Table of Contents HOL NET

Transcription

1 Table of Contents Lab Overview - - VMware NSX-T Data Center Operations, Troubleshooting and API Consumption... 2 Lab Guidance... 3 Module 1 - NSX-T Datacenter Operations - Use Tools within NSX-T Datacenter for Day to Day Operations (15 minutes)... 9 Module Guidance Dashboard, Counters, and Statistics Port Connection Tool Traceflow IPFIX Central CLI Module 1 - Conclusion Module 2 - NSX-T Datacenter Troubleshooting - Use Tools within NSX-T Datacenter for Troubleshooting (15 minutes) Module Guidance Routing Tables MAC Address Tables Port Mirroring Module 2 - Conclusion Module 3 - API Consumption - Gain Familiarity with the NSX-T API (30 minutes)...69 NSX RESTful API Manual Consumption Terraform Consumption Module 3 Conclusion Page 1

2 Lab Overview - - VMware NSX-T Data Center Operations, Troubleshooting and API Consumption Page 2

3 Lab Guidance Note: It will take more than 60 minutes to complete this lab. You should expect to only finish 2-3 of the modules during your time. The modules are independent of each other so you can start at the beginning of any module and proceed from there. You can use the Table of Contents to access any module of your choosing. The Table of Contents can be accessed in the upper right-hand corner of the Lab Manual. In this lab we will explore use cases around VMware NSX-T Datacenter operations, troubleshooting, and API consumption. Lab Module List: (15 Minutes) - Intermediate - This module will walk you through the basics of NSX-T Datacenter operations. You will use features such as Traceflow, Port Connection tool, and others. Module 2 - NSX-T Datacenter Troubleshooting - Use tools within NSX-T Datacenter for troubleshooting (15 minutes) - Intermediate - This module will walk you through the basics of NSX-T Datacenter troubleshooting. You will view various system configurations and correct misconfigurations after problem identification. Module 3 - API Consumption - Gain familiarity with the NSX-T API (30 minutes) - Advanced - This module will explore the basics of NSX API consumption through manual interaction as well as several common configuration management tools. Lab Captains: Module Kenyon Hensler, Staff Systems Engineer, USA This lab manual can be downloaded from the Hands-on Labs Document site found here: This lab may be available in other languages. To set your language preference and have a localized manual deployed with your lab, you may utilize this document to help guide you through the process: Page 3

4 Location of the Main Console 1. The area in the RED box contains the Main Console. The Lab Manual is on the tab to the Right of the Main Console. 2. A particular lab may have additional consoles found on separate tabs in the upper left. You will be directed to open another specific console if needed. 3. Your lab starts with 90 minutes on the timer. The lab can not be saved. All your work must be done during the lab session. But you can click the EXTEND to increase your time. If you are at a VMware event, you can extend your lab time twice, for up to 30 minutes. Each click gives you an additional 15 minutes. Outside of VMware events, you can extend your lab time up to 9 hours and 30 minutes. Each click gives you an additional hour. Alternate Methods of Keyboard Data Entry During this module, you will input text into the Main Console. Besides directly typing it in, there are two very helpful methods of entering data which make it easier to enter complex data. Page 4

5 Click and Drag Lab Manual Content Into Console Active Window You can also click and drag text and Command Line Interface (CLI) commands directly from the Lab Manual into the active window in the Main Console. Accessing the Online International Keyboard You can also use the Online International Keyboard found in the Main Console. 1. Click on the Keyboard Icon found on the Windows Quick Launch Task Bar. Page 5

6 Click once in active console window In this example, you will use the Online Keyboard to enter the sign used in addresses. The sign is Shift-2 on US keyboard layouts. 1. Click once in the active console window. 2. Click on the Shift key. Click on key 1. Click on the "@ key". Notice sign entered in the active console window. Page 6

7 Activation Prompt or Watermark When you first start your lab, you may notice a watermark on the desktop indicating that Windows is not activated. One of the major benefits of virtualization is that virtual machines can be moved and run on any platform. The Hands-on Labs utilizes this benefit and we are able to run the labs out of multiple datacenters. However, these datacenters may not have identical processors, which triggers a Microsoft activation check through the Internet. Rest assured, VMware and the Hands-on Labs are in full compliance with Microsoft licensing requirements. The lab that you are using is a self-contained pod and does not have full access to the Internet, which is required for Windows to verify the activation. Without full access to the Internet, this automated process fails and you see this watermark. This cosmetic issue has no effect on your lab. Look at the lower right portion of the screen Page 7

