![VMware NSX
Restarts a controller. Restart only one controller at a time
# restart controller
Shows control-cluster status
# show control‐cluster status
Shows controller, configuration, and status of the specified VNI
# show control‐cluster logical‐switches vni
“vniID”
Shows the hosts that are connected to the specified VNI
# show control‐cluster logical‐switches
connection‐table “vniID”
Shows MAC records of the specified VNI
# show control‐cluster logical‐switches mac‐
table “vniID”
Shows the ARP records updated from the specified connection.
# show control‐cluster logical‐switches arp‐
records “hostIP”
Shows the MAC records updated from the specified connection
# show control‐cluster logical‐switches mac‐
records “hostIP”
Shows the VTEP table for the specified VNI
# show control‐cluster logical‐switches vtep‐
table “vniID”
Shows the VTEP records updated from the specified host
# show control‐cluster logical-switch vtep-
records “hostIP“
FIREwAll
Shows the firewall configuration
# show the firewall configuration
Shows specific firewall rule information
# show firewall rule-id “ruleID”
Show IP address group
# show configuration ipset
Show application set
# show configuration application-set
DyNAMIC RouTINg
Shows entries on table
# show ip [bgp/ospf]
Shows neighbors
# show ip [bgp/ospf] neighbors
Shows routes learned
# show ip route [bgp/ospf]
Shows configuration
# show configuration [bgp/ospf]
NSX Controller Commands
NSX Edge commands
CoNTRollERS
Shows controller nodes status
# show controller list all
EDgES
Shows information for all edges
# show edge all
Shows specific Edge information
# show edge “edgeID”
logICAl RouTERS
list all logical router instance
# List all logical router instance
list which host received routing information
# show logical-router list dlr “dlrID” host
list routing table for a specific host
# show logical-router host “hostID” dlr
“dlrID” route
Shows logical router’s statistics
# show logical‐router controller master dlr
“dlrID” statistics
Show the ARP table for a logical router on a specific host
# show logical‐router host “hostID” dlr
“dlrID” arp
logICAl SwITCHES
Shows logical Switches
# show logical‐switch list all
Shows connected logical switch on a host
# show logical‐switch controller
“controllerID” host “hostIP” joined-vnis
Shows MAC Address table for a logical switch
# show logical‐switch controller master vni
“vniID” mac
Shows VTEP table for a host
# show logical‐switch controller
“controllerID” host “hostIP” vtep
Shows the ARP table for a host
# show logical‐switch controller
“controllerID” host “hostIP” arp
Shows MAC address table for a host
# show logical‐switch controller
“controllerID” host “hostIP” mac
Shows logical switch statistics
# show logical‐switch controller master vni
“vniID” statistics
Shows all hosts on which a logical switch is available
# show logical‐switch list vni “vniID”host
NSX Manager
Check NSX VIBs Installed
# esxcli software vib list | grep esx
uninstalling NSX VIBs
# esxcli software vib remove
--vibname=esx-vxlan
# esxcli software vib remove
--vibname=esx-vsip
Display VXlAN Details
# esxcli network vswitch dvs vmware vxlan list
Test VTEP Connectivity
# vmkping ++netstack=vxlan -d -s “MTU_SIZE”
“VTEP_IP_DEST”
ESXi Commands
Shows load balancer configuration
# show configuration
loadbalancer
Shows VIPs
# show configuration
loadbalancer virtual
“vipName”
Shows load balancer pool configuration
# show configuration
loadbalancer pool “poolName”
Shows load balancer pool
member state
# show service loadbalancer
pool “poolName”
load Balancer commands
NSX Edge Sizes
Flavours vCPu Memory general guideline
Compact 1 512MB
- Tests
- POCs
Large 2 1GB
- Medium performance firewall
- Single Services
Quad-Large 4 1GB - High performance firewall
X-Large 6 8GB
- High performance Firewall
- Load Balancing
NSX licensing
Product Features Standard Advanced Enterprise
Distributed switching and routing • • •
NSX edge firewall • • •
NAT • • •
SW L2 bridging to physical environment • • •
Dynamic routing with ECMP (active-active) • • •
API-driven automation • • •
Integration with vRealize and OpenStack • • •
Log Management with vRealize Log Insight for NSX • • •
Automation of security policies with vRealize • •
NSX edge load balancing • •
Distributed firewalling • •
Integration with Active Directory • •
Server activity monitoring • •
Service insertion (third-party integration) • •
Integration with AirWatch • •
Cross vCenter NSX •
Multi-site NSX optimizations •
VPN (IPSec and SSL) •
Remote Gateway •
Integration with hardware VTEPs •
Documentation Center
https://www.vmware.com/support/pubs/nsx_pubs.html
official Blog
http://blogs.vmware.com/networkvirtualization
VMware Hands-on labs
http://hol.vmware.com/
Design guide
http://bit.ly/2cHPgtJ
Trending support issues
http://kb.vmware.com/kb/2131154
Troubleshooting
https://kb.vmware.com/kb/2122691
NSX Resource links
Teaming and Failover Mode
