installing and upgrading vmware nsx intelligence - vmware ... · overview of nsx intelligence 1...

Installing and Upgrading VMware NSX Intelligence

Modified on 17 SEP 2020VMware NSX Intelligence 1.1

You can find the most up-to-date technical documentation on the VMware website at:

https://docs.vmware.com/

VMware, Inc.3401 Hillview Ave.Palo Alto, CA 94304www.vmware.com

Copyright ©

2020 VMware, Inc. All rights reserved. Copyright and trademark information.


VMware, Inc. 2

https://docs.vmware.com/

http://pubs.vmware.com/copyright-trademark.html

Contents

Installing and Upgrading VMware NSX Intelligence 4

1 Overview of NSX Intelligence 5

2 NSX Intelligence Installation and Configuration Workflow 6

3 Preparing for NSX Intelligence Installation 7NSX Intelligence System Requirements 9

4 Download the NSX Intelligence Installer Bundle 10

5 Install the NSX Intelligence Appliance 12

6 Upgrading NSX Intelligence 17Preparing to Upgrade the NSX Intelligence Appliance 17

Verify the Current State of the NSX Intelligence Appliance 18

Download the NSX Intelligence Appliance Upgrade Bundle 18

Upgrade the NSX Intelligence Appliance Using the CLI 19

Upgrade the NSX Intelligence Appliance Using the UI 22

7 Uninstall the NSX Intelligence Appliance 25

8 Troubleshooting NSX Intelligence Appliance Installation 26Credentials Were Incorrect or Account Provided Has Been Locked 26

Failed Status for the Appliance Deployment Does Not Get Cleared 27

Degraded Services Exist After a Successful Appliance Deployment 27

NSX Intelligence Appliance Installation Failed 28

NSX Intelligence Appliance Deletion Failed 29

Insufficient Privileges to Access NSX Intelligence 30

9 Troubleshooting NSX Intelligence Appliance Upgrade 31Upgrade Failed During the UI Plugin Registration Step 31

Upload of the Upgrade Bundle Failed 32

VMware, Inc. 3


The Installing and Upgrading VMware NSX Intelligence document describes how to install, configure, and upgrade VMware NSX® Intelligence™ .

Intended Audience

This information is intended for enterprise system administrators who must install or use the NSX Intelligence appliance. This information is provided for experienced enterprise system administrators who are familiar with virtual machine technology and network virtualization concepts.

Technical Publications Glossary

VMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For definitions of terms as they are used in VMware technical documentation, go to https://www.vmware.com/topics/glossary.

Related Documentation

If necessary, refer to the VMware NSX-T™ Data Center documentation at https://docs.vmware.com/en/VMware-NSX-T-Data-Center/index.html when you are installing or upgrading NSX Intelligence. You use the NSX Manager user interface to install the NSX Intelligence appliance and access NSX Intelligence features.

VMware, Inc. 4

https://www.vmware.com/topics/glossary

https://www.vmware.com/topics/glossary

https://docs.vmware.com/en/VMware-NSX-T-Data-Center/index.html

https://docs.vmware.com/en/VMware-NSX-T-Data-Center/index.html

Overview of NSX Intelligence 1VMware NSX® Intelligence™ provides a graphical user interface to visualize the security posture and network traffic flows that have occurred in your on-premises NSX-T Data Center environment.

NSX Intelligence is available for ESXi-based hosts beginning with NSX-T Data Center version 2.5. It provides the following functionalities.

n A graphical visualization of the NSX-T components, such as groups, VMs, and network traffic flows, in your NSX-T Data Center. The data used is based on the network traffic flows aggregated during the specified time period.

n Recommendations for security policies, policy security groups, and services for applications. The recommendations assist you with the implementation of micro-segmentation at the application level. They enable you to enforce a more dynamic security policy by correlating traffic patterns of communication that is occurring between the VMs in your NSX-T Data Center environment.

You can use NSX Intelligence if you have an NSX-T Data Center Enterprise Plus license.

Important You must have an Enterprise Administrator role to have permission to install, configure, back up, restore, and upgrade the NSX Intelligence appliance.

The NSX Intelligence appliance is available for two different deployment scenarios. A small appliance is available for a lab or proof-of-concept deployment, or small-scale production environment. You can use a large appliance for a large-scale production environment. See NSX Intelligence System Requirements.

To enable the NSX Intelligence functionality, you must install the NSX Intelligence appliance, which is delivered separately from the NSX-T Data Center appliance. You use the NSX Manager user interface (UI) to install the NSX Intelligence appliance. See Chapter 2 NSX Intelligence Installation and Configuration Workflow.

After you install and configure the NSX Intelligence appliance successfully, you access the NSX Intelligence features using the Plan & Troubleshoot > Discover & Plan tab in the NSX Manager UI. See "Getting Started With NSX Intelligence" in the Using and Managing VMware NSX Intelligence document.

VMware, Inc. 5

NSX Intelligence Installation and Configuration Workflow 2Use the following checklist to track your NSX Intelligence installation progress.

Perform the procedures in the order they are listed.

1 Install NSX-T Data Center 2.5 or later on an ESXi-based host. VMware NSX® Intelligence™ is supported on ESXi-based hosts only. See "NSX-T Data Center Installation Workflows" in the NSX-T Data Center Installation Guide.

2 Verify that the NSX-T Data Center version is compatible with the NSX Intelligence version that you intend to install. See VMware Product Interoperability Matrices at https://www.vmware.com/resources/compatibility/sim/interop_matrix.php#interop&555=&175=.

3 Ensure the NSX Intelligence system requirements are met. See NSX Intelligence System Requirements.

4 Configure the necessary ports and protocols required for NSX Intelligence. See VMware Ports and Protocols at https://ports.vmware.com/home/NSX-Intelligence.

5 Synchronize time on the NSX Manager VM and the compute cluster on which the NSX Intelligence appliance is to be deployed.

6 Download the NSX Intelligence installer OVA file from VMware Product Downloads. See Chapter 4 Download the NSX Intelligence Installer Bundle.

