vSphere is now known as NSX Data Center for vSphere.

Intended AudienceThis manual is intended for anyone who wants to use the REST API to programmatically control an NSX Data Centerfor vSphere environment. The information in this manual is written for experienced developers who are familiar withvirtual machine technology, virtualized datacenter operations, and REST APIs. This manual also assumes familiaritywith NSX Data Center for vSphere.

VMware Technical Publications GlossaryVMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For definitions of terms asthey are used in VMware technical documentation go to http://www.vmware.com/support/pubs.

Technical Documentation and Product UpdatesYou can find the most up-to-date technical documentation on the VMware Web site at:http://www.vmware.com/support/.

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to: .

Using the NSX REST APITo use the NSX REST API, you must configure a REST client, verify the required ports are open between your RESTclient and the NSX Manager, and understand the general RESTful workflow.

Ports Required for the NSX REST API

The NSX Manager requires port 443/TCP for REST API requests.

Configuring REST Clients for the NSX REST API

Some common REST clients include Postman, RESTClient (a Firefox add-on), and curl (a command-line tool). Thedetails of REST client configuration will vary from client to client, but this general information should help you configureyour REST client correctly. The NSX REST API can use basic authentication or JSON Web Token authentication.

You can authenticate using basic authentication or JSON Web Tokens. See "Working with API Tokens" forinformation on creating and using JSON Web Tokens. You must configure your REST client to send the NSXManager authentication credentials. See the documentation for your REST client for details.

You must use https to send API requests to the NSX Manager.You might need to import the certificate from the NSX Manager to your REST client to allow it to connect to the NSXManager.

When you submit an API request with a request body, you must include the appropriate Content-Typeheader.Starting in NSX 6.4, both XML and JSON are supported. This guide documents XML examples. Set theContent-Type header to application/xml or application/json as needed.Some requests require additional headers, for example, firewall configuration changes require the If-Match header.This is noted on each method description.

To ensure you always receive the correct response bodies, set the Accept header Starting in NSX 6.4, both XML and JSON are supported. This guide documents XML examples. Set the Accept header to application/xml or application/json as needed.

http://www.vmware.com/support/pubshttp://www.vmware.com/support/


Note: Some methods, for example, the central CLI method, POST /1.0/nsx/cli, might require a different Acceptheader.

The following API method will return a response on a newly deployed NSX Manager appliance, even if you have notmade any configuration changes. You can use this as a test to verify that your REST client is configured correctly tocommunicate with the NSX Manager API.

GET /api/2.0/services/usermgmt/user/admin

URI and Query Parameters

Some methods have URI or query parameters. URI parameters are values that you include in the request URL. Youuse a question mark (?) to join the request URL and the query parameters. Multiple query parameters can becombined by using ampersands (&).

For example, you can use this method to get a list of logical switches on a transport zone:

GET /api/2.0/vdn/scopes/{scopeId}/virtualwires

scopeId is a URI parameter that represents a transport zone.

The startindex and pagesize query parameters control how this information is displayed. startindex determineswhich logical switch to begin the list with, and pagesize determines how many logical switches to list.

To view the first 20 logical switches on transport zone vdnscope-1, use the following parameters: scopeId URI parameter set to vdnscope-1. startindex query parameter set to 0. pagesize query parameter set to 20.

These parameters are combined to create this request:

GET https://192.168.110.42/api/2.0/vdn/scopes/vdnscope-1/virtualwires?

startindex=0&pagesize=20

RESTful Workflow Patterns

All RESTful workflows fall into a pattern that includes only two fundamental operations, which you repeat in this orderfor as long as necessary. Make an HTTP request (GET, PUT, POST, or DELETE).

The target of this request is either a well-known URL (such as NSX Manager) or a link obtained from the response toa previous request. For example, a GET request to an Org URL returns links to vDC objects contained by the Org.

Examine the response, which can be an XML document or an HTTP response code.If the response is an XML document, it might contain links or other information about the state of an object. If theresponse is an HTTP response code, it indicates whether the request succeeded or failed, and might beaccompanied by a URL that points to a location from which additional information can be retrieved.

Revision Numbers

Some API objects include a configuration version number. In some cases, this revision number is used to preventconcurrent changes to an object. As a best practice, before you change the configuration of an object, retrieve thelatest configuration using GET. Modify the response body as needed and use it as your PUT request body. If the objecthas been modified since your GET operation, you might see an error message.

Finding vCenter Object IDsMany API methods reference vCenter object IDs in URI parameters, query parameters, request bodies, and responsebodies. You can find vCenter object IDs via the vCenter Managed Object Browser.