Policy NSX Support Multi vTEP Support uplink Behavior
Route Based on Originating Port Both NICs Active
Route Based on Source MAC Hash Both NICs Active
Route Based on IP Hash Flow Based
Route Based on NIC Load
LACP Flow Based
Explicit Failover Order Only one NIC active
NSX load Balancing Services
NSX Reference Architecture
• load Balancer is the VMs
default gateway
• only DNAT is required
• Server farm replies back to the
original client IP
• This model is simple too but not
quite flexible
• Full visibility into the original
client IP address
• Shared network services
Inline Mode (Transparent)
• Connected directly on the same
VMs network
• It's not the VMs default gateway
• SNAT is mandatory
• Server farm replies back to
the VIP
• This model is simple to deploy
• It provides greater flexibility
• Dedicated network services
one-Arm Mode (Proxy)
NSX Dynamic Routing
VXlAN Frame Format
Copyright © 2016 VMware, Inc. All rights reserved. VMware Professional Services https://vmware.com/products/nsx
14 bytes
outer Ethernet
Header
8 bytes
outer uDP
Header
8 bytes
VXlAN
Header
14 bytes
Ethernet
Header
4 bytes
802.1Q
1500 bytes
original Payload
FCS
20 bytes
outer IP Header
Inner Frame
VXlAN Encapsulated Frame
wAN Internet
Payload Rack/Cluster Management Cluster Edge Cluster
VPN
VPN
WAN Internet
VPN
VPN
OS
APP
OS
APP
OS
APP
OS
APP
NSX Implementation Steps
vCenter
vSphere Cluster 1 vSphere Cluster 2 vSphere Cluster N
Register with vCenter
Deploy NSX
Controllers
NSX Controllers
NSX Edge
Services
gateway
Configure and
deploy EdgeService
gateway(s) and
additional Networking
& Security Services
Deploy NSX Manager
VP N
2
3
1
5
Prepare
Clusters
4
…
VP N
Peering
Peering
1
2
5
4
3
6
Dynamic routing protocol is configured
on the logical router instance
1
Controller pushes new logical router
configuration including to ESXi hosts
2
Dynamic routing peering between the
NSX Edge and logical router control VM
3
New learned routes from the NSX Edge are
pushed to the Controller for distribution
4
Controller sends the route updates
to all ESXi hosts
5
Routing kernel modules on the hosts
handle the data path traffic
6
@duboc • @dumeirell • @vmwarensx
Minimum MTu size: 1600
oSPF/BgP
wAN Internet
NSX Edge
(Acting as next hop router)
DlR
Control VM
oSPF/BgP
NSX Mgr
NSX Controller
Cluster
192.168.10.1
Data
Path
DlR
172.16.10.0/24
172.16.20.0/24
172.16.30.0/24
192.168.10.2
(Forwarding Address)
192.168.10.3
(Protocol Address)](https://image.slidesharecdn.com/nsxposter-221226162255-c9c8b0f3/85/NSX_Poster-pdf-1-320.jpg)
NSX_Poster.pdf
- 1. VMware NSX Restarts a controller. Restart only one controller at a time # restart controller Shows control-cluster status # show control‐cluster status Shows controller, configuration, and status of the specified VNI # show control‐cluster logical‐switches vni “vniID” Shows the hosts that are connected to the specified VNI # show control‐cluster logical‐switches connection‐table “vniID” Shows MAC records of the specified VNI # show control‐cluster logical‐switches mac‐ table “vniID” Shows the ARP records updated from the specified connection. # show control‐cluster logical‐switches arp‐ records “hostIP” Shows the MAC records updated from the specified connection # show control‐cluster logical‐switches mac‐ records “hostIP” Shows the VTEP table for the specified VNI # show control‐cluster logical‐switches vtep‐ table “vniID” Shows the VTEP records updated from the specified host # show control‐cluster logical-switch vtep- records “hostIP“ FIREwAll Shows the firewall configuration # show the firewall configuration Shows specific firewall rule information # show firewall rule-id “ruleID” Show IP address group # show configuration ipset Show application set # show configuration application-set DyNAMIC RouTINg Shows entries on table # show ip [bgp/ospf] Shows neighbors # show ip [bgp/ospf] neighbors Shows routes learned # show ip route [bgp/ospf] Shows configuration # show configuration [bgp/ospf] NSX Controller Commands NSX Edge commands CoNTRollERS Shows controller nodes status # show controller list all EDgES Shows information for all edges # show edge all Shows specific Edge information # show edge “edgeID” logICAl RouTERS list all logical router instance # List all logical router instance list which host received routing information # show logical-router list dlr “dlrID” host list routing table for a specific host # show logical-router host “hostID” dlr “dlrID” route Shows logical router’s statistics # show logical‐router controller master dlr “dlrID” statistics Show the ARP table for a logical router on a specific host # show logical‐router host “hostID” dlr “dlrID” arp logICAl SwITCHES Shows logical Switches # show logical‐switch list all Shows connected logical switch on a host # show logical‐switch controller “controllerID” host “hostIP” joined-vnis Shows MAC Address table for a logical switch # show logical‐switch controller master vni “vniID” mac Shows VTEP