7 Install the NSX Intelligence appliance. See Chapter 5 Install the NSX Intelligence Appliance.

Important If you are installing the NSX Intelligence 1.1 appliance using NSX-T Data Center 2.5.x, you must use the instructions provided for the NSX Intelligence 1.0.x release, which was released with NSX-T Data Center 2.5.x. See Download and Unpack the NSX Intelligence Installer Bundle and Install the NSX Intelligence Appliance. You can use the same commands described in those topics to unpack the NSX Intelligence installer OVA file that you download from the VMware Products Download portal and to install the NSX Intelligence appliance.

8 To enable the NSX Intelligence user interface (UI) in the NSX Manager UI, refresh the web browser you are using for the NSX Manager session.

9 Begin using the NSX Intelligence features. See "Getting Started with NSX Intelligence" in the Using VMware NSX Intelligence documentation.

VMware, Inc. 6

https://www.vmware.com/resources/compatibility/sim/interop_matrix.php#interop&555=&175=


https://ports.vmware.com/home/NSX-Intelligence

https://docs.vmware.com/en/VMware-NSX-Intelligence/1.0/installation/GUID-BB24AACC-D699-49FD-8436-8FD8BC9A704C.html


https://docs.vmware.com/en/VMware-NSX-Intelligence/1.0/installation/GUID-45906AC9-7FD7-441E-83F9-E83CC68E8148.html

Preparing for NSX Intelligence Installation 3You must prepare the deployment environment so that it meets the minimum system requirements required for installing NSX Intelligence.

The following table details the NSX Intelligence deployment, platform, and installation requirements.

Requirements Description

NSX-T Data Center 2.5 or later with a NSX-T Data Center Enterprise Plus license

NSX-T Data Center 2.5 or later that is installed on an ESXi-based host, such as VMware vSphere®. See "NSX-T Data Center Installation Workflows" in the NSX-T Data Center Installation Guide.

Important Verify that your current version of NSX-T Data Center version is compatible with the NSX Intelligence version that you plan to install. See the VMware Product Interoperability Matrices at https://www.vmware.com/resources/compatibility/sim/interop_matrix.php#interop&555=&175=.

Supported deployment method OVA deployed using NSX Manager on the VMware vCenter Server™ that has been added as a compute manager.

Important The NSX Intelligence appliance can only be installed using NSX Manager and is not supported when the OVA is installed independently.

Supported Platform ESXi hosts managed by vCenter Server.

VMware, Inc. 7




Requirements Description

Certificate n If your NSX Manager uses CA-signed certificates with partial chain on the NSX Manager Unified Appliance cluster, you must replace the certificate with a full certificate chain. See VMware Knowledge Base article https://kb.vmware.com/s/article/78317 for more information.

n Ensure that the certificates used for the NSX Manager Unified Appliance node or cluster are compatible with the following certificate types. The following message algorithms, key sizes, and signature algorithms are compatible with the NSX Intelligence appliance.

n Message Algorithm: RSA

Key Sizes: 2048, 3072, 4096

n Signature algorithms: SHA256, SHA384, SHA512

Using a message algorithm, such as DSA or EC, might cause failures during the NSX Intelligence appliance deployment. A host might be unable to report flows or configuration update from the NSX Manager Unified Appliance because it is unable to reach the NSX Intelligence appliance.

IP address An NSX Intelligence appliance must have a static IP address. You cannot change the IP address after installation.

NSX Intelligence Appliance Password n At least 12 characters

n At least one lower-case letter

n At least one upper-case letter

n At least one digit

n At least one special character

n At least five different characters

n No dictionary words

n No palindromes

n More than four monotonic character sequences are not allowed.

VMware Tools™ The NSX Intelligence virtual machine running on an ESXi host has VMware Tools installed. Do not remove VMware Tools.

System n Verify that the system requirements are met. See NSX Intelligence System Requirements.

n Verify that the required ports are open. See https://ports.vmware.com/home/NSX-Intelligence.

n Obtain the IP address information for the management subnet and gateway, DNS server IP address, and the NTP server IP address for the NSX Intelligence appliance to use.

n Verify that an SSD-based datastore is configured and accessible to the NSX Intelligence appliance.


VMware, Inc. 8

https://kb.vmware.com/s/article/78317



This chapter includes the following topics:

n NSX Intelligence System Requirements

NSX Intelligence System Requirements

Before you install the NSX Intelligence appliance, ensure that your environment meets the minimum supported system requirements for both the server and the client systems. The server host is where you install the NSX Intelligence appliance and the client system is where the NSX Intelligence user interface (UI) features are displayed.

NSX Intelligence Appliance Resource Requirements and Limits

The following table lists the available NSX Intelligence appliance sizes, the resources required, and the estimated maximum number of supported hosts, VM workloads, and traffic flows for each size. The NSX Intelligence Small VM appliance size is suitable for lab and proof-of-concept deployments, or small-scale production environment. The NSX Intelligence Large VM appliance size is suitable for a production environment.

Appliance Size Memory vCPU Disk SpaceMax. # of Hosts

Max # of VM Workloads Max. # of Flows

NSX Intelligence Small 64 GB 16 2 TB 50 2,000 250,000 flows per 5 minutes

NSX Intelligence Large 128 GB 32 2 TB 100 5,000 500,000 flows per 5 minutes

Note Only one NSX Intelligence appliance is supported per NSX Manager cluster.

NSX Intelligence Web Client Memory, CPU, and Browser Requirements

For an optimal performance, your client system must have a minimum of two 1.4 GHz CPU cores and at least 16 GB of RAM.

The following table lists the Web browser versions supported for NSX Intelligence. The minimum supported browser resolution is 1280 x 800 pixels.

Browser Windows 10 Mac OS X 10.15, 10.14 Ubuntu 18.4

Google Chrome 80 Yes Yes Yes

Mozilla Firefox 72 Yes Yes Yes

Microsoft Edge 80 Yes Yes Yes


VMware, Inc. 9

Download the NSX Intelligence Installer Bundle 4To install the NSX Intelligence appliance, download the NSX Intelligence OVA installer bundle file. The bundle file contains the OVA and other supporting files that are used for installing the NSX Intelligence appliance.

