NSX CLI Guide

Manager

Associated Commands:

CLI Description	Command
Backup KeyManager data Create a backup of an NSX KeyManager node. If you do not provide a passphrase on the command line, you will be prompted to enter one. The passphrase is used to encrypt the backup. If you forget the passphrase, you will not be able to restore the backup. Important: This backup command is one part of the backup process. You must complete all backup and restore tasks in the correct order. See the NSX-T Administration Guide for information and instructions about performing backups and restores.	backup node file <filename> [passphrase <passphrase>]
Clear auth-policy vidm enabled property Clear the vidm service's enabled property.	clear auth-policy vidm enabled
Clear auth-policy vidm lb-extern enabled property Clear the external load balancer enabled property.	clear auth-policy vidm lb-extern enabled
Clear security banner or message of the day Clear the security banner or message of the day. The banner is reset to the system default banner.	clear banner
Clear Cluster Virtual IP Clear Cluster Virtual IP.	clear cluster vip
Clear all configured logging-servers Clear all logging server configuration.	clear logging-servers
Clear all name servers Clear all name servers from the DNS configuration.	clear name-servers
Clear search domains Remove all domain names from the DNS search list.	clear search-domains
Clear http service redirect host Clear the HTTP service redirect host.	clear service http redirect-host
Clear install-upgrade service enabled property Clear the install-upgrade service's enabled property.	clear service install-upgrade enabled
Clear manager service logging levels Clear the log levels of the manager service.	clear service manager logging-level
Clear NTP service start on boot Configure the NTP service to not start on boot.	clear service ntp start-on-boot
Clear snmp service start on boot Configure the snmp service to not start on boot.	clear service snmp start-on-boot
Clear SSH service start on boot Configure the SSH service to not start on boot.	clear service ssh start-on-boot
Clear SSH Root login property Disable SSH Root login property	clear ssh root-login
Disable password expiration for the user Disable password expiration for the user.	clear user <node-username> password-expiration
Copy a local file to remote file Copy a local file to a remote destination.	copy file <existing-file-arg> url <scp-file-url-arg>
Copy a remote file to the local file store Copy a remote file to the local file store. If no destination file is specified, the copied file has the same file name as the source file. You can use the file argument to specify a different destination file name.	copy url <url> [file <filename>]
Copy a remote https url file with same filename Copy a remote https url file to local file using same filename.	copy url <url> thumbprint <thumbprint> [file <filename>]
Remove all other management nodes from the cluster Remove all other management nodes from the cluster. This will effectively convert a multi-node management cluster into a single node setup. The system will prompt for confirmation for this operation. It is recommended to use GSS guidance before using this command.	deactivate cluster
Delete all packet capture sessions Delete all packet capture sessions.	del all capture sessions
Delete packet capture session Delete the specified packet capture session.	del capture session <session-id-arg>
Delete local file Delete a local file.	del file <existing-file-or-pattern-arg>
Delete logging-server Delete the specified logging server configuration. You can use the get logging-servers command to display the current logging server configuration.	del logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> [facility <facility>] [messageid <messageid>] [structured-data <structured-data>]
Delete name server Delete the specified name server from the DNS configuration.	del name-server <name-server-arg>
Remove NTP server Remove an existing NTP server.	del ntp-server <hostname-or-ip-address>
Delete route Delete the specified network route.	del route prefix <prefix> gateway <gateway-ip> [interface <interface-name>]
Delete a domain name Delete the specified domain name from the DNS search list.	del search-domains <search-domain-arg>
Delete SNMP v2 Trap Targets Delete SNMP v2 Trap Targets.	del snmp v2-targets <hostname-or-ip-address-optional-port-arg>
Delete SNMP v3 Trap Targets Delete SNMP v3 Trap Targets.	del snmp v3-targets <hostname-or-ip-address-optional-port-arg>
Delete SNMP v3 Users Delete SNMP v3 Users.	del snmp v3-users <user-id-arg>
Delete SSH service known host Delete the specified host entry from the SSH known hosts file.	del ssh-known-host <hostname-or-ip-address-optional-port-arg>
Delete SSH service keys from authorized_keys file for specified user Delete any SSH key with specified label from specified user's authorized_keys file. If password is not provided in the command then you are prompted to enter it. Password is required only for users root and admin.	del user <username> ssh-keys label <key-label> [password <password>]
Detach node from the management plane Detach this keymanager from the management plane. You can specify any NSX Manager in the management cluster in this command. Use the API username and password for the specified NSX Manager. If you do not provide a password on the command line, you will be prompted to enter one. Get the NSX Manager thumbprint by running the get certificate api thumbprint command on the specified NSX Manager.	detach management-plane <ip-address[:port]> username <username> thumbprint <thumbprint> [password <password>]
