Nsx on SneakU

NSX-v: The Penny Drops

Tue, 26 Jan 2016 00:00:00 +0000

I was onsite implementing NSX-v for a customer, and part of the installation in this environment requires that we allocate the VTEP pnics to the VXLAN transport VLAN. To do this I had to liaise with the Network Operations guy. After laying it out for him that although these VTEP interfaces are going to be used for “VM Data” (his words, not mine) they will only need to be an access port in VLAN xxx, the penny finally dropped for this guy on why they are going the NSX-v route.

NSX Manager: VTY configuration is locked by other VTY

Fri, 22 Jan 2016 00:00:00 +0000

Have you ever had the problem of working on a unstable network connection and your network drops out.

Well this happened to me this morning, but whilst it happened, I was actually connected to my NSX Manager via SSH and in configuration mode. When my network connectivity returned (4G) and I could SSH into the NSX Manager, I was greeted with the following:

VTY configuration is locked by other VTY
nsxmgr> ena
Password:
nsxmgr# conf t
VTY configuration is locked by other VTY
nsxmgr#

I asked around internally and it turns out that there is currently no elegant way of disconnecting the session which has crashed. I will be following this up so that hopefully an elegant solution will be included in a future release.

How to create a NSX-v API Only User Account

Thu, 21 Jan 2016 00:00:00 +0000

One of the main reasons for customers wanting to implement NSX for vSphere is the fact there is a RESTful API which can be leveraged to drive the whole system.

In a standard NSX-v installation, by default, the only account that has API only privileges (and no vSphere Web Client privileges) is the NSX Manager “admin” account. It is possible to use vSphere SSO accounts to interact with the NSX API, however this will also allow vSphere Web Client access (although they wont be able to view or access anything once logged on without granting specific vCenter rights).

NSX-v: Manually uninstall NSX VIBs

Thu, 21 Jan 2016 00:00:00 +0000

Due to a recent lab rebuild, I needed to manually remove the NSX VIBs that were installed on my ESXi host, and thought I would document the process so I can remember it in the future.

Removing the NSX VIBs from a host manually does not remove the configuration stored on the NSX Manager, so care needs to be taken when doing this.

Depending on the version of NSX-v installed, the number of NSX VIBs installed will vary.

Using PHP to query NSX-v via REST

Mon, 09 Nov 2015 00:00:00 +0000

Whilst working on a little side project of mine, I wanted to be able to submit a REST API call against a NSX Manager. At first I was just going to use shell_exec to execute one of my python scripts, but after a bit of investigation, I found that I could use the PHP Client URL Library (cURL) .

It took me a little bit of time to get it working just the way I wanted, but now that I have the basics, it should be simple to be able to do most things through a webpage.

NSX-v Quick Tip – Changing Controller Passwords

Tue, 04 Aug 2015 00:00:00 +0000

Changing NSX-v controller passwords is a question which comes up quite a bit with customers. Often because the passwords chosen at deployment time are either too complex to type in on a VM console session, or on the other end of the spectrum, they were set to something easy to type during deployment, and now need to be changed.

When deploying NSX-v controllers during the setup phase, the password is set when deploying the first controller.

Scripting - Resetting NSX-v objects

Sun, 14 Jun 2015 00:00:00 +0000

On various engagements I am involved with, I often need to produce some code to add or delete objects from NSX-v. These objects in general are things like IP Sets, MAC Sets, Security Groups, Security Tags, Services, Service Groups, Security Policies and even deleting the FW rulebase itself.

Until recently I was doing this manually as I was dealing with relatively small numbers of objects, however on a previous engagement I was working on a script to import up to 33,000 objects and when testing the script in a dev environment, we needed a way to go through and delete everything we had just imported and set it back to “defaults”.

NSX-v: Controller Packet Capture

Wed, 18 Mar 2015 00:00:00 +0000

So following on from my previous post (NSX-v: ESG Packet Capture), today we run through how to do a packet capture on one of your NSX Controllers.

Why would you want to do this I hear you ask?

Well I had a situation recently where I had some unexplained behavior and I needed to make sure that a particular packet was physically arriving at the controller as it had to pass through several VRFs and a FW or two.

