Category: VMware

This guide provides a concise overview of essential commands to manage NSX effectively.

NSX Manager Commands

The NSX Manager is the centralized network management component of VMware NSX, offering an intuitive interface for managing the network and security settings across your virtual environment. Below are key commands you can run from the NSX Manager CLI:

• List all ESXi hosts to get the Transport Node UUIDs: To view all ESXi hosts registered with NSX, and their respective Transport Node UUIDs, use
  get transport-nodes status
  This command is vital for identifying nodes for further configuration or troubleshooting.
• List the Transport Node Status: To check the status of a specific Transport Node, use get transport-node <uuid> status. This command provides insights into the health and connectivity status of the node.
• List the Transport Node VTEP Information: View the VXLAN Tunnel Endpoint (VTEP) information with get transport-node <uuid> vtep. This is crucial for understanding the overlay network configuration.
• Lists the VIF UUID of a VM: To find the Virtual Interface (VIF) UUID of a VM connected to a Segment on a Transport Node, use
  get transport-node <uuid> vifs
  This command is useful for troubleshooting VM connectivity issues.

Commands Run from ESXi Host

Directly interacting with ESXi hosts is sometimes necessary for detailed troubleshooting or configuration. Here are commands specific to NSX that you can run on ESXi hosts:

• List the VIBs installed on ESXi: To see all NSX-installed VMware Installation Bundles (VIBs) on an ESXi host, use esxcli software vib list | grep nsx.
• List all the NSX modules currently loaded in the system: Check which NSX modules are active with esxcli system module list | grep nsx.
• Check the User World Agents (UWA) Status: For nsx-mpa, nsx-proxy, and nsx-opsagent, use /etc/init.d/nsx-<agent> status to verify if these agents are running correctly.
• Check UWAs Connection: Use
  esxcli network ip connection list | grep <port number> to check connections to the NSX Controllers (Port 1235) and NSX Manager (Port 1234).

ESXi Host Networking Commands

Network configuration and troubleshooting directly on ESXi hosts are facilitated by the following commands:

• List Physical NICs/vmnic: esxcli network nic list gives a summary of all physical NICs.
• Physical NIC Details: Use esxcli network nic get -n <vmnic-id> for detailed information about a specific NIC.
• List vmk NICs: For IP addresses, MAC, MTU, and other details, use
  esxcli network ip interface ipv4 get.
• Details of vxlan IP Stack: To view the VXLAN-dedicated IP stack configuration, use esxcli network ip interface list --netstack=vxlan.
• Ping from a VXLAN TCP/IP Stack: vmkping ++netstack=vxlan x.x.x.x allows testing connectivity using the VXLAN stack.
• View VXLAN-dedicated TCP/IP Stack’s Routing and ARP Tables: Use
  esxcli network ip route ipv4 list -N vxlan and
  esxcli network ip neighbor list -N vxlan respectively.

NSX Installation Log Files

Troubleshooting NSX installations requires access to specific log files:

On NSX Manager:

• View Log Files: Use get log-file manager.log follow or
  get log-file syslog follow to tail the NSX Manager logs in real-time.

On ESXi Hosts:

• Installation and Host-related Logs: Located at /var/log/esxupdate.log for installation activities, /var/log/vmkernel.log for host issues, and
  /var/log/vmksummary.log, /var/log/vmkwarning.log for VMkernel warnings and messages. Module load failures are captured in /var/log/syslog.log.

This blog post dives into the essential commands for managing the NSX Management Cluster and explores the key log files within the NSX Manager to ensure you’re equipped to maintain and troubleshoot your setup effectively.

Understanding the NSX Management Cluster

Essential Commands for NSX Management Cluster

To help you navigate the management of the NSX Management Cluster, here are some indispensable commands you should be familiar with:

Querying Cluster Status

• Command: get cluster status
• Description: This command allows you to check the current status of the NSX management cluster, providing insights into its health and operational state.

Querying Cluster Configuration

• Command: get cluster config
• Description: Use this command to obtain the configuration details of the NSX management cluster. It’s essential for verifying the current setup and planning any necessary adjustments.

Detaching a Manager Node

• Command: detach node <ID>
• Description: If you need to remove a Manager node from the cluster, this command lets you safely detach it, ensuring no disruption to the cluster’s operation.

Adding a New Manager Node

• Command:
  join <Primary Manager Node IP> cluster-id <ID> thumbprint <Primary Manager Node Thumbprint> username admin password <admin password>
• Description: This command is crucial for scaling or repairing the NSX management cluster. It allows you to add a new Manager node to the cluster, enhancing its resilience and capacity.

Key Log Files in NSX Manager

For effective troubleshooting and monitoring of the NSX Management Cluster, understanding how to access and interpret log files is crucial. Here are the essential log files within the NSX Manager:

NSX Manager Logs

• Access Command: get log-file manager.log follow
• Location & Description: This log provides detailed records of the operations and events within the NSX Manager, offering invaluable insights for troubleshooting.

Syslog Files

• Access Command: get log-file syslog follow
• Location & Description: The syslog files capture a wide range of system messages, including errors, warnings, and operational information, which are critical for diagnosing issues within the cluster.

This blog post aims to elucidate the essential command-line interface (CLI) commands for managing the NSX Distributed Firewall, focusing on commands that can be executed from the NSX Manager and ESXi hosts, as well as detailing relevant log files for troubleshooting and auditing purposes. Additionally, we’ll touch upon commands for managing gateway firewall settings on NSX Edge devices.