8 Please check to see that your lab is finished all the startup routines and is ready for you to start. If you see anything other than "Ready", please wait a few minutes. If after 5 minutes your lab has not changed to "Ready", please ask for assistance. Page 8

9 Module 1 - NSX-T Datacenter Operations - Use Tools within NSX-T Datacenter for Day to Day Operations (15 minutes) Page 9

10 Module Guidance This module will review common operational activities within NSX-T Datacenter. You will use these tools to gain an understanding of what to do on a day to day basis to ensure proper functioning of the NSX-T Datacenter system. This module takes approximately 15 minutes to complete and: Reviews the Dashboard, Counters, and Statistics Uses the port connection tool Demonstrates the use of Traceflow Reviews the IPFIX configuration Walks through parts of the Central CLI Page 10

11 Dashboard, Counters, and Statistics This lesson will focus on reviewing data available in NSX-T Datacenter. Open Chrome Browser from Windows Quick Launch Task Bar 1. Click on the Chrome Icon on the Windows Quick Launch Task Bar. Navigate to NSX-T Manager 1. Click on the VMware NSX Login bookmark Login to NSX-T Manager Page 11

12 Login to NSX Manager 1. Enter the username admin 2. Enter the password VMware1! 3. Click Login Navigate to the Dashboard 1. Click the Dashboard tile Page 12

13 Review the Dashboard Review each of the tiles on the dashboard Each tile represents a component of the NSX-T Datacenter infrastructure. Each of the tiles is clickable and will drill down into the status of the tile's components. Hovering over each tile will show details of the members status. Backup status for each component is also shown. Page 13

14 Navigate to LS-Uplink Monitor To view the Counters associated with a Logical Switch 1. Click on Switching 2. Click on Switches 3. Select the LS-Uplink Logical Switch 4. Click on Monitor Page 14

15 Review Logical Switch Statistics Review the statistics of the LS-Uplink Logical Switch. The statistics shown here are similar to traditional statistics and counters found on traditional networking hardware. These statistics are a summation of all ports on the logical switch. The statistics in the lab may not match the screen shot as traffic will vary based on lab uptime. Navigate to Related Ports 1. Click Related 2. Click Ports Select a Port Page 15

16 1. Click uplink1 Navigate to Monitor Tab 1. Click Monitor Review Logical Port Statistics Review the statistics of the uplink1 Logical Port. The statistics shown here are similar to traditional statistics and counters found on traditional networking hardware. These statistics are specific to this logical port. The statistics in the lab may not match the screen shot as traffic will vary based on lab uptime. Page 16

17 Port Connection Tool In this lesson you will use the port connection tool to verify end to end connectivity Navigate to the Port Connection Tool 1. Expand the Tools section 2. Select Port Connection Select the Virtual Machines Select the db-01a and web-01a virtual machines and interfaces 1. Select db-01a 2. Select the VIF 3. Select web-01a 4. Select the VIF Page 17

18 5. Click GO Review the results Review the results of the traceflow. Each component is clickable to view the details of the specific component. By using the Port Connection tool you can quickly verify the status of the Logical Interface (LIF) on the Logical Switch, the Associated Virtual Interfaces (VIF), the hypervisor physical connectivity and the tunnel status between the hypervisors. This information can be used to verify logical port connectivity and physical connectivity between hypervisors. The web-01a virtual machine may be on a different transport node than shown. Page 18

19 Traceflow Traceflow allows for virtual machine to virtual machine connectivity mapping including all logical components between. In the lesson you will use traceflow to verify connectivity between two virtual machines. Navigate to Traceflow 1. Ensure the Tools section is expanded 2. Select Traceflow Select the VMs to Trace 1. Select k8s-master as the Source 2. Select the Virtual Interface ending in Select web-01a as the Destination The remaining fields will be auto populated. Page 19

20 4. Click TRACE Review the Traceflow results Review the Traceflow results. Notice all of the components that are inspected for traffic forwarding. All of the components from VNIC to VNIC are traced including Logical Switches, Routers, Firewall, and Tunnels. Page 20

21 IPFIX IPFIX is a network monitoring protocol similar to NetFlow. IPFIX allows for variable length fields and customized data. NSX-T Datacenter supports the exporting of IPFIX data from both switches and firewalls to a collector such as vrealize Network Insight. In this lesson students will configure IPFIX for switching data as well as firewall data. There is no IPFIX Collector in the lab. This lesson is only for demonstration of the configuration. Navigate to IPFIX 1. Ensure Tools is expanded 2. Select IPFIX Configure a Switch Collector Page 21

