Add VMware NSX-V devices

Relevant for: AFA Administrators

This topic describes ASMS's support for VMware NSX-V devices.

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a VMware NSX-V device environment.

Back to top

Device permissions

ASMS requires the following to collect data from VMware NSX-V devices

ASMS requires minimal, read-only access permissions to access VMware NSX-V devices and perform data collection.

The user accessing the VMware NSX-V device must have one of the following roles:

  • Auditor
  • Security Admin
  • NSX Admin
  • Enterprise Admin

Note: If you are using an NSX Manager, we recommend using the build-in NSX Manager user to connect from ASMS.

When ActiveChange is enabled, the user connecting to the VMware NSX-V device requires read-write permissions.

  • Security Admin
  • Enterprise Admin

Note: When adding an NSX-V device to AFA with vCenter permissions, (both Admin and Read Only), the following data will be missing:

  • Device version
  • Device host name
  • NSX Manager IP

Back to top

Add a VMware NSX-V to AFA

This procedure describes how to add a VMware NSX-V device to AFA.

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page

  2. In the vendor device selection page, click VMware > NSX.

  3. Complete the fields as needed.

    Host

    Enter the host name or IP address of the NSX Manager. This is the name that will be displayed in the devices tree.

    User Name

    Enter the user name to use for REST access to the device.

    Password

    Enter the password to use for REST access to the device.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    Select the Learning mode option to specify that AFA traffic simulation should treat traffic that is not specified in a rule as blocked.

    In reality, the default behavior for NSX devices is to allow all traffic that is not explicitly blocked. Learning mode enables you to better understand the specific traffic that needs to be allowed on the device.

    Specify how AFA should acquire the device's routing information:

    • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.
    • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For details, see Specify routing data manually.

    Select the Enable ActiveChange option to enable ActiveChange for the device.

    Note: Enabling ActiveChange rollback for this device requires special configuration on the device.

    For more details, see Implement changes with ActiveChange and Enabling VMWare NSX ActiveChange Rollback.

    Real-time change monitoring

    Select this option to enable real-time change monitoring.

    For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for this device.
  4. Click Finish. The new device is added to the device tree.

  5. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    To select multiple users, press the CTRL button while selecting.

    Click OK to close the dialog.

    6. A success message appears to confirm that the device is added.

Back to top