NSX Manager: The Central Control Plane

The NSX Manager serves as the centralized control plane for managing NSX environments, offering a unified interface for configuring and monitoring network virtualization and security settings. Here are some key CLI commands you can run directly from the NSX Manager:

• View the Rule Count of L2, L3 Firewall Rules: To get a summary of Layer 2 and Layer 3 firewall rules, use the command get firewall summary
  This command provides a quick overview of the rules in place, helping administrators gauge the extent of their firewall configurations.
• List of Firewall Entities in the Excluded List: To view the entities excluded from firewall protection, execute get firewall exclude-list
  This command is crucial for identifying assets that are intentionally bypassed by firewall rules for specific purposes.
• Firewall Status: Checking the overall status of the firewall is as simple as running get firewall status
  This command confirms whether the distributed firewall is operational and can help in troubleshooting connectivity issues.

ESXi Hosts: The Data Plane

ESXi hosts, where VMs reside, are integral to enforcing NSX DFW rules. The following CLI commands can be run on ESXi hosts to manage and troubleshoot DFW settings at the host level:

• List All the VMs dvFilter Names: Use summarize-dvfilter to list all dvFilters associated with VMs. dvFilters are kernel modules that apply firewall rules to VMs’ network traffic.
• View IP and MAC Addresses for a dvFilter: To see the IP and MAC addresses related to a specific dvFilter, the command is
  vsipioctl getaddrsets -f <dvfilter-name>
• List the Firewall Rules Applied on DvFilter: Retrieve the set of firewall rules applied to a dvFilter by executing
  vsipioctl getrules -f <dvfilter-name>
• View Firewall Configuration for a dvFilter: To inspect the firewall configuration for a specific dvFilter, the command is
  vsipioctl getfwconfig -f <dvfilter-name>

Log Files: The Insight Tools

Log files play a pivotal role in monitoring, troubleshooting, and auditing. Here are essential log file locations for NSX components:

• NSX Syslog Log File on ESXi: Located at /var/log/nsx-syslog.log, this file captures a wide range of NSX-related events and is invaluable for troubleshooting.

Gateway Firewall: NSX Edge Commands

NSX Edge devices provide gateway services, including firewalling for north-south traffic. Here’s how to manage gateway firewall settings via CLI:

• Query Interfaces with Firewall Rules:
  get firewall interfaces lists all edge interfaces with configured firewall rules.
• Query Gateway Firewall Rules: For specific interface rules, use
  get firewall <interface-uuid> ruleset rules

This blog post delves into the logical routing capabilities of NSX-T and how network administrators can harness the power of NSX Manager and Edge CLI commands to efficiently manage and troubleshoot their network infrastructure.

NSX Manager: Your Gateway to Network Management

NSX Manager serves as the centralized network management console in VMware’s NSX-T architecture. From listing gateways to viewing detailed route information, NSX Manager equips administrators with the tools they need to manage their network effectively.

Key Commands from NSX Manager:

• List All Gateways: Easily view all the gateways within your network with
  get gateways
• Gateway Details: For specifics about a gateway, use
  get gateway <uuid>
• Interface Management: View a gateway’s interfaces using get gateway <uuid> interfaces and get detailed interface information with
  get gateway <uuid> interface <interface-id>
• Routing Information: Access route details on a gateway with
  get gateway <uuid> route
• NSX Edge Node Status: Check the status of NSX Edge nodes registered with the NSX Manager using get transport-node status

Edge CLI: Deep Dive into Gateway Diagnostics

The Edge CLI is your go-to for an in-depth analysis and diagnostics of gateways. Whether you’re monitoring gateway statistics or reviewing BGP and OSPF configurations, the Edge CLI commands offer a granular view of network operations.

View the gateway BGP information:

• Gateway Overview: get gateways provides a list of all gateways.
• To enter into the VRF construct: vrf <ID>
• View the bgp neighbor of a Tier-0 SR:
  (Tier-0)> get bgp neighbor
• View the interfaces on a Tier-0 SR:
  (Tier-0)> get interfaces
• View the forwarding table:
  (Tier-0)> get forwarding
• View the Routes:
  (Tier-0)> get route
• View the BFG configuration:
  (Tier-0)> get bfd-config

View the gateway OSPF information

• To enter into the VRF construct: vrf <ID>
• View the bgp neighbor of a Tier-0 SR:
  (Tier-0)> get ospf neighbor
• View the details of the OSPF interface:
  (Tier-0)> get ospf interface
• View the forwarding table:
  (Tier-0)> get forwarding
• View the Routes:
  (Tier-0)> get route
• View the OSPF database:
  (Tier-0)> get ospf database

• Statistics and Neighbors: Use get gateway <uuid> stats for statistics and
  get gateway <uuid> neighbor to view neighbor details.
• BGP and OSPF Configurations: Enter the VRF construct with
  vrf <ID> to view BGP neighbors, OSPF interfaces, and routing information.

ESXi Host-Level Insights

At the ESXi host level, NSX-T extends its capabilities to provide essential diagnostics and log file access, ensuring administrators have all the necessary tools at their fingertips.

Commands Run from ESXi:

• Forwarding Table and Interfaces: View the gateway’s forwarding table and interfaces with get gateway <UUID> forwarding and
  get gateway <UUID> interfaces.
• Neighbors: To see a gateway’s neighbors, use
  get gateway <UUID> neighbors.

Log Files on ESXi:

• NSX Syslog Log File: Located at /var/log/nsx-syslog.log, this log file is critical for troubleshooting and understanding the events within your NSX environment.