22 1. Click Switch IPFIX Collectors 2. Click Configure Collectors 3. Click Add 4. Click the Pencil Icon 5. Enter Click Save Configure a Switch Profile 1. Click Switch IPFIX Profile 2. Click Add 3. Enter SW_IPFIX_Profile 4. Change the Active Timeout to 60 Page 22

23 Apply the Switch Profile 1. Click Applied To 2. Select Logical Switch 3. Select all Logical Switches 4. Move the selected Logical Switches to Selected 5. Click Save Page 23

24 Configure a Firewall Collector 1. Click Firewall IPFIX Collectors 2. Click Add 3. Enter FW_Collector 4. Click Add 5. Click the Pencil Icon 6. Enter Click Save If the Firewall IPFIX Collectors link is not visible complete the next step to change the browsers zoom. Otherwise skip the next step Page 24

25 Change Browser Zoom 1. Click the Chrome Settings button 2. Click the Zoom Out button Repeat as necessary to view the DOWNLOAD VTEP TABLE link. Once the table has been downloaded the zoom may be reset to 100%. Page 25

26 Configure a Firewall Profile 1. Click Firewall IPFIX Profiles 2. Click Add 3. Enter FW_IPFIX_Profile Page 26

27 Apply the Firewall Profile 1. Click Applied To 2. Select Logical Switch 3. Select Available 4. Click to move all Logical Switches to Selected 5. Click Save In this lesson you have configured IPFIX for reporting to an IPFIX collector. IPFIX is an indispensable network operations and troubleshooting tool. For more information on VMware's IPFIX Collector vrealize Network Insight please click here. Page 27

28 Central CLI In this lesson students will review the NSX-T Datacenter Central CLI. The Central CLI replaces the need to connect to individual components to perform monitoring and testing. The Central CLI operates from the NSX-T Datacenter Manager. Open Putty 1. Click on the Putty Icon If putty is already open, right-click the putty window and select putty nsxctrl-01a.corp.local 1. Select nsxctrl-01a.corp.local 2. Click Load 3. Click Open Page 28

29 Login to nsxctrl-01a Login using the user name admin and password VMware1! View Available Get Commands 1. Enter Page 29

30 get? Review the output for available commands get Logical Switches 1. Enter get logical-switches Review the output. This is a list of all logical switches configured Page 30

31 View LS-Web arp-table For this step copy and paste will be useful. By highlighting the UUID the text will be copied to the clipboard. By right-clicking in the putty session the text in the clipboard will be pasted. 1. Record the LS-Web UUID 2. Enter get logical-switch 262dbb9b e60-8ace-1c8b18a06715 arp-table Review the arp-table reported via the Central CLI. There are many possible commands available via the Central CLI. For quick operations and troubleshooting the Central CLI is a valuable tool. For further reading on the Central CLI see the NSX-T Datacenter Central CLI documentation by clicking here. Page 31

32 Module 1 - Conclusion This now completes Module 1 on NSX-T Datacenter Operations. In this module you reviewed common operational activities within NST-T Datacenter. You used these tools to gain an understanding of what to do on a day to day basis to ensure proper functioning of the NSX-T Datacenter system. The tools reviewed in the module were: Reviews the Dashboard, Counters, and Statistics Uses the port connection tool Demonstrates the use of Traceflow Reviews the IPFIX configuration Walks through parts of the Central CLI You've finished Module 1 Congratulations on completing Module 1. If you are looking for additional information on NSX-T Datacenter Operations, then please review the NSX-T Documentation Center via the URL below: Go to Proceed to any module below which interests you the most: Lab Module List: Module 1 - NSX-T Datacenter Operations - Use Tools within NSX-T Datacenter for Day to Day Operations (15 minutes)- Intermediate - This module will walk you through the basics of NSX-T Datacenter operations. You will use features such as Traceflow, Port Connection tool, and others. Module 2 - NSX-T Datacenter Troubleshooting - Use Tools within NSX-T Datacenter for Troubleshooting (15 minutes) - Intermediate - This module will walk you through the basics of NSX-T Datacenter troubleshooting. You will view various system configurations and correct misconfigurations after problem identification. Module 3 - API Consumption - Gain Familiarity with the NSX-T API (30 minutes)- Advanced - This module will explore the basics of NSX API consumption through manual interaction as well as several common configuration management tools. Lab Captain: Module 1-3 Kenyon Hensler, Staff Systems Engineer, United States. Page 32

33 How to End Lab To end your lab click on the END button. Page 33

34 Module 2 - NSX-T Datacenter Troubleshooting - Use Tools within NSX-T Datacenter for Troubleshooting (15 minutes) Page 34

