While NSX 6.2.x has been out for a while now, most people should be aware of the newly introduced feature called the Central CLI.

I won’t go into the details of what the Central CLI is, as you can read about it on Brett Draytons blog (link).

What I do want to point out though is that the main method for accessing the Central CLI is via a SSH connection to the NSX Manager. As you may or may not be aware, the authentication used for SSH connections to the NSX Manager is not integrated with SSO, meaning it uses local authentication.

So in a default installation, the admin account is able to SSH to the NSX Manager. As is often the case, using the admin account as a shared account, to perform operational procedures doesn’t often sit very well with security teams, and in some situations, the NSX Manager (and associated vSphere infrastructure) may be owned by an outsourcer, and they may be reluctant to give up the admin account.

So there are a couple of ways to work around this.

The first is to create a local user account for each person that is required to use the Central CLI for operational or troubleshooting purposes. In a large enterprise, this may not be suitable as there is no easy way to enforce enterprise password policies etc. Not to mention that the password would not be synced to any other account.

The second is to use an API call to issue Central CLI commands. And because the NSX API is able to be authenticated using SSO, it means that you generally do not need access to the admin account.

Although this API call is documented in the API guide, I have found that next to no-one I encounter in my day to day role (outside of VMware of course) knows that it exists.

The details are as follows (as described in the NSX 6.2 API Guide):

POST https://NSX-Manager-IP-Address/api/1.0/nsx/cli?action=execute

Request Body

<nsxcli>
  <command>CLI Command</command>
</nsxcli>

So say for example you wanted to issue the command “show cluster all” to my NSX Manager 10.29.5.211, it would be put together as follows:

POST https://10.29.5.211/api/1.0/nsx/cli?action=execute

Request Body

<nsxcli>
  <command>show cluster all</command>
</nsxcli>

And if successful, you should receive a HTTP status code of 200, and returned in the body will be the unformatted text.

This return text is identical to the output of the command if you were to run it on the command line via SSH.

Here is a screenshot from my Postman client showing the output.

So having the Central CLI commands and output accessible through an API means we can do some cool things with it.

I’ve come across some customers recently where for any number of reasons, the people who were required to troubleshoot issues with NSX-v, do not have access to the NSX Manager via SSH. So I put together a simple webpage which allows the Central CLI to be accessed from a webpage, I call it my NSX-v Web Central CLI.

I am not a web designer or programmer, so please don’t assume that the code that makes up these web pages and scripts is secure or the best way of doing things. The code I provide here is done to show what could be possible by using the NSX-v API.

So if we use our example command from earlier, this is what it would look like.

Now next to the Clear button, there is a little Question mark icon. Clicking this will open another window that will give the user the ability to see what commands are available.

By Clicking on the dropdown list, the user can choose the different command areas available via the Central CLI which will then list out each command syntax (This is the part provided by AJAX).

For Central CLI command areas that have lots of applicable commands, like the Edge commands, the windows is scrollable.

If you want to see another project which utilises the Central CLI API, head over to https://networkinferno.net/powernsx and checkout the PowerNSX module written by Nick Bradford.