Find Datacenter MOID

1 In a web browser, enter the vCenter Managed Object Browser URL: http://vCenter-IP-Address/mob.

2 Click content.

3 Find rootFolder in the Name column, and click the corresponding link in the Value column. For example,group-d1.

4 Find the childEntity in the Name column, and the corresponding Value column entry is the datacenter MOID. Forexample, datacenter-21.

Find Cluster or Host MOID


2 Click content.


4 Find childEntity in the Name column, and click the corresponding link in the Value column. For example,datacenter-21.

5 Find hostFolder in the Name column, and click the corresponding link in the Value column. For example,group-h23.

6 Find childEntity in the Name column. The corresponding Value column lists the host clusters. For example,domain-c33.

7 To find the MOID of a host in a cluster, click the appropriate host cluster link located in the previous step.

8 Find host in the Name column. The corresponding Value column lists the hosts in that cluster by vCenter MOIDand hostname. For example, host-32 (esx-02a.corp.local).

Find Portgroup MOID


2 Click content.




6 Find childEntity in the Name column. The corresponding Value column contains links to host clusters. Click theappropriate host cluster link. For example, domain-c33.

7 Find host in the Name column. The corresponding Value column lists the hosts in that cluster by vCenter MOIDand hostname. Click the appropriate host link, For example, host-32.

8 Find network in the Name column. The corresponding Value column lists the port groups on that host, Forexample, dvportgroup-388.

Find VM MOID or VM Instance UUID


2 Click content.





6 Find childEntity in the Name column. The corresponding Value column contains links to host clusters. Click theappropriate host cluster link. For example, domain-c33.

7 Find host in the Name column. The corresponding Value column lists the hosts in that cluster by vCenter MOIDand hostname. Click the appropriate host link, For example, host-32.

8 Find vm in the Name column. The corresponding Value column lists the virtual machines by vCenter MOID andhostname. For example, vm-216 (web-01a).

9 To find the instance UUID of a VM, click the VM MOID link located in the previous step. Click the config link in theValue column.

10 Find instanceUuid in the Name column. The corresponding Value column lists the VM instance UUID. Forexample, 502e71fa-1a00-759b-e40f-ce778e915f16.


Endpointshttps://{nsxmanager}/apiBase URI Parameters:

nsxmanager(required) Hostname or IP address of the NSX Manager.

Working With vSphere Distributed Switches

GET /api/2.0/vdn/switches

Description:Retrieve information about all vSphere Distributed Switches.

Responses:Status Code: 200Body: application/xml

dvs-35

VmwareDistributedVirtualSwitch

423A993F-BEE6-1285-58F1-54E48D508D90

916287b3-761d-430b-8ab2-83878dfe3e7f

10


vds-site-a

datacenter-21

Datacenter

Datacenter Site A

false

0

1600

FAILOVER_ORDER

Uplink 4

false

dvs-47


***

***


POST /api/2.0/vdn/switches

Description:Prepare a vSphere Distributed Switch.

The MTU is the maximum amount of data that can be transmitted in one packet before it is divided into smallerpackets. VXLAN frames are slightly larger in size because of the traffic encapsulation, so the MTU required is higherthan the standard MTU. You must set the MTU for each switch to 1602 or higher.

Request:Body: application/xml

dvs-26

DistributedVirtualSwitch

0

DistributedVirtualSwitch

ETHER_CHANNEL

mtu-value

Working With vSphere Distributed Switches in a Datacenter

GET /api/2.0/vdn/switches/datacenter/{datacenterID}

URI Parameters:

datacenterID(required) A valid datacenter ID (e.g. datacenter-21)

Description:Retrieve information about all vSphere Distributed Switches in the specified datacenter.


dvs-35


423A993F-BEE6-1285-58F1-54E48D508D90

916287b3-761d-430b-8ab2-83878dfe3e7f

10



vds-site-a

datacenter-21

Datacenter

Datacenter Site A

false

0

1600

FAILOVER_ORDER

Uplink 4

false

dvs-47


***

***

Working With a Specific vSphere Distributed Switch

GET /api/2.0/vdn/switches/{vdsId}

URI Parameters:

vdsId(required) A valid vSphere Distributed Switch ID (e.g. dvs-35)

Description:Retrieve information about the specified vSphere Distributed Switch.


dvs-35


423A993F-BEE6-1285-58F1-54E48D508D90

916287b3-761d-430b-8ab2-83878dfe3e7f

10



vds-site-a

datacenter-21

Datacenter

Datacenter Site A

false

0

1600

FAILOVER_ORDER

Uplink 4

false

DELETE /api/2.0/vdn/switches/{vdsId}

URI Parameters:

vdsId(required) A valid vSphere Distributed Switch ID (e.g. dvs-35)

Description:Delete the specified vSphere Distributed Switch.