35 Module Guidance This module will review common troubleshooting activities within NSX-T Datacenter. You will use these tools to gain an understanding of what to do on a day to day basis to ensure proper functioning of the NSX-T Datacenter system. This module takes approximately 15 minutes to complete and goes through: Show Routing Tables Show MAC Tables Review VTEP Tables Configure Port Mirroring Page 35

36 Routing Tables In this lesson you will review routing tables from NSX-T Datacenter. Open Chrome Browser from Windows Quick Launch Task Bar 1. Click on the Chrome Icon on the Windows Quick Launch Task Bar. Navigate to NSX-T Manager 1. Click on the VMware NSX Login bookmark Login to NSX-T Manager Page 36

37 Login to NSX Manager 1. Enter the username admin 2. Enter the password VMware1! 3. Click Login Navigate to Edges You will need the IP address of an edge node associated with the router you need to troubleshoot. 1. Expand the Fabric section 2. Select Nodes 3. Select Edges 4. Record the Management IP of the Edge associated with nsx-edge-01a You may need to expand the Edge column to see the names of the edges. Open Putty 1. Click on the Putty icon If putty is already open, right-click the putty window and select putty Page 37

38 Connect to the Edge 1. Click nsx-edge-01a 2. Click Load 3. Click Open Login to the Edge 1. Enter the password VMware1! Page 38

39 List all Logical Routers To enter the appropriate VRF for troubleshooting you must find the appropriate VRF number. In this instance you must use the Service Routers of the Tier 0 logical router. This is the logical router that runs BGP and peers with the northbound router. 1. Enter the command to list all logical routers: get logical-routers 2. Record the VRF number of the SERVICE_ROUTER_TIER0 Enter VRF Context Mode In VRF context mode the router will output information specific to the VRF you enter 1. Enter the command to switch to vfr 2: vrf 2 Page 39

40 Get Routes 1. Type the command get route 2. Review the routes available on this T0 SR Notice the different Flags associated with the different routes. b represents a BGP route learned from the northbound router. nc represents an NSX Connected route that was auto plumbed from a Tier 1 logical router or this Tier 1 logical router. c represents a route directly connected to this Tier 0 SR (Service Router). Notice the routes that are available via this address is the Intra Tier 0 Transit Subnet. This is address space the Tier 0 SR uses to route to the Tier 0 DR (Distributed Router). With this information you will be able to determine if your Tier 0 SR has learned the appropriate routes from the physical environment. Routes on Transport Nodes Routes are also available on all the transport nodes. To view the routes on hypervisor transport nodes the nsxcli is used. Open Putty Page 40

41 1. Click on the Putty icon If putty is already open, right-click the putty window and select putty Connect to esx-01a 1. Select esx-01a.corp.local 2. Click Load 3. Click Open Open nsxcli 1. Enter nsxcli Page 41

42 View Logical Routers 1. Enter get logical-routers Review the output from the command. Notice the number of LIFs and Routes associated with each logical router. The VDR UUID listed can be matched to the ID of the logical routers in the NSX-T Datacenter GUI View Logical Router Forwarding Detail 1. Enter get logical-router af7bf4c8-aa dc-c68d20f13e2a forwarding Page 42

43 The UUID af7bf4c8-aa dc-c68d20f13e2a matches the ID of the Tier 0 router. The output of the command lists all routes available for the Tier 0 router on the esx-01a transport node. By reviewing the output of the Edge Node and Transport Node forwarding tables administrators can quickly identify where routing problems may be occurring. To copy the command to the putty session high light the command in the manual and drag and drop it to the putty window. Page 43

44 MAC Address Tables Many common troubleshooting techniques involve verifying that the network devices are learning the appropriate MAC addresses from devices connected to them. In this lesson students will learn the various methods to view the MAC Address Tables on the different components of NSX-T Datacenter. Open Chrome Browser from Windows Quick Launch Task Bar 1. Click on the Chrome Icon on the Windows Quick Launch Task Bar. Navigate to NSX-T Manager 1. Click on the VMware NSX Login bookmark Page 44

45 Login to NSX-T Manager Login to NSX Manager 1. Enter the username admin 2. Enter the password VMware1! 3. Click Login Page 45

46 Download MAC-VTEP Table 1. Click Switching 2. Ensure the Switches tab is selected 3. Select the LS-DB Logical Switch 4. Change to the Monitor tab 5. Click DOWNLOAD MAC-VTEP TABLE Download the Central Control Plane Table 1. Ensure Central Control Plane is selected 2. Click Download Page 46