table for a host # show logical‐switch controller “controllerID” host “hostIP” vtep Shows the ARP table for a host # show logical‐switch controller “controllerID” host “hostIP” arp Shows MAC address table for a host # show logical‐switch controller “controllerID” host “hostIP” mac Shows logical switch statistics # show logical‐switch controller master vni “vniID” statistics Shows all hosts on which a logical switch is available # show logical‐switch list vni “vniID”host NSX Manager Check NSX VIBs Installed # esxcli software vib list | grep esx uninstalling NSX VIBs # esxcli software vib remove --vibname=esx-vxlan # esxcli software vib remove --vibname=esx-vsip Display VXlAN Details # esxcli network vswitch dvs vmware vxlan list Test VTEP Connectivity # vmkping ++netstack=vxlan -d -s “MTU_SIZE” “VTEP_IP_DEST” ESXi Commands Shows load balancer configuration # show configuration loadbalancer Shows VIPs # show configuration loadbalancer virtual “vipName” Shows load balancer pool configuration # show configuration loadbalancer pool “poolName” Shows load balancer pool member state # show service loadbalancer pool “poolName” load Balancer commands NSX Edge Sizes Flavours vCPu Memory general guideline Compact 1 512MB - Tests - POCs Large 2 1GB - Medium performance firewall - Single Services Quad-Large 4 1GB - High performance firewall X-Large 6 8GB - High performance Firewall - Load Balancing NSX licensing Product Features Standard Advanced Enterprise Distributed switching and routing • • • NSX edge firewall • • • NAT • • • SW L2 bridging to physical environment • • • Dynamic routing with ECMP (active-active) • • • API-driven automation • • • Integration with vRealize and OpenStack • • • Log Management with vRealize Log Insight for NSX • • • Automation of security policies with vRealize • • NSX edge load balancing • • Distributed firewalling • • Integration with Active Directory • • Server activity monitoring • • Service insertion (third-party integration) • • Integration with AirWatch • • Cross vCenter NSX • Multi-site NSX optimizations • VPN (IPSec and SSL) • Remote Gateway • Integration with hardware VTEPs • Documentation Center https://www.vmware.com/support/pubs/nsx_pubs.html official Blog http://blogs.vmware.com/networkvirtualization VMware Hands-on labs http://hol.vmware.com/ Design guide http://bit.ly/2cHPgtJ Trending support issues http://kb.vmware.com/kb/2131154 Troubleshooting https://kb.vmware.com/kb/2122691 NSX Resource links Teaming and Failover Mode Policy NSX Support Multi vTEP Support uplink Behavior Route Based on Originating Port Both NICs Active Route Based on Source MAC Hash Both NICs Active Route Based on IP Hash Flow Based Route Based on NIC Load LACP Flow Based Explicit Failover Order Only one NIC active NSX load Balancing Services NSX Reference Architecture • load Balancer is the VMs default gateway • only DNAT is required • Server farm replies back to the original client IP • This model is simple too but not quite flexible • Full visibility into the original client IP address • Shared network services Inline Mode (Transparent) • Connected directly on the same VMs network • It's not the VMs default gateway • SNAT is mandatory • Server farm replies back to the VIP • This model is simple to deploy • It provides greater flexibility • Dedicated network services one-Arm Mode (Proxy) NSX Dynamic Routing VXlAN Frame Format Copyright © 2016 VMware, Inc. All rights reserved. VMware Professional Services https://vmware.com/products/nsx 14 bytes outer Ethernet Header 8 bytes outer uDP Header 8 bytes VXlAN Header 14 bytes Ethernet Header 4 bytes 802.1Q 1500 bytes original Payload FCS 20 bytes outer IP Header Inner Frame VXlAN Encapsulated Frame wAN Internet Payload Rack/Cluster Management Cluster Edge Cluster VPN VPN WAN Internet VPN VPN OS APP OS APP OS APP OS APP NSX Implementation Steps vCenter vSphere Cluster 1 vSphere Cluster 2 vSphere Cluster N Register with vCenter Deploy NSX Controllers NSX Controllers NSX Edge Services gateway Configure and deploy EdgeService gateway(s) and additional Networking & Security Services Deploy NSX Manager VP N 2 3 1 5 Prepare Clusters 4 … VP N Peering Peering 1 2 5 4 3 6 Dynamic routing protocol is configured on the logical router instance 1 Controller pushes new logical router configuration including to ESXi hosts 2 Dynamic routing peering between the NSX Edge and logical router control VM 3 New learned routes from the NSX Edge are pushed to the Controller for distribution 4 Controller sends the route updates to all ESXi hosts 5 Routing kernel modules on the hosts handle the data path traffic 6 @duboc • @dumeirell • @vmwarensx Minimum MTu size: 1600 oSPF/BgP wAN Internet NSX Edge (Acting as next hop router) DlR Control VM oSPF/BgP NSX Mgr NSX Controller Cluster 192.168.10.1 Data Path DlR 172.16.10.0/24 172.16.20.0/24 172.16.30.0/24 192.168.10.2 (Forwarding Address) 192.168.10.3 (Protocol Address)