Working With Segment ID Pools and Multicast Ranges

Working With Segment ID PoolsSegment ID pools (also called segment ID ranges) provide virtual network identifiers (VNIs) to logical switches.

You must configure a segment ID pool for each NSX Manager. You can have more than one segment ID pool. Thesegment ID pool includes the beginning and ending IDs.

You should not configure more than 10,000 VNIs in a single vCenter server because vCenter limits the number ofdvPortgroups to 10,000.

If any of your transport zones will use multicast or hybrid replication mode, you must also configure a multicast addressrange.

GET /api/2.0/vdn/config/segments

Description:Retrieve information about all segment ID pools.


1

Local Segments

Local Segment ID pool

5000

5999

false

0

3

Universal-Segments

Universal segment ID pool

200000

201000

true

2

POST /api/2.0/vdn/config/segments

Query Parameters:

isUniversal(optional) Set to true when creating a universal segment ID pool.

Description:Add a segment ID pool.


name - Required property. desc - Optional property. begin - Required property. Minimum value is 5000 end - Required property. Maximum value is 16777216


Segment 1

Segment Range 1

5000

12999

Working With a Specific Segment ID Pool

GET /api/2.0/vdn/config/segments/{segmentPoolId}

URI Parameters:

segmentPoolId(required) A valid segmentPoolId

Description:Retrieve information about the specified segment ID pool.


1

Local Segments

Local Segment ID pool

5000

5999

false

0

PUT /api/2.0/vdn/config/segments/{segmentPoolId}

URI Parameters:


Description:Update the specified segment ID pool.


If the segment ID pool is universal you must send the API request to the primary NSX Manager.


Local Segment ID pool expanded

6999

DELETE /api/2.0/vdn/config/segments/{segmentPoolId}

URI Parameters:


Description:Delete the specified segment ID pool.

If the segment ID pool is universal you must send the API request to the primary NSX Manager.

Working With Multicast Address RangesIf any of your transport zones will use multicast or hybrid replication mode, you must add a multicast address range(also called a multicast address pool). Specifying a multicast address range helps in spreading traffic across yournetwork to avoid overloading a single multicast address.

GET /api/2.0/vdn/config/multicasts

Description:Retrieve information about all configured multicast address ranges.

Universal multicast address ranges have the property isUniversal set to true.


5

239.0.0.0-239.255.255.255

239.0.0.0

239.255.255.255

false

0

10

Range 2

237.0.0.0


237.255.255.255

false

0

POST /api/2.0/vdn/config/multicasts

Query Parameters:

isUniversal(optional) Set to true when creating a universal multicast addressrange.

Description:Add a multicast address range for logical switches.

The address range includes the beginning and ending addresses.


Range 2

237.0.0.0

237.255.255.255

Working With a Specific Multicast Address Range

GET /api/2.0/vdn/config/multicasts/{multicastAddresssRangeId}

URI Parameters:

multicastAddresssRangeId(required) A valid multicast address range ID

Description:Retrieve information about the specified multicast address range.


5

239.0.0.0-239.255.255.255

239.0.0.0

239.255.255.255

false

0


PUT /api/2.0/vdn/config/multicasts/{multicastAddresssRangeId}

URI Parameters:


Description:Update the specified multicast address range.

If the multicast address range is universal you must send the API request to the primary NSX Manager.


Extended range 2

Extended range 2

238.255.255.255

DELETE /api/2.0/vdn/config/multicasts/{multicastAddresssRangeId}

URI Parameters:


Description:Delete the specified multicast address range.

If the multicast address range is universal you must send the API request to the primary NSX Manager.

Working With the VXLAN Port Configuration

GET /api/2.0/vdn/config/vxlan/udp/port

Description:Retrieve the UDP port configured for VXLAN traffic.


4789


Update the VXLAN Port Configuration

PUT /api/2.0/vdn/config/vxlan/udp/port/{portNumber}

URI Parameters:

portNumber(required) A valid UDP port for VXLAN

Query Parameters:

force(optional) Set to true to force the change in VXLAN port.

This updates the port configuration on the hosts directly,and might cause a disruption in VXLAN traffic. In across-vCenter NSX environment, this does not changethe port on all NSX Managers.

Description:Update the VXLAN port configuration to use port portNumber.

This method changes the VXLAN port in a three phrase process, avoiding disruption of VXLAN traffic. In across-vCenter NSX environment, change the VXLAN port on the primary NSX Manager to propagate this change on allNSX Managers and hosts in the cross-vCenter NSX environment.

Method history:

Release Modification

6

nsx api guide 6 - docs.vmware.com · nsx api guide version: 6.4 page 2 table of contents...

Documents