47 Administrators may want to view individual transport node MAC Tables as well. This can be achieved using the Transport Node selection and choosing the appropriate transport node. Save the File 1. Click Save Open the File 1. Click file.csv Select WordPad 1. Click WordPad Page 47

48 Review The Results The contents of this file include all of the MAC addresses, the current VTEP that the MAC address lives behind and the MAC address of the VTEP. With these three pieces of information the controllers can distribute the switching information to all transport nodes participating in the LS-DB logical switch to ensure layer 2 reachability of all VMs attached to a LIF on the LS-DB logical switch Close WordPad Once you have completed reviewing the table close WordPad Download VTEP Table 1. Click DOWNLOAD VTEP TABLE Complete the previous steps to download the Central Control Plane Table and open the file. The browser zoom may need to be adjusted to view the link. If it is not visible, complete the next step and then complete this step. Otherwise skip the next step. Page 48

49 Change Browser Zoom 1. Click the Chrome Settings button 2. Click the Zoom Out button Repeat as necessary to view the DOWNLOAD VTEP TABLE link. Once the table has been downloaded the zoom may be reset to 100%. Save the File 1. Click Save The filename may be file(1).csv Open the File Page 49

50 1. Click file.csv The filename may be file(1).csv Review the Results The contents of the VTEP Table include all information about the VTEPs participating in the LS-DB logical switch. This includes the VTEP Label, IP, MAC Address, and Segment ID. This information is used during replication to ensure the delivery of all BUM (broadcast, unknown unicast, and multicast) traffic. Close WordPad Once you have completed reviewing the table close WordPad MAC Tables on Transport Nodes MAC Address Tables are also available on all the transport nodes. To view the MAC Address Tables on hypervisor transport nodes the nsxcli is used. Open Putty 1. Click on the Putty icon If putty is already open, right-click the putty window and select putty Page 50

51 Connect to esx-01a 1. Select esx-01a.corp.local 2. Click Open Open nsxcli 1. Enter nsxcli Page 51

52 View Logical Switches 1. Enter get logical-switches This command will list all logical switches configured on the transport node Page 52

53 View the MAC Table 1. Enter get logical-switch 262dbb9b e60-8ace-1c8b18a06715 mac-table The ID 262dbb9b e60-8ace-1c8b18a06715 corresponds to the ID of the LS-WEB logical switch. Review the results. With this table administrators can view the different MAC Tables on the transport node. The LCP Local Entry table lists the VMs MAC Address connected to this transport node on the LS-WEB logical switch. The LCP Remote Entry represents the MAC Address of a VM on another transport node connected to the LS- WEB logical switch. The Inner MAC represents the VM's MAC address while the Outer MAC and Outer IP represent the Transport Node's MAC and IP Addresses. The Host Kernel Entry shows the distributed router ports connected to the Logical Switch. Page 53

54 ARP Tables 1. Enter get logical-switch 262dbb9b e60-8ace-1c8b18a06715 arp-table The ARP table of the transport node is also available via nsxcli. The ARP table shows the IP to MAC address mapping on the transport node. The entries in these tables will correspond to the output of the mac-tables. Here administrators can view the inner IPs and MAC addresses. You can copy the command to the lab by highlighting the command in the manual and dragging and dropping it to the putty session. Page 54

55 Port Mirroring Port mirroring is a very useful tool to allow for packet capture of a single or multiple ports on a switch. This allows for packet level debugging of applications and networks. Navigate to Port Mirroring 1. Expand the Tools section 2. Select Port Mirroring Sessions 3. Click ADD 4. Click Local SPAN Page 55

56 Create a New Session 1. Name the session WEB-01a 2. Select the ESX-TN01 Transport Node 3. Select Bidirectional 4. Click NEXT Page 56

57 Skip Source PNIC Selection 1. Click NEXT Administrators may mirror physical NICs as well as virtual NICs. In this lab only virtual NICs will be mirrored. Page 57

58 Select Source VM 1. Select web-01a 2. Click the > button 3. Click SHOW VIRTUAL INTERFACE (VNIC) Page 58

59 Select Interface 1. Scroll Down 2. Select the only interface 3. Click > to select the interface 4. Click NEXT Page 59

60 Select Destination VM 1. Scroll to the top 2. Select k8s-node1 3. Click > to select the VM 4. Click SHOW VIRTUAL INTERFACE (VNIC) Page 60

61 Select Interface 1. Scroll to the bottom 2. Select the last interface 3. Click > to select the interface 4. Click SAVE Open Putty 1. Click on the Putty icon If putty is already open, right-click the putty window and select putty Page 61