Prerequisites

n Verify that you are entitled to use NSX Intelligence. You can use NSX Intelligence if you have an NSX-T Data Center Enterprise Plus license.

n You must have an Enterprise Administrator user role to install, configure, update, and use NSX Intelligence.

n Verify that you have the proper permission to download the OVA file to your local system or to a web server.

n If you are downloading to a local web server, ensure that it is using the default port 80 for HTTP and that it is accessible from the NSX Manager user interface.

n If you are downloading to an IIS web server on a Windows system, verify that the web server is set up to support the application/vmware MIME type. If necessary, manually update your IIS web server.

Procedure

1 Locate the NSX Intelligence installer OVA file on the VMware Products Download portal.

2 Download the OVA file to a local datastore or a local web server.

Note The currently supported web server is IIS for a Windows system and Apache for Linux or Mac OS. You can use another web server of your choice, but IIS and Apache are the web servers tested and supported for these operating systems.

The OVA filename has the following format VMware-NSX-Intelligence-appliance-<release-number>.<build-number>.ova. For example, VMware-NSX-Intelligence-appliance-1.1.0.0.0.15620107.ova.

3 Copy the file path of the NSX Intelligence OVA file. For example, http://local-web-server/nsx-intelligence-appliance-1.0.0.0.0.14303803.ova, if you downloaded the OVA file to a local web server. You provide this path during the NSX Intelligence appliance installation process.

VMware, Inc. 10

What to do next

Proceed with installing the NSX Intelligence appliance. See Chapter 5 Install the NSX Intelligence Appliance.


VMware, Inc. 11

Install the NSX Intelligence Appliance 5You use the NSX Manager user interface (UI) to install and configure the NSX Intelligence appliance.

Before you can begin to use the NSX Intelligence features, you must install and configure the NSX Intelligence appliance to integrate the NSX Intelligence services and plugins with NSX Manager.

Important If you are installing the NSX Intelligence 1.1 appliance using NSX-T Data Center 2.5.x, you must use the instructions provided for the NSX Intelligence 1.0.x release, which was released with NSX-T Data Center 2.5.x. See Download and Unpack the NSX Intelligence Installer Bundle and Install the NSX Intelligence Appliance. You can use the same commands described in those topics to unpack the NSX Intelligence installer OVA file that you download from the VMware Products Download portal and to install the NSX Intelligence appliance.

Prerequisites

n Verify that the minimum NSX Intelligence system requirements are met for the appliance size you want to install. See Chapter 3 Preparing for NSX Intelligence Installation.

n You must have an Enterprise Administrator role to install, configure, and use NSX Intelligence.

n Locate the NSX Intelligence installer bundle file on the VMware download portal and download it locally. See Chapter 4 Download the NSX Intelligence Installer Bundle.

n Determine the size of the NSX Intelligence appliance to configure. Small size is for lab or proof-of-concept deployment, or small-scale production environment. Large size is for a large-scale production environment.

n Synchronize time between an NTP server, the compute cluster on which the NSX Intelligence appliance is to be deployed, and with the NSX Manager server.

n Collect the IP addresses for the management subnet, gateway, DNS server, and NTP server that are required to configure the NSX Intelligence appliance.

n Ensure that the certificates used for the NSX Manager Unified Appliance node or cluster are compatible with the certificate types listed in Chapter 3 Preparing for NSX Intelligence Installation.

VMware, Inc. 12


https://docs.vmware.com/en/VMware-NSX-Intelligence/1.0/installation/GUID-45906AC9-7FD7-441E-83F9-E83CC68E8148.html

Procedure

1 From your browser, log in with Enterprise Administrator privileges to an NSX Manager at https://<nsx-manager-ip-address>.

2 In NSX Manager, select System > Appliances.

3 Scroll down in the Appliances Overview pane, locate the NSX Intelligence Appliance card, and click Add NSX Intelligence Appliance.

If you have a cluster of NSX Manager nodes, you might receive a message asking you to log in to a specific NSX Manager node to upload the NSX Intelligence deployment bundle. Only one NSX Manager node is assigned as the orchestrator node and is used to deploy the NSX Intelligence appliance.

The Add Appliance wizard is displayed, as shown in the following image.

Note If you had previously uploaded an OVA file, the Appliance Information pane displays the Active Bundle Version text box and the version number of the previously uploaded OVA file. You do not need to upload another OVA file unless you want to use a different version. If you want to use a different OVA bundle version, click Change and provide the location of the new OVA file that you want to use.


VMware, Inc. 13

4 In the Add Appliance wizard, enter the NSX Intelligence appliance information.

Detail Item Action to Take

OVA File 1 From the drop-down menu, select one of the following menu items.

n Upload OVA File if you downloaded the NSX Intelligence OVA file in a locally accessible location.

n Remote OVA Link if you downloaded the NSX Intelligence OVA file to a remote Web server.

See Chapter 4 Download the NSX Intelligence Installer Bundle for more information.

2 If you selected Upload OVA File, click Select to enter the filename or navigate to the file location. If you selected Remote OVA Link, enter the URL for the NSX Intelligence OVA file that you downloaded. For example, if the file is on a remote web server, http://localhost/nsx-intelligence-appliance-1.1.0.0.0.15620107.ova.

3 Click Upload.

The upload progress is displayed.

You can continue to provide the rest of the appliance information as the OVA file is uploaded. When the OVA file has been successfully uploaded, a green Uploaded status is displayed.

Name Enter a hostname for the NSX Intelligence appliance.

This value can be a fully qualified domain name (preferred), such as subdomain.company.com, or a simple name, such as mytest-lab.

Management IP/Netmask Enter the IP address, including the range, to use for the NSX Intelligence appliance. For example, 10.11.22.33/24

Management Gateway Enter one gateway IP address for the NSX Intelligence appliance to use.

DNS Server Any known DNS servers are listed. Enter additional DNS server IP addresses, if necessary.

NTP Server Enter one or more NTP server IP addresses.

Appliance size Select the NSX Intelligence appliance size to configure.

A Small appliance size can be used for lab or proof-of-concept environment, or a small-scale production environment. A Large appliance size is for a large-scale production environment.