Detach specified node from the cluster Detach the specified node from the cluster.	detach node <node-id-arg>
Detach specified node from the cluster without checking repository-ip modification errors Detach specified node from the cluster without checking repository-ip modification errors.	detach node <node-id-arg> ignore-repository-ip-check
Display packet capture result Display the result of the specified packet capture session with the tcpdump command.	display capture session <session-id-arg>
Display packet capture result Display packet capture result with command tcpdump.	display capture session <session-id-arg> parameters <capture-options-arg>
Exit the CLI Exit the VRF context mode if you are in it. Otherwise, exit the CLI.	exit
Query all packet capture sessions Display information for all packet capture sessions.	get all capture sessions
Show system arp cache Display the ARP table.	get arp-table
Get API account lockout period Get the amount of time, in seconds, that an account will remain locked out of the API after exceeding the maximum number of failed authentication attempts.	get auth-policy api lockout-period
Get API account lockout reset period In order to trigger an account lockout, all authentication failures must occur in this time window. If the reset period exprires, the failed login count is reset to zero.	get auth-policy api lockout-reset-period
Get API maximum authentication faliures Get the number of failed API authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.	get auth-policy api max-auth-failures
Get CLI account lockout period Get the amount of time, in seconds, that an account will remain locked out of the CLI after exceeding the maximum number of failed authentication attempts.	get auth-policy cli lockout-period
Get CLI maximum authentication faliures Get the number of failed CLI authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.	get auth-policy cli max-auth-failures
Get minimum allowable password length Get the minimum number of characters that passwords must have.	get auth-policy minimum-password-length
Get auth-policy vidm Get the vidm's properties.	get auth-policy vidm
Query packet capture session Display information for the specified packet capture session.	get capture session <session-id-arg>
Display API server certificate Display the API server's certificate.	get certificate api
Display API server certificate thumbprint Display the API server's certificate thumbprint.	get certificate api thumbprint
Display cluster certificate Display the clsuter certificate.	get certificate cluster
Display cluster certificate text Display the cluster certificate text.	get certificate cluster text
Display cluster certificate thumbprint Display the cluster certificate thumbprint.	get certificate cluster thumbprint
Show the cgroup translation Display the translations for the specified container group. Optionally specify a translation type to display translations of that type.	get cgroup <uuid> [<translation-type>]
Show the group translation Display the translations for the specified container group. Optionally specify a translation type to display translations of that type.	get cgroup <uuid> [<translation-type>]
Show all existing cgroups Display all container groups.	get cgroups
Lookup cgroups for the IP address Display container groups with the specified IP address.	get cgroups with ip <ip46-address>
Lookup cgroups for the hardware address Display container groups with the specified MAC address.	get cgroups with mac <hardware-address>
Lookup cgroups for the network interface Display container groups with the specified network interface.	get cgroups with vif <vif-id-arg>
Show status to display datetime stamp Show status to display datetime stamp in command output.	get cli-output datetime
Show inactivity timeout Show inactivity timeout in seconds.	get cli-timeout
Display system clock Display the current date and time.	get clock
Get Cluster Config Get Cluster Config.	get cluster config
Get Cluster Status Get status of all the groups.	get cluster status
Get Cluster Status Get status of all the groups. Show leadership if there is any.	get cluster status verbose
Get Cluster Virtual IP Get Cluster Virtual IP.	get cluster vip
Display commands history Display the commands history in command output. To show all command history set size to 0. Note:Outputs command history from version 3.2.0 and above.	get command history
Show system configuration Display configuration settings in command line syntax.	get configuration
Show the system CPU status Display the system CPU information.	get cpu-stats
Show the datum ID(s) and span(s) for the message ID Display the datum ID(s) and span(s) for the specified message ID.	get data <data-id-arg>
Lookup datum ID(s) for the receiver Display datum ID(s) for the specified receiver.	get data with receiver <uuid-arg>
Get a domain object by id Display information about the specified domain object.	get domain-object <domain-object-id>
Find all domain objects of a given type Display domain objects of the specified type.	get domain-objects <domain-object-type>
Find all domain objects of a given type with the specified component name Display domain objects of the specified type with the specified component name	get domain-objects <objects-type-with-component-name> <component-name>