62 Connect to k8s-node1 1. Select k8s-node1 2. Click Open Start TCPDump Page 62

63 1. Enter the command: tcpdump -vvni ens192 icmp This command starts tcpdump on the interface selected in the Port Mirroring session filtering on icmp. Open an New Chrome Tab 1. Click the New Tab button Load the vsphere Web Client 1. Click RegionA 2. Click HTML5 Client Login to the vsphere Web Client 1. Select the Use Windows session authentication checkbox 2. Click Login Page 63

64 Open web-01a Remote Console 1. Select web-01a 2. Click Launch Remote Console Open the Console 1. Click Open VMware Remote Console Login to web-01a 1. Enter the username Page 64

65 root 2. Enter the password VMware1! Start a ping 1. Enter the command: ping Press Ctrl+Alt to release your cursor Return to the k8s-node1 session 1. Click the root@k8s-node1 putty session Page 65

66 Review the Output Review the output of the tcpdump command. The traffic displayed is from the monitor session configured earlier notice there is no traffic sourced or destined for the k8snode1 VM. Only mirrored traffic is shown. Page 66

67 Module 2 - Conclusion This now completes Module 2 on NSX-T Datacenter Troubleshooting. In this module you reviewed common troubleshooting tools and activities within NSX-T Datacenter. You used these tools to gain an understanding of what to do when troubleshooting a dataplane issue within NSX-T Datacenter system. The activities reviewed in the module were: Routing Tables MAC, VTEP, and ARP Tables Port Mirroring You've finished Module 2 Congratulations on completing Module 2. If you are looking for additional information on NSX-T Datacenter Troubleshooting, then please review the NSX-T Documentation Center via the URL below: Go to Proceed to any module below which interests you the most: Lab Module List: Module 1 - NSX-T Datacenter Operations - Use Tools within NSX-T Datacenter for Day to Day Operations (15 minutes) - Intermediate - This module will walk you through the basics of NSX-T Datacenter operations. You will use features such as Traceflow, Port Connection tool, and others. Module 2 - NSX-T Datacenter Troubleshooting - Use Tools within NSX-T Datacenter for Troubleshooting (15 minutes)- Intermediate - This module will walk you through the basics of NSX-T Datacenter troubleshooting. You will view various system configurations and correct misconfigurations after problem identification. Module 3 - API Consumption - Gain Familiarity with the NSX-T API (30 minutes) - Advanced - This module will explore the basics of NSX API consumption through manual interaction as well as several common configuration management tools. Lab Captain: Module 1-3 Kenyon Hensler, Staff Systems Engineer, United States. Page 67

68 How to End Lab To end your lab click on the END button. Page 68

69 Module 3 - API Consumption - Gain Familiarity with the NSX-T API (30 minutes) Page 69

70 NSX RESTful API NSX is designed ground up with a RESTful API. The NSX REST API can be used to both configure NSX and to provision NSX logical network services. The NSX REST API can be called directly or indirectly from various programming languages. Many orchestration and automation tools such as vrealize Automation via vrealize Orchestrator can call the NSX REST API to perform Layer 2 through Layer 7 network orchestration and automation. To demonstrate NSX RESTful API calls, you will be using the RESTClient extension to the Mozilla Firefox browser. RESTClient is a debugger for RESTful Web Services and is a useful tool when working with various REST API's. During this module the following tasks will be completed: Overview of RESTful APIs Overview of Powershell cmdlets Review of multiple NSX API calls Creation and deletion of NSX Objects Configuration of alarming available only via the NSX API Introduction to REST API's A REpresentational State Transfer (REST) API defines a set of simple principles which are loosely followed by most API implementations. Page 70

71 Resource (the source of specific information) Global Permanent Identifier (every resource is uniquely identified think HTTP URL) Standard Interface (used to exchange the representation of resources think the HTTP protocol) Set of Constraints REST leverages the strength of HTTP to send data (Headers and Bodies) between Clients and Servers. The term Uniform Resource Locator (URL) and Uniform Resource Identifier (URI) can be used interchangeably when working with REST. Resources (building blocks) are linked together by embedded hyperlinks in HTML documents or URI references, and resources can expose the state via representations containing both metadata (such as size, media type, or character set) and content (binary image or text document). REST Request Methods REST Clients specify the desired interaction (HTTP request message as defined by RFC 2616). Each HTTP method has specific, well-defined semantics within the context of a REST API s resource model: GET - (The purpose of GET is to retrieve a representation of a resource s state) including Response Headers and Body. HEAD - is used to retrieve the metadata associated with the resource s state or just the Response Headers. PUT - should be used to add a new resource to a store or update a resource. DELETE - removes a resource from its parent. POST - should be used to create a new resource. Page 71