5 Click Next.

6 Enter the configuration details about where the NSX Intelligence appliance is to be deployed.


Compute Manager From the drop-down menu, select the compute manager on which to deploy the NSX Intelligence appliance.

Compute Cluster Use the drop-down menu to select the cluster to use.

Resource Pool (Optional) Select the resource pool to use from the drop-down menu.


VMware, Inc. 14


Host (Optional) Select the host from the drop-down menu. If you are using a cluster with several transport nodes, decide which transport node to use.

Note Explicitly selecting a host overrides the vCPU count check. Verify that the selected host has enough vCPU count to accommodate the size of the NSX Intelligence appliance you are installing. If the host does not, the resulting NSX Intelligence appliance might have an incorrect configuration. If you are unsure, leave the text box empty and a host is selected for you.

Datastore From the drop-down menu, select the datastore on which to store the NSX Intelligence configuration and data.

Virtual Disk Format Select a thick or thin provision from the drop-down menu.

Note

n If you select the Thick Provision format, the datastore infrastructure must support the hardware acceleration feature. If you selected Thick Provision and hardware acceleration is not supported, the system changes your selection to the Thin Provision format.

n If you selected vSAN in Datastore, you cannot select the virtual disk format. The storage policy assigned by VMware vCenter Server™ takes effect.

Network From the drop-down menu, select the network to be used.

7 Click Next.

8 Configure the Admin credentials and access to the NSX Intelligence appliance.

Enable SSHand Enable Root Access Select whether you want to allow SSH access or a root access to the NSX Intelligence appliance command-line interface (CLI).

By default, these access methods are disabled for security reasons. You use the CLI to configure a backup file server, back up the NSX Intelligence appliance configuration, and restore a backup.

System Root Credentials If you allowed root access, set the root password. Use the password requirements shown on the UI.

Admin CLI and Audit CLI Credentials Configure the Admin CLI credentials and Audit CLI credentials. Select Same as root password if you want to use the same root password you defined earlier for either the CLI password or Audit CLI password. Otherwise, enter the passwords for CLI password and Audit CLI password.


VMware, Inc. 15

9 Click Install Appliance.

The installation progress is shown on the NSX Intelligence Appliance card under the System > Configuration > Appliances tab . The installation can take anywhere from 5 to 30 minutes to finish. The installer deploys and registers the NSX Intelligence appliance with the NSX Manager. The installer checks the health status of the services and plug-ins that the NSX Intelligence appliance requires.

Note If there is any error reported, use the information provided in the error messages to resolve the reported problem. After the problem is resolved, you must uninstall the NSX Intelligence appliance first and try to reinstall it from the System > Appliances tab. See Chapter 7 Uninstall the NSX Intelligence Appliance or also Chapter 8 Troubleshooting NSX Intelligence Appliance Installation for possible hints in resolving problems you might have encountered.

10 After you receive the message that the NSX Intelligence appliance is successfully installed, click View NSX Intelligence.

If the deployment is taking longer than 30 minutes or if you see any error messages, consult the Chapter 8 Troubleshooting NSX Intelligence Appliance Installation topics.

The NSX Manager UI refreshes with the NSX Intelligence features enabled in the Plan & Troubleshoot > Discover & Plan section of the UI.

Important You cannot access the NSX Intelligence appliance directly using the IP address assigned to the appliance. You can only access the NSX Intelligence UI and features by logging in to the NSX Manager UI and clicking the Plan & Troubleshoot tab. The Discover & Take Action or Recommendations tabs in the Discover & Plan section of the UI provide access to the NSX Intelligence features.

What to do next

Begin using the NSX Intelligence features using the Plan & Troubleshoot > Discover & Plan section of the NSX Manager UI. See "Getting Started with NSX Intelligence" in the Using VMware NSX Intelligence document.


VMware, Inc. 16

Upgrading NSX Intelligence 6You can only upgrade your current VMware NSX® Intelligence™ version 1.0 configuration to a 1.1 or later version of the appliance using the NSX Intelligence command-line interface (CLI). Beginning with NSX Intelligence version 1.1, you can upgrade your NSX Intelligence appliance to a later version using the NSX Manager user interface (UI).

Important If your current NSX-T Data Center environment includes an older NSX Intelligence version, you must upgrade the NSX Intelligence version first before you can upgrade to a later NSX-T Data Center version.

Only an in-place upgrade mode is supported. All the configuration files and all the data from the /data partition of the NSX Intelligence appliance node are retained. There is no network traffic data migration support available.


n Preparing to Upgrade the NSX Intelligence Appliance

n Upgrade the NSX Intelligence Appliance Using the CLI

n Upgrade the NSX Intelligence Appliance Using the UI

Preparing to Upgrade the NSX Intelligence Appliance

Before you upgrade your NSX Intelligence appliance, make some preparations first.

Use the following list before proceeding with the upgrade.

1 Check to see if there are any known upgrade problems and workarounds documented in the VMware NSX Intelligence Release Notes.

2 Ensure that the NSX Manager Unified Appliance cluster has a valid NSX-T Data Center Enterprise Plus license that allows deployment and use of the NSX Intelligence appliance. Specifically, check that the license has not expired.

3 Verify that the current NSX Intelligence appliance is in a healthy state. See Verify the Current State of the NSX Intelligence Appliance.

4 Download the latest NSX Intelligence upgrade bundle. See Download the NSX Intelligence Appliance Upgrade Bundle.

VMware, Inc. 17

Verify the Current State of the NSX Intelligence Appliance

Before you begin the upgrade process, it is important to test the NSX Intelligence appliance's working state to help determine whether any post-upgrade problems you might encounter are related to the upgrade.

Procedure

1 Identify and record the NSX Intelligence administrative IDs and passwords.

2 Click Plan & Troubleshoot > Discover & Take Action and verify that security positions are being displayed without errors.

3 Click Plan & Troubleshoot > Recommendations and verify that any existing recommendations are listed without errors and new recommendations can be generated without errors.

4 If you are upgrading from NSX Intelligence 1.1 or later, verify that there are no active alarms and that the NSX Intelligence appliance is in a healthy state.

a Click System > Configuration > Appliances.

b Locate the NSX Intelligence card.

c Verify that there are no open alarms and that the node is in a healthy state.

