Add VMware NSX-T data centers

Relevant for: AFA Administrators

This topic describes ASMS's support for VMware NSX-T data centers.

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a VMware NSX-T Data Center environment.

Device permissions

ASMS requires the following to collect data from VMware NSX-T data centers.

ASMS requires minimal, read-only access permissions to access VMware NSX-T data centers and perform data collection.

The user accessing the VMware NSX-T Data Center for analysis and monitoring must have one of the following NSX-T roles:

  • EA - Enterprise Administrator
  • A - Auditor
  • Custom role/permissions (use R flag for all features/components)

Note: If you are using the NSX Manager, we recommend using the built-in NSX Manager user to connect from ASMS.

When ActiveChange is enabled, the user connecting to the VMware NSX-T Data Center requires read-write permissions.

  • Enterprise Admin

Add a VMware NSX-T to AFA

This procedure describes how to add a VMware NSX-T Data Center to AFA.

Do the following:

  1. From the Administration area, access the Devices Setup page. For details, see Access the DEVICES SETUP page

  2. Click New > Devices > VMware > NSX-T. In the vendor device selection page, click VMware > NSX-T.

  3. Complete the fields as needed.

    Host

    Enter the host name or IP address of the NSX Manager. This is the name that will be displayed in the devices tree.

    User Name

    Enter the username to use for REST access to the device.

    Password

    Enter the password to use for REST access to the device.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    Select Enable ActiveChange to enable ActiveChange for the device. For more details, see Implement changes with ActiveChange.

    Select the Learning mode option to specify that AFA traffic simulation should treat traffic that is not specified in a rule as blocked.

    In reality, the default behavior for NSX-T devices is to allow all traffic that is not explicitly blocked. Learning mode enables you to better understand the specific traffic that needs to be allowed on the device.

    Note: Learning mode is supported for NSX-T versions 3.0 and above.

    Specify how AFA should acquire the device's routing information:

    • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.
    • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For details, see Specify routing data manually.

    Real-time change monitoring

    Select this option to enable real-time change monitoring.

    For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for this device.

    Learning mode



    You can select the Learning mode option to specify that AFA traffic simulation should treat traffic that is not specified in a rule as blocked. By default, DBWs allow all traffic that is not explicitly blocked. Learning mode enables you to better understand the specific traffic that needs to be allowed on the device.

    Note: Learning mode is not supported for NSX-T versions below 3.0.

  4. Click Finish. The new device is added to the device tree.

  5. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

    6. A success message appears to confirm that the device is added.

Upgrading to NSX-T Data Center from NSX-V

IMPORTANT: Do not delete the NSX-V device. Deletion of the device is irreversible and includes all associated reports and data.

Before Upgrading from NSX-V to NSX-T, do the following on the NSX-V:

  1. Rename the device.
  2. Turn off the monitor.
  3. Erase the password

Note: All the existing reports and history will be kept on this device as long as the device is not deleted. After being renamed, you will not be able to run analysis on the device.

Migration from NSX-V to NSX-T in the VMware environment.

Follow these steps to migrate from NSX-V to NSX-T:

  1. Add the NSX-T to ASMS with a new credential.
  2. Copy the trusted traffic from the former NSX-V device to the new NSX-T Data Center. AlgoSec Professional Services can assist.

  3. (optional but recommend) Back up all NSX-V reports before deleting the NSX-V device. AlgoSec Professional Services can assist.

    Important: Backup the NSX-V reports before deleting device to avoid irreversible loss of the NSX-V data.

  4. Delete the NSX-V device.