72 REST Response Status Codes The REST APIs use a HTTP response message to inform clients of their request s result (as defined in RFC 2616). Five categories are defined: 1xx: Informational Communicates transfer protocol-level information. 2xx: Success Indicates that the client s request was accepted successful. 3xx: Redirection Indicates that the client must take some additional action in order to complete their request. 4xx: Client Error This category of error status codes points the finger at clients. 5xx: Server Error The server takes responsibility for these error status codes. HTTP response message to inform clients of their request s result (As Defined in RFC 2616): 200 OK 201 Created 202 Accepted 204 No content 400 Bad request 401 Unauthorized 403 Forbidden 404 Not found 405 Method Not Allowed 409 Conflict 500 Internal Server Error 501 Not implemented 503 Service unavailable HTTP Request Headers for the NSX RESTful API When configuring RESTful API's to provision NSX services, the following are a list of the important request headers: 1. Authorization: The user and password credential in Base64 encoded format. Page 72

73 2. Content-Type: "application/xml". Says that the request body/payload is in xml format. HTTP Requests for the NSX RESTful API 1. Method/Verb: GET/PUT/POST/DELETE : Action on the resource. 2. URL: Resource. 3. Headers: Authorization and Content-Type. 4. Body: XML Payload. 5. Status Code: 2xx For Success and 4xx and 5xx for Failures. OpenAPI Specification The NSX-T Datacenter OpenAPI Specification is available from NSX-T Manager at GET GET Page 73

74 This specification allows API users to quickly consume all methods available from NSX-T Datacenter. This documentation is generated for every NSX-T Datacenter release. Page 74

75 Manual Consumption One of the methods to consume the NSX-T Datacenter API is through manually interacting with the API. This can be done with many different tools. This lesson will explore the use of Postman and curl. Open Postman 1. Click the Windows Button 2. Type Postman 3. Click Postman Page 75

76 Close the Create a New Dialog 1. Click X Create an Authorization Header An authorization header will authenticate the session with the NSX-T Datacenter API 1. Switch the Type to Basic Auth 2. The Username and Password will be automatically populated 3. Click Update Request Enter the URI to GET All Logical Switches 1. Ensure the method is set to GET 2. Enter 3. Click Send Page 76

77 Review the Output By reviewing the output of the request administrators can inspect all Logical Switches created. This information includes all of the required information associated with this Logical Switch. This information can also be used as a template to create a Logical Switch. By reviewing the required components of a Logical Switch creation in the API Guide these values can be completed with the values of a Logical switch that meets the same requirement as the new Logical Switch. Generate a curl Command Postman will generate code for many languages from your request. This allows for easy scripting of API requests. 1. Click Code 2. Select curl on the drop down 3. Click Copy to Clipboard Page 77

78 Open Putty 1. Click on the Putty icon If putty is already open, right-click the putty window and select putty Open a Connection to api-01a 1. Enter Click Open Login to api-01a Login using the username: Page 78

79 admin Password: VMware1! Execute the curl Command 1. Paste the curl command by right clicking in the Putty window 2. Append the command with <SPACE> -k 3. Be sure to include the space before -k. This option ignores invalid certificates. 4. Execute the command Page 79

80 Review the Output 1. Scroll to the top of the Putty session 2. Review the output. This output will match the output from Postman. curl can be used for all API functions and may be used in conjunction with other command line tools such as grep, sed, and awk to build complex create, update, and destroy functions. Page 80

81 Terraform Consumption Terraform is a tool that allows for the creation of sharable configuration files that create and change infrastructure. Terraform has released an NSX-T Datacenter Module that allows for the configuration of NSX-T Datacenter objects. Open Putty If a putty session to api-01a is already open skip the step labeled "Open the logicalswitch.tf File" 1. Click on the Putty icon If putty is already open, right-click the putty window and select putty Open a Connection to api-01a Page 81

82 1. Select api-01a.corp.local 2. Click Load 3. Click Open Login to api-01a Login using the username: admin Password: VMware1! Open the logicalswitch.tf File 1. Switch to the api1 directory cd api1 2. Open the logicalswitch.tf file vi logicalswitch.tf Page 82

83 Review the File Review the file by using the arrow keys to move to the top and bottom of the file. Notice the resource section. This section will create a NSX-T Datacenter Logical Switch. Once you have completed reviewing the file exit the vi editor. 1. Type :q! Page 83

84 Verify the logicalswitch.tf File 1. Enter the command: terraform plan This command will verify the required data and plugins for terraform to complete the action. Page 84