Download the NSX Intelligence Appliance Upgrade Bundle

Before you begin the upgrade process, download the correct NSX Intelligence upgrade bundle version and file type to use. The upgrade bundle contains all the files to upgrade your currently installed NSX Intelligence appliance.

Procedure

1 On the VMware Products Download portal, locate the NSX Intelligence version that you want to use.

2 Navigate to the location of the available upgrade bundles for the selected version.


VMware, Inc. 18

3 Use the following table to determine which upgrade bundle you must download.

Upgrade Path Bundle File Type Filename Format Example

NSX Intelligence version 1.0 to version 1.1 or later

NUB VMware-NSX-

Intelligence-

appliance-

BundleReleaseNumber.NSXIntelligenceBuildNumber.nub

VMware-NSX-Intelligence-

appliance-1.1.0.0.0.1574

7280.nub

NSX Intelligence version 1.1 to a later version

MUB VMware-NSX-

Intelligence-upgrade-

bundle-

BundleReleaseNumber.NSXIntelligenceBuildNumber.mub

VMware-NSX-Intelligence-

upgrade-

bundle-1.1.1.0.0.1583576

0.mub

4 Download the appropriate NSX Intelligence upgrade bundle to a local system or to a remote Web server that is accessible from the NSX Intelligence appliance.

What to do next

Install the upgrade bundle to your current NSX Intelligence installation.

n If you are upgrading from NSX Intelligence version 1.0.x, see Upgrade the NSX Intelligence Appliance Using the CLI.

n If you are upgrading from NSX Intelligence version 1.1 or later, see Upgrade the NSX Intelligence Appliance Using the UI.

Upgrade the NSX Intelligence Appliance Using the CLI

You can only use the NSX Intelligence CLI to upgrade your NSX Intelligence version 1.0 appliance to a 1.1 or later version.

Caution When using the CLI method to upgrade the NSX Intelligence appliance, do not forcefully end the SSH session or press Ctrl+C. Doing so ends the upgrade process and might leave the NSX Intelligence appliance in an unhealthy state.

Prerequisites

n Download the NSX Intelligence appliance upgrade bundle (.nub) file. See Download the NSX Intelligence Appliance Upgrade Bundle.

n Verify that there is free space in the /tmp partition in the NSX Intelligence host that is at least the size of the upgrade bundle file that you downloaded. Also, verify that there is at least twice the size of the upgrade bundle file or 4 GB of free space in the /image partition in the NSX Intelligence host.


VMware, Inc. 19

Procedure

1 Log in to your NSX Intelligence appliance using the CLI admin credentials that you had set up during the initial installation.

$ssh admin@<NSX Intelligence IP Address>

2 From the NSX Intelligence command line, use the following command to copy the NSX Intelligence .nub upgrade file from where you downloaded it.

copy url <url_to_NSX_intelligence_upgrade_nub>

For example,

copy url http://localserver/VMware-NSX-Intelligence-appliance-1.1.0.0.0.15188324.nub

3 Verify the upgrade bundle using the following command.

Tip Press Tab after entering upgrade-bundle and the <upgrade_bundle_name> is auto-filled.

verify upgrade-bundle upgrade_bundle_name

Following is a sample output for the verify upgrade-bundle command.

Checking upgrade bundle /var/vmware/nsx/file-store/VMware-NSX-Intelligence-

appliance-1.1.0.0.0.15188324.nub contents

Verifying bundle VMware-NSX-Intelligence-appliance-1.1.0.0.0.15188324.bundle with signature

VMware-NSX-Intelligence-appliance-1.1.0.0.0.15188324.bundle.sig

Moving bundle to /image/VMware-NSX-Intelligence-appliance-1.1.0.0.0.15188324.bundle

Extracting bundle payload

Successfully verified upgrade bundle

Bundle manifest:

appliance_type: 'nsx-intelligence-appliance'

version: '1.1.0.0.0.15188324'

os_image_path: 'files/nsx-root.squashfs'

os_image_md5_path: 'files/nsx-root.squashfs.md5'

Current upgrade info:

{

"info": "",

"body": {

"meta": {

"from_version": "1.0.1.0.0.14576942",

"old_data_dev": "/dev/mapper/nsx-data",

"new_data_dev": "/dev/mapper/nsx-data__bak",

"new_os_dev": "/dev/sda3",

"to_version": "1.1.0.0.0.15188324",

"new_config_dev": "/dev/mapper/nsx-config__bak",

"old_os_dev": "/dev/sda2",

"bundle_path": "/image/VMware-NSX-Intelligence-appliance-1.1.0.0.0.15188324",

"old_config_dev": "/dev/mapper/nsx-config"

},

"history": []


VMware, Inc. 20

},

"state": 1,

"state_text": "CMD_SUCCESS"

}

4 Upgrade the NSX Intelligence appliance using the NSX Intelligence Playbook.

Tip Press Tab after entering upgrade-bundle and the <upgrade_bundle_name> is auto-filled. Press Tab after entering playbook and the <nsx_intelligence_playbook_name> is auto-populated.

start upgrade-bundle <upgrade_bundle_name> playbook <nsx_intelligence_playbook_name>

The system reboots as part of the upgrade process, as shown in the following example.

mynsxintel> start upgrade-bundle VMware-NSX-Intelligence-appliance-1.1.0.0.0.15188324 playbook

VMware-NSX-Intelligence-appliance-1.1.0.0.0.15188324-playbook

****************************************************************************

Node Upgrade is in progress. Please do not make any changes, until

the upgrade operation is complete.

****************************************************************************

2020-02-13 13:50:26,455 - Validating playbook /var/vmware/nsx/file-store/VMware-NSX-Intelligence-

appliance-1.1.0.0.0.15188324-playbook.yml

2020-02-13 13:50:26,583 - Running "shutdown_pace_svc" (step 1 of 7)

2020-02-13 13:50:51,734 - Running "install_os" (step 2 of 7)

2020-02-13 13:51:55,482 - Running "retain_pace_config" (step 3 of 7)

2020-02-13 13:52:00,529 - Running "switch_os" (step 4 of 7)

2020-02-13 13:52:17,786 -

System will now reboot (step 5 of 7)

{

"info": "",

"body": null,

"state": 1,


}

mynsxintel>

Broadcast message from root@mynsxintel (Fri 2020-02-13 13:52:22 UTC):

The system is going down for reboot at Fri 2020-02-13 13:53:22 UTC!

