NSX Administration and Troubleshooting Guides

This is the corrected follow-up to my older article about simplifying NSX Edge removal in VCF. The most important correction is that the Edge Cluster Deployment Removal Tool does not preserve everything attached to an Edge cluster. Broadcom requires added dependencies to be removed or disconnected before the cleaner runs. The procedure below is based on Broadcom KB 316110, reviewed on August 25, 2026. Always reopen the KB before a change because the attachment, checksum, prerequisites, and supported releases can change. ...

This post replaces the unsafe package-removal command that appeared in my older article about removing stale NSX packages from an ESXi host. Broadcom now documents a clear distinction between removing NSX through its management workflow and cleaning up VIBs that remain afterward. Warning: Do not manually remove individual NSX VIBs with esxcli software vib remove. Broadcom identifies that method as unsupported. It can break distributed-switch state, disconnect host networking, and in some failure cases leave reimaging as the recovery path. ...

In VMware NSX, configuring SSH keys for users with specific labels and types provides a tailored access control approach that enhances both security and management capabilities. This blog walks through the process of setting user-specific SSH keys in NSX, using customized labels and types for better organization and identification. Before You Begin Overview SSH keys are crucial for secure authentication in NSX environments, allowing administrators to manage access without exposing systems to the risks of password-based logins. By setting SSH keys with specific labels and types, you can streamline user access management and improve security configurations. ...

Enabling SSH on NSX appliances via the CLI (Command Line Interface) is an essential skill for VMware administrators, providing a more direct and scriptable approach to managing and configuring the NSX environment. Here’s how to enable SSH on NSX from the CLI, allowing for secure, remote administration of your virtual network infrastructure. Pre-Requisites Ensure you have local or console access to the NSX appliance (NSX Manager, NSX Edge, or Controller) for initial setup. Administrative credentials will be required to execute the following commands. The instructions have been tested on NSX 4.1.2.3 ...

In this blog we will go over replacing the idps reporting Corfu certificate in NSX Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. Identifying the Expired Certificate In my case the cluster manager Corfu certificate has already expired Generating a New Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate ...

In this blog we will go over replacing the cluster manager Corfu certificate in NSX. In this example I will be using the UI to generate the self signed certificate and then an API call to replace the certificate. In my case the cluster manager Corfu certificate has already expired Generating a Self Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate ...

I replaced the expired Monitoring Corfu certificate in NSX by generating a self-signed certificate in the UI and sending the replacement through the API. In my case the Monitoring Corfu certificate has already expired Generating a Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate ...

I replaced the expired CSM Corfu certificate in NSX by generating a self-signed certificate in the UI and sending the replacement through the API. I covered the same procedure for the MP Corfu certificate and the CCP Corfu certificate in separate posts. The Expired CSM Corfu Certificate In my case the CSM Corfu certificate has already expired Generating a New Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate ...

This walkthrough covers a targeted replacement of a node-scoped Global Manager (GM) Corfu certificate. The screenshots were captured on NSX 4.1.0.2; the exact UI differs in later releases. Version and safety note: On NSX 4.2.x and VCF NSX 9.x, Broadcom prefers the built-in NSX Manager certificate-replacement UI. For a broader self-signed-certificate assessment or recovery, use the current Certificate Analyzer, Results and Recovery (CARR) procedure. CARR requires a dry run before remediation. Use the API below only when a targeted GM Corfu binding is appropriate for the installed release. ...

I replaced the expired MP Corfu certificate in NSX by generating a self-signed certificate in the UI and sending the replacement through the API. In my case the MP Corfu certificate has already expired Generating a New Self-Signed Certificate In the top menu bar I went to Generate -> Generate Self Signed Certificate ...