85 Apply the logicalswitch.tf File 1. Enter the command: terraform apply 2. Type: yes Page 85

86 Review the Output The output of the command shows the Logical Switch "TfLogicalSwitch" was created Open Chrome Browser from Windows Quick Launch Task Bar 1. Click on the Chrome Icon on the Windows Quick Launch Task Bar. Navigate to NSX-T Manager 1. Click on the VMware NSX Login bookmark Page 86

87 Login to NSX-T Manager Login to NSX Manager 1. Enter the username admin 2. Enter the password VMware1! 3. Click Login Page 87

88 View the Logical Switch 1. Click Switching 2. Select the Switches tab 3. Notice the Logical Switch TfLogicalSwitch If the Logical Switch is not visibile refresh the page. Delete the Logical Switch Delete the Logical Switch to avoid confusion in the next part of the lesson Page 88

89 1. Select the TfLogicalSwitch 2. Click Delete 3. Click Delete Return to the Putty Session 1. Click the Putty Session Open the infra.tf File 1. Switch to the api2 directory cd../api2 2. Enter the command: vi infra.tf Page 89

90 Review the File Review the file by using the arrow keys to move to the top and bottom of the file. Notice the many resource sections. This file will create a Tier 1 router, connect the Tier 1 router to the Tier 0 router, create a Logical Switch, attach the Tier 1 router to the logical switch, and assign an IP address to the Tier 1 interface on the logical switch. This is a common action for tenant creation in an environment. Once you have completed reviewing the file exit the vi editor. 1. Type: :q! Page 90

91 Verify the infra.tf File 1. Enter the command: terraform plan Apply the infra.tf File 1. Enter the command: Page 91

92 terraform apply Confirm the Apply 1. Type: yes Review the Output Review the output of the command. Many actions were preformed. Scroll up to view the complete output. Return to NSX Manager Return to NSX Manager to review the configuration 1. Click VMware NSX Chrome window Page 92

93 Login to NSX-T Manager If the session has timed out login to NSX Manager. If the session is still active skip this step 1. Enter the username admin 2. Enter the password VMware1! 3. Click Login Page 93

94 Refresh Switches 1. Click REFRESH 2. Notice the TfLogicalSwitch2 Switch Page 94

95 Review Tier 1 Router 1. Click Routing 2. Select the T1-Terraform Logical Router Review the Summary 3. Click Configuration 4. Click Router Ports Page 95

96 Review the IP Address Assignments The IP address was specified in the infra.tf file as a variable. The next address may vary by lab. This address is automatically configured from a pool of addresses for use in connecting Tier 0 routers to Tier 1 routers. Return to the Putty Session 1. Click the Putty Session Ping the Router Address 1. Enter ping c 3 The ping should be successful. This IP address is being advertised from the newly created Tier 1 router through the Tier 0 router to the vpod router via BGP. Page 96

97 Remove the configuration Terraform will also remove previously created configurations. 1. Enter the command: terraform destroy 2. Confirm the removal yes Page 97

98 Review the Output The command successfully removed the configuration. This is a common action in the removal of an application or tenant from an infrastructure as code environment. Page 98

99 Module 3 Conclusion This module utilized the NSX API to configure multiple NSX objects. The NSX API provides a powerful tool for configuration, troubleshooting, and monitoring. You've finished Module 3 Congratulations on completing Module 3. For additional information on the NSX API visit the URL below and select the NSX API Guide: Go to Proceed to any module below or end the lab. Lab Module List: Module 1 - NSX-T Datacenter Operations - Use Tools within NSX-T Datacenter for Day to Day Operations (15 minutes) - Intermediate - This module will walk you through the basics of NSX-T Datacenter operations. You will use features such as Traceflow, Port Connection tool, and others. Module 2 - NSX-T Datacenter Troubleshooting - Use Tools within NSX-T Datacenter for Troubleshooting (15 minutes) - Intermediate - This module will walk you through the basics of NSX-T Datacenter troubleshooting. You will view various system configurations and correct misconfigurations after problem identification. Module 3 - API Consumption - Gain Familiarity with the NSX-T API (30 minutes) - Advanced - This module will explore the basics of NSX API consumption through manual interaction as well as several common configuration management tools. Lab Captain: Module 1-3: Kenyon Hensler, Staff Systems Engineer, United States How to End Lab To end the lab click on the END button. Page 99

100 Conclusion Thank you for participating in the VMware Hands-on Labs. Be sure to visit to continue your lab experience online. Lab SKU: Version: Page 100