5 (Optional) If you are upgrading from NSX Intelligence 1.0.1 or later, you can verify the upgrade's progress using the following command.

get upgrade progress-status


VMware, Inc. 21

6 (Optional) After the reboot process is finished, log in to the NSX Intelligence appliance console as the root user to verify the appliance upgrade status in the /var/log/resume-upgrade.log file.

root@mynsxintel:~# cat /var/log/resume-upgrade.log

2020-02-13 13:53:45,798 - Resuming paused playbook /var/vmware/nsx/file-store/VMware-NSX-

Intelligence-appliance-1.1.0.0.0.15188324-playbook.yml

2020-02-13 13:53:45,799 - Validating playbook /var/vmware/nsx/file-store/VMware-NSX-Intelligence-

appliance-1.1.0.0.0.15188324-playbook.yml

2020-02-13 13:53:45,904 - Running "start_pace_svc" (step 6 of 7)

2020-02-13 13:53:51,002 - Running "finish_upgrade" (step 7 of 7)

2020-02-13 13:53:51,421 - Playbook finished successfully

{

"info": "",

"body": null,

"state": 1,


}

7 (Optional) From the NSX Intelligence appliance console, verify that the NSX Intelligence appliance version is correct and matches the version of the upgrade bundle you downloaded from the VMware download portal.

get version

Following is a sample output based on the examples used in earlier steps.

mynsxintel> get version

VMware NSX Intelligence, Version 1.1.0.0.0.15188324

Upgrade the NSX Intelligence Appliance Using the UI

Use the NSX Manager user interface (UI) to upgrade your current NSX Intelligence version 1.1.x appliance to a later version of the appliance.

Beginning with NSX Intelligence version 1.1, you upgrade the NSX Intelligence appliance using the NSX Manager UI only. The upgrade bundle must be of the MUB filetype.

Caution Do not power off the NSX Intelligence appliance manually during the upgrade process. It is rebooted as part of the upgrade process.

Prerequisites

n Download the NSX Intelligence appliance bundle (.mub) file. See Download the NSX Intelligence Appliance Upgrade Bundle.

n Ensure that the /image partition in the NSX Manager host has enough space for the MUB file to be uploaded to the NSX Manager host.


VMware, Inc. 22

n The /image and /tmp partitions of the NSX Intelligence appliance node must have enough space to upload and verify the NSX Intelligence upgrade bundle.

Procedure

1 From your browser, log in with enterprise administrator privileges to an NSX Manager at https://<nsx-manager-ip-address>.

2 In NSX Manager, select System > Upgrade.

3 Locate the NSX Intelligence Appliances card and click Upgrade NSX Intelligence.

4 In the Upgrade Bundle pane, use the following to decide which method to use to upload the upgrade bundle.

n Select Upload MUB File if you downloaded the MUB update bundle to a local datastore.

n Select Upload From Remote Location if you downloaded the MUB update bundle to a remote Web server.

5 Enter the filename of the upgrade bundle using the following information.

Important The MUB filename entered must match exactly as the upgrade bundle file that you downloaded from the VMware Products Download portal.

a If you selected the Upload MUB File method, click Select File, navigate to the downloaded MUB file location, and select the file.

b If you selected Upload From Remote Location method, enter the full URL of the MUB file you downloaded on your remote Web server.

6 Click Upload File.

The upload might take some time. The progress of the upload and verification of the upgrade bundle is displayed. If you decide not to continue with the upload, click Cancel. A message is displayed to confirm the bundle upload cancellation. You must reupload the bundle again to proceed with the upgrade process.

7 After the upgrade bundle is uploaded successfully, click Start Upgrade.

The Upgrade Coordinator is upgraded with the NSX Intelligence upgrade information. The Upgrade Coordinator runs in NSX Manager. It is a self-contained web application that orchestrates the upgrade process of NSX Intelligence and other NSX objects. The Upgrade Coordinator guides you through the proper upgrade sequence. You can track the upgrade process from the user interface.

8 After the Upgrade Coordinator is updated successfully, the Summary tab shows the version of the currently installed NSX Intelligence appliance and the target version to be used to upgrade the appliance.


VMware, Inc. 23

9 Click Run Pre-Checks.

The health of the NSX Intelligence appliance is verified. Also, the upgrade pre-check process verifies if there is any NSX-T Data Center appliance upgrade in progress and handles it accordingly. When the pre-checks are finished without errors, the green Ready text and checkmark icon appears on the NSX Intelligence upgrade card. If errors were encountered during the pre-checks, the error messages are displayed.

10 Click Next.

11 On the NSX Intelligence Appliance Upgrade tab, verify that the target version, upgrade unit, and IP address shown are correct.

12 Click Start Upgrade.

The Status column in the table changes from Not Started to In Progress and the upgrade's progress is displayed next to Details. If an error is encountered, the value in the Status column is changed to Failed. You can look at the error information provided in Details or click Recent Logs to view the upgrade process log output. Determine the necessary action you must do to resolve the error encountered.

13 (Optional) If the upgrade attempt failed and you have determined that it is safe to try the upgrade again, click Retry Upgrade.

The upgrade steps that finished successfully in the previous attempt are not redone. The upgrade process step where the failure happened is attempted again. When all the upgrade steps are finished successfully, the Upgrade Successful banner message is displayed and the Status value in the table is changed to Upgraded.

14 Click Finish.

The NSX Intelligence Appliances card displays the information about the new appliance version and the summary of the upgrade that finished.

What to do next

Navigate to Plan & Troubleshoot > Discover & Take Action and verify that the data flow visualization is intact and new traffic flow data is getting collected as expected.


VMware, Inc. 24

Uninstall the NSX Intelligence Appliance 7If you want to uninstall NSX Intelligence completely, use the following steps.