Show the content of End User License Agreement Show the content of End User License Agreement	get eula
Show the acceptance of End User License Agreement Show the acceptance of End User License Agreement	get eula acceptance
List file in the filestore Display information about the specified file in the filestore.	get file <existing-file-arg>
Display file thumbprint Display the file thumbprint.	get file <existing-file-arg> thumbprint
List files in the filestore Display information about the files in the filestore.	get files
Show the system storage capacity Display the file system information.	get filesystem-stats
Get the firewall exclusion list Display the firewall exclusion list.	get firewall exclude-list
Get current status of the firewall Display the firewall status.	get firewall status
Get the firewall summary Display the firewall summary.	get firewall summary
Display information about the specified Gateway Display information about the specified Gateway.	get gateway <gateway-id>
Display the routing table for the specified Gateway Display the routing table for the specified Gateway.	get gateway <gateway-id> <route-arg>
Display a specific IPv4 route on the specified Gateway Display a specific IPv4 route on the specified Gateway.	get gateway <gateway-id> <route-arg> <network-address>
Display information about a specific interface on the specified Gateway Display information about a specific interface on the specified Gateway	get gateway <gateway-id> interface <gateway-interface-id>
Display all interfaces on the specified gateway Display all interfaces on the specified gateway.	get gateway <gateway-id> interfaces
Get all routing Config entities on the specified Service Gateway Get all routing Config entities on the specified Service Gateway.	get gateway <gateway-id> routing-config
Display specific IPv4 routes from all the Gateway Display specific IPv4 routes from all the Gateway.	get gateway routes <network-address>
Display information about all gateways Display information about all gateways.	get gateways
Show all existing groups Display all groups.	get groups
Lookup groups for the IP address Display groups with the specified IP address.	get groups with ip <ip46-address>
Lookup groups for the hardware address Display groups with the specified MAC address.	get groups with mac <hardware-address>
Lookup group for the network interface Display groups with the specified network interface.	get groups with vif <vif-id-arg>
Display system hostname Display the system hostname.	get hostname
Display network interface properties Display information about the specified network interface.	get interface <interface-name-arg>
Display all network interface properties Display information about all network interfaces.	get interfaces
Get the last barrier processed by NestDb Pigeon for the specified transport node Get the last barrier processed by NestDb Pigeon for the specified transport node.	get last processed barrier <uuid-arg>
Show log file contents Display the contents of the specified log file.	get log-file <log-file-arg>
Show log file contents Display the last 10 lines of the specified log file and all new messages that are written to the log file.	get log-file <log-file-arg> follow
Display all configured logging servers Display logging server configuration.	get logging-servers
Display information about the specified logical router Display information about the specified logical router.	get logical-router <logical-router-id>
Display the routing table for the specified logical router Display the routing table for the specified logical router.	get logical-router <logical-router-id> <route-arg>
Display a specific IPv4 route on the specified logical router Display a specific IPv4 route on the specified logical router.	get logical-router <logical-router-id> <route-arg> <network-address>
Display information about a specific interface on the specified logical router Display information about a specific interface on the specified logical router.	get logical-router <logical-router-id> interface <logical-router-interface-id>
Display all interfaces on the specified logical router Display all interfaces on the specified logical router.	get logical-router <logical-router-id> interfaces
Get all routing Config entities on the specified Service Router Get all routing Config entities on the specified Service Router.	get logical-router <logical-router-id> routing-config
Display specific IPv4 routes from all the logical routers Display specific IPv4 routes from all the logical routers.	get logical-router routes <network-address>
Display information about all logical routers Display information about all logical routers.	get logical-routers
Display the logical switch ports Display port information for the specified logical switch.	get logical-switch <uuid-arg> ports
Display information about a logical switch Display information about the specified logical switch. Use the get logical-switches command to get a list of all logical switches. You can use the VNI or UUID to specify the logical switch.	get logical-switch <vni-or-uuid-arg>
Display local ARP table for a logical switch Display local ARP table for the specified logical switch.	get logical-switch <vni-or-uuid-arg> arp-table
Display ARP table for a logical switch for both local and remote records Display the ARP table for the specified logical switch for both local and remote records.	get logical-switch <vni-or-uuid-arg> arp-table all