NSX-v: ESG Packet Capture

Mon, 16 Mar 2015 00:00:00 +0000

Whilst troubleshooting at a client today, I needed to perform a packet capture on one of the Edge Services Gateways in the environment. Performing a packet capture is often very helpful in diagnosing a range of different issues.

To kick off a packet capture you can jump on the console of the ESG or like I am doing in this example, open up an SSH session to the ESG.

You will need to know what interface to run the capture on, so run the following command to list out all the interfaces (for ease of reading I have removed all the interfaces that were showing down/down from the output)

Scripting: NSX-v - Security Groups with Dynamic membership

Thu, 19 Feb 2015 00:00:00 +0000

NSX-v allows the creation of Security Groups to group objects to be used in DFW rules and security policies. Each security group can have a mix of static and dynamic membership (If you want to get picky, you can also statically exclude objects). One of the possible ways to dynamically include members into the security group is to match on a security tag. This allows a VM to have security tags assigned to them, and based on the security tag, a VM can be dynamically added as a security group member.

Scripting: NSX-v - Importing Checkpoint Objects

Fri, 06 Feb 2015 00:00:00 +0000

When faced with migrating from a Checkpoint installation to a VMware NSX-v installation, at some point someone is going to need to get all the objects across to the new firewall platform. I was recently asked to help add some functionality to a script to take some data from an odumper csv output and pump it into NSX-v.

The following script is a bit of a hack I put together. The script is based off one written by Brett Drayton (www.brettdrayton.com) in this post.

Scripting: Querying NSX-v service objects by port

Thu, 05 Feb 2015 00:00:00 +0000

When using the NSX-v distributed firewall (DFW) have you ever need to find out if a service has already been configured in the system for a particular port number?

Recently I was given a sample ruleset from a client to re-create in the DFW, and one thing that stood out was that when creating NSX firewall rules and faced with a random port number that needed to be configured for a rule, there is no easy way to find out if a service has already been configured using that port.

Scripting, Scripting and more Scripting

Tue, 03 Feb 2015 00:00:00 +0000

Over my years as a network engineer there has always been some element of scripting required. Whether it was formally required by a project, a particular situation or whether it was because i was sick of doing the same thing over and over again and wanted to make my life easier.

As part of my new role at VMware, I get to play with NSX for vSphere or NSX-v, and one thing that becomes apparent, is that if you don’t learn how to use the REST API, there will be certain situations where you will not be able to achieve your desired outcome. The NSX REST API, can be used to configure items which are not exposed in the UI, or you can use your favourite scripting language and script repetitive tasks.

vRA 6.1 Hotfix for NSX

Wed, 07 Jan 2015 00:00:00 +0000

Whilst deploying a NSX 6.1 and vRA 6.1 lab for some testing, I came across a peculiar error in regards to deploying a 1-arm load balancer.

Essentially it wouldn’t work! When vRA was trying to execute the multi-machine blueprint, it would provision all the VMs correctly and then destroy them shortly afterwards. The logs would show the following error.

[Timezone] [Error]: VcoWorkflow 'Create Edge': Failed after 00:00:10.4947127, java.lang.RuntimeException: com.vmware.o11n.plugins.nsx.error.VsmException: VSM response error (10166): Invalid Configuration. To deploy NSX Edge appliances, at-least one Vnic must be configured and must be connected to a valid portgroup. (Workflow:Create edge / Scriptable task (item1)#57)

So after a bit of research, it turned out that you need to apply a hotfix for vRA 6.1 when integrated with NSX.

My VCP-NV Experience

Mon, 06 Oct 2014 00:00:00 +0000

Today I finally passed my VCP-NV exam, and truth be told, it was only on my second attempt at the exam that I actually passed.

When I booked my first attempt at the exam, I had a complete 4 week study plan worked out, however even the best laid plans always come unstuck, and mine came unstuck as I was sent interstate for work several times in the weeks leading up to my first attempt. Due to travelling for work I had completely forgotten that I had booked the exam, and it wasn’t until the night before the exam that I realised that it was booked for 8am the next morning. This meant that there was less than 10 hours until I had to start the exam. I had a choice… get some sleep or try and cram. I compromised and read the NSX design guide and called it a night.