Procedure

1 From your browser, log in with enterprise administrator privileges to an NSX Manager at https://<nsx-manager-ip-address>.

2 In the NSX Manager UI, select System > Appliances.

3 Locate the NSX Intelligence appliance card.

4 Click Delete.

5 In the Confirm Appliance Deletion dialog box, click Confirm.

VMware, Inc. 25

Troubleshooting NSX Intelligence Appliance Installation 8This section provides information to resolve problems you might encounter when installing the NSX Intelligence appliance.


n Credentials Were Incorrect or Account Provided Has Been Locked

n Failed Status for the Appliance Deployment Does Not Get Cleared

n Degraded Services Exist After a Successful Appliance Deployment

n NSX Intelligence Appliance Installation Failed

n NSX Intelligence Appliance Deletion Failed

n Insufficient Privileges to Access NSX Intelligence

Credentials Were Incorrect or Account Provided Has Been Locked

An attempt to deploy the NSX Intelligence appliance resulted in the error message The credentials were incorrect or the account specified has been locked.

Problem

After the NSX Intelligence appliance installer was run, the error message The credentials were incorrect or the account specified has been locked is displayed when the installer was attempting to register the NSX Intelligence server with the NSX Manager

Cause

The registration step might have failed for one of the following reasons.

n The Management Plane token might have expired. The token is only valid for 30 minutes.

n The system time is not synchronized between the NSX Intelligence server host and the NSX Manager host.

Solution

1 Ensure that the system time is synchronized between the NSX Intelligence server host and the NSX Manager host.

VMware, Inc. 26

2 If system times are synchronized, verify if there is any network latency.

3 Remove the NSX Intelligence appliance and retry installing it again after synchronizing the system times or when the network latency is resolved.

Failed Status for the Appliance Deployment Does Not Get Cleared

NSX Intelligence appliance deployment succeeds, but the Appliance deployment failed status remains displayed.

Problem

When the initial attempt to deploy the NSX Intelligence appliance fails, for example due to an insufficient resource problem, the failed deployment status message does not get cleared even after the reported problem is resolved.

Cause

When the underlying root cause of the reported deployment problem has been resolved, the NSX Intelligence appliance is not aware of it because the resolution is performed external to the NSX Intelligence appliance.

Solution

1 After you resolve the problem reported during the earlier attempt to deploy the appliance, uninstall the NSX Intelligence appliance.

2 Attempt to reinstall the NSX Intelligence appliance from the System > Appliances tab.

3 (Optional) To obtain the updated deployment status of the NSX Intelligence appliance, refresh your web browser.

Degraded Services Exist After a Successful Appliance Deployment

The NSX Intelligence appliance deployed successfully, but there are some degraded services that exist.

Problem

The NSX Intelligence appliance deployed successfully, but the appliance's health is reported as Degraded. This Degraded health status is reported either immediately after the NSX Intelligence appliance is deployed or at a later stage in the appliance's lifecycle .


VMware, Inc. 27

Cause

The cause can be any of the following reasons.

1 Service startup on NSX Intelligence depends on the receipt of specific configuration information from the NSX Manager Unified Appliance. During the initial NSX Intelligence startup, this configuration might take some time to finish and the NSX Intelligence appliance is expected to remain in the Degraded state for approximately 15 minutes.

2 If this problem is observed during a different time in the NSX Intelligence appliance's lifecycle, the problem might be due to a resource contention on the NSX Intelligence appliance.

3 The NSX Intelligence appliance's certificate is incompatible with the certificate on the NSX Manager Unified Appliance.

Solution

The following possible solutions correspond accordingly to the problems listed in the preceding Problems section.

1 After the initial NSX Intelligence appliance deployment, you must wait for the initial configuration synchronization to finish. Wait for approximately 30 minutes after the system is powered on for the appliance to reach the Stable state. Refresh your web browser after the NSX Intelligence appliance is no longer in the Degraded state.

2 If the problem is due to a resource contention, allow about 30 minutes for the NSX Intelligence appliance's self-heal process to start.

3 Ensure that the certificates used for the NSX Manager Unified Appliance node or cluster are compatible with the certificate types listed in the "Preparing for NSX Intelligence Installation" topic in the Installing and Upgrading VMware NSX Intelligence document.

In the unlikely event that none of the above solutions work, contact your VMware representative for assistance.

NSX Intelligence Appliance Installation Failed

The NSX Intelligence appliance installation failed.

Problem

The NSX Intelligence appliance installation failed to complete successfully.

Cause

The NSX Intelligence appliance installation failed due to one of the following reasons.

n If the resources present in the NSX Intelligence system host is less than what is required, the appliance power-on might fail with the Insufficient Capacity error.


VMware, Inc. 28

n If the appliance registration failed due to CA certificate-related issues or the appliance deployment took more than 30 minutes, then the NSX Intelligence appliance installation might fail with the Registration Failed error.

Solution

To try to resolve the issue, perform one of the following suggested solutions that corresponds to the cause listed in the previous section.

n Verify that the resources on the NSX Intelligence system host meet at least the minimum prerequisites before restarting the installation of the NSX Intelligence appliance.

n If the Registration Failed error is displayed, ensure that the certificates used for the NSX Manager Unified Appliance node or cluster are compatible with the certificate types supported by NSX Intelligence NSX Intelligence. Delete the existing NSX Intelligence appliance and try reinstall it again.

n See Chapter 3 Preparing for NSX Intelligence Installation for more information about the minimum systems requirements.

NSX Intelligence Appliance Deletion Failed

The NSX Intelligence appliance deletion failed to complete.

Problem

An attempt to delete the NSX Intelligence appliance did not complete successfully.

Cause

If while the NSX Intelligence appliance's VM host is being powered off or deleted, a connectivity issue occurred between NSX Manager and vCenter Server, the deletion can fail.

Solution

Try to perform one or both of the follow suggested solutions.

n Verify that the connectivity between the NSX Manager and the vCenter Server is intact.

n Try deleting the NSX Intelligence appliance using the Force Delete option. After the delete operation is complete, verify that NSX Intelligence appliance's VM got deleted from vCenter Server. If the NSX Intelligence appliance's VM does not get deleted successfully, manually delete the VM from vCenter Server using the following high-level information. For more details, consult the documentation for your specific vCenter Server version.

a Log in to the vCenter Server that manages the VM host for the NSX Intelligence appliance.

b Power off the NSX Intelligence VM.

c Delete the NSX Intelligence VM from the datastore in the VM host.


VMware, Inc. 29

Insufficient Privileges to Access NSX Intelligence

An error is displayed after an attempt to log in directly to the NSX Intelligence appliance.

Problem

After a successful deployment of the NSX Intelligence appliance, the following error is displayed after trying to log in directly to the NSX Intelligence appliance using the IP address displayed on the NSX Intelligence appliance card.

The application server is unable to fulfill your request due to insufficient privileges.

You do not have the privileges to access NSX Intelligence. (403 Forbidden)

Cause

You cannot access the NSX Intelligence appliance directly using the IP address assigned to the appliance. You can only access the NSX Intelligence user interface (UI) and features by logging in to the NSX Manager UI and clicking the Plan & Troubleshoot tab.

Solution

1 From your browser, log in with the required privileges to an NSX Manager at https:<nsx-manager-ip-address>.

Ensure that you have the required privileges to access the NSX Intelligence UI. See "Role-Based Access Control in NSX Intelligence" in the Using and Managing VMware NSX Intelligence document for more information.

2 Navigate to the NSX Intelligence home page by clicking Plan & Troubleshoot tab.

3 In the Discover & Plan section, select either Discover & Take Action or Recommendations.

4 To learn more about the NSX Intelligence user interface and features, see "Getting Started with NSX Intelligence" in the Using and Managing VMware NSX Intelligence document.


VMware, Inc. 30

Troubleshooting NSX Intelligence Appliance Upgrade 9This section provides information to help you resolve problems you might encounter when upgrading the NSX Intelligence appliance.


n Upgrade Failed During the UI Plugin Registration Step

n Upload of the Upgrade Bundle Failed

Upgrade Failed During the UI Plugin Registration Step

When upgrading NSX Intelligence using NSX Manager Unified Appliance 2.5.x, the upgrade process might sometimes fail at the UI plugin registration step.

Problem

Either a change in the NSX Manager Unified Appliance node's IP address or certificate might have caused the UI plugin registration to fail. After the upgrade failure on the NSX Intelligence CLI session occurs, an upgrade status check reveals the failure occurred, as shown in the following example output from the get upgrade progress-status command.

nsx-intelligence> get upgrade progress-status

...output snipped...

Upgrade step status:

Name: update_plugin_registration

State: TASK_FAILURE

Errors:

Registration of node failed with status code 400

Status file:

wait_for_intelligence_server: resp_status: 200, body: b'{"results":[{"_links":

[],"_revision":0,"_create_user":"admin","_create_time":1581934303820,"_last_modified_user":"admin","_l

ast_modified_time":1581934303820,"_system_owned":false,"id":"default","path":"endpoints/

default","end_point_address":"20.20.0.11","protocol":"https","thumbprint":"2d7efed079858e3b9d8b83647f3

8e48c177d56cbb1ab6669a8d63899be0a5206"}]}'

Node Registration response - 400, b'{"error_code":400,"module_name":"common-

service","error_message":"I/O error on GET request for \\\\\\"https://20.20.0.11/api/v1/node/version\\

\\\\": No route to host (Host unreachable); nested exception is java.net.NoRouteToHostException: No

route to host (Host unreachable)"}'

VMware, Inc. 31

The following error snippet in the /var/log/resume-upgrade.log file also gives information about the UI plugin registration failure.

...output snipped...

2020-03-26 15:26:07,291 - Playbook failed at step update_plugin_registration. Run the command 'set

debug-mode' followed by 'start upgrade-bundle VMware-NSX-Intelligence-appliance-1.1.0.0.0.15898874

step get_upgrade_task_history' for more info.

{

"info": "[MUS] UpgradeError: Playbook failed at step update_plugin_registration. Run the command

'set debug-mode' followed by 'start upgrade-bundle VMware-NSX-Intelligence-

appliance-1.1.0.0.0.15898874 step get_upgrade_task_history' for more info.",

"state_text": "CMD_ERROR",

"state": 2,

"body": null

}

Cause

This problem can happen if the information about the NSX Manager Unified Appliance node is different from what is saved in the NSX Intelligence appliance. The NSX Manager Unified Appliance node's IP address or certificate might have changed since the last time the NSX Intelligence appliance was installed.

Solution

Update the information about the NSX Manager Unified Appliance node's IP address, certificate, and certificate thumbprint before resuming the NSX Intelligence upgrade process. Use the information provided in the VMware Knowledge Base article https://kb.vmware.com/s/article/78505 to resolve this problem.

Upload of the Upgrade Bundle Failed

You might get the Upgrade bundle upload failed error message when you try to upgrade your NSX Intelligence appliance to a newer version that you had previously deployed successfully, but you had deleted.

Problem

If you had successfully upgraded your NSX Intelligence appliance to a newer version (for example, 1.1.1.0.0.16275204) from an older version (for example, 1.1.0.0.0.15887964), but you decided to delete version 1.1.1.0.0.16275204 to redeploy version 1.1.0.0.0.15887964, you might see the following error.

Upgrade bundle upload failed! Upgrade coordinator is already at target version. Cannot re-trigger UC

upgrade.


VMware, Inc. 32



Cause

The NSX Intelligence Upgrade Coordinator (UC) already has the NSX Intelligence upgrade information for the newer NSX Intelligence bundle version (for example, 1.1.1.0.0.16275204) from the previous successful upgrade.

Solution

1 Using SSH, log in with Enterprise Administrator privileges to an NSX Manager node.

2 From the CLI, restart the Upgrade Coordinator using the following command.

restart service intelligence-upgrade-coordinator

3 After the NSX Intelligence Upgrade Coordinator is restarted successfully, try using the same NSX Intelligence upgrade bundle again to update your NSX Intelligence appliance.


VMware, Inc. 33

installing and upgrading vmware nsx intelligence - vmware ... · overview of nsx intelligence 1...

Documents