Display ARP table for a logical switch for both local and remote records Display the ARP table for the specified logical switch for both local and remote records	get logical-switch <vni-or-uuid-arg> arp-table all verbose
Display ARP table for a logical switch for only remote records, show site id at column TransportNodeId Display the ARP table for the specified logical switch for only remote records.	get logical-switch <vni-or-uuid-arg> arp-table remote
Display ARP table for a logical switch for only remote records Display the ARP table for the specified logical switch for only remote records.	get logical-switch <vni-or-uuid-arg> arp-table remote verbose
Display local ARP table for a logical switch Display local ARP table for the specified logical switch.	get logical-switch <vni-or-uuid-arg> arp-table verbose
Display local MAC table for a logical switch Display local MAC address table for the specified logical switch.	get logical-switch <vni-or-uuid-arg> mac-table
Display MAC table for a logical switch for both local and remote mac records Display the MAC address table for the specified logical switch for both local and remote mac records.	get logical-switch <vni-or-uuid-arg> mac-table all
Display MAC table for a logical switch for both local and remote records Display the MAC address table for the specified logical switch for both local and remote records.	get logical-switch <vni-or-uuid-arg> mac-table all verbose
Display MAC table for a logical switch for only remote mac records Display the MAC address table for the specified logical switch for only remote mac records.	get logical-switch <vni-or-uuid-arg> mac-table remote
Display MAC table for a logical switch for only remote records Display the MAC address table for the specified logical switch for only remote records.	get logical-switch <vni-or-uuid-arg> mac-table remote verbose
Display local MAC table for a logical switch Display local MAC address table for the specified logical switch.	get logical-switch <vni-or-uuid-arg> mac-table verbose
Display RTEP Group synced from remote site, the first row shows local RTEP Group. Display RTEP Group synced from remote site	get logical-switch <vni-or-uuid-arg> rtep-group
Display statistics information about the specified logical switch Display statistics information about the specified logical switch.	get logical-switch <vni-or-uuid-arg> stats
Display transport nodes which joined a given logical switch Display transport nodes which joined a given logical switch.	get logical-switch <vni-or-uuid-arg> transport-node-table
Display information about a logical switch Display information about the specified logical switch and logical switch ports associated with it. Use the get logical-switches command to get a list of all logical switches. You can use the VNI or UUID to specify the logical switch.	get logical-switch <vni-or-uuid-arg> verbose
Display all virtual tunnel end points related to the specified logical switch Display all virtual tunnel end points related to the specified logical switch.	get logical-switch <vni-or-uuid-arg> vtep
Display all virtual tunnel end points related to the specified logical switch Display all virtual tunnel end points related to the specified logical switch.	get logical-switch <vni-or-uuid-arg> vtep verbose
Display the logical switch port Display information about the specified logical switch port.	get logical-switch-port <uuid-arg>
Display information about all logical switches Display information about all logical switches.	get logical-switches
Display a summary of all logical switch statistics Display a summary of all logical switch statistics.	get logical-switches stats
Show managers Show the current list of configured managers.	get managers
Show the system memory status Display the system memory information.	get memory-stats
Get all name servers Get all name servers in the DNS configuration.	get name-servers
Show the system network statistics Display the system network statistics.	get network-stats
Get central-config properties Get central-config properties.	get node central-config
Display upgrade status of the node Display upgrade status of the node.	get node upgrade status
Display registered nodes Display the list of registered nodes.	get nodes
Show NTP associations Display the status of the NTP system. The delay, offset and dispersion values are in seconds.	get ntp-server associations
Show NTP servers Display all NTP servers.	get ntp-servers
Display system processes Display a snapshot of the system processes.	get processes
Monitor system processes Display information about processes that are running. The display is updated every few seconds.	get processes monitor
Get the realization status for the specified transport node Get the realization status for the specified transport node.	get realization-status <uuid-arg>
Get all connected receivers Display all connected receivers.	get receivers
Display a specific IPv4 route Display the specified IPv4 route.	get route prefix <cidr-notation>
Display IPv4 routes Display all configured IPv4 routes.	get routes
Display information about all routing domains Display information about all routing domains.	get routing-domain <uuid-arg> vtep
Display information about all routing domains Display information about all routing domains.	get routing-domains
Get all search domains Get all domain names in the DNS search list.	get search-domains
Display the segment ports Display port information for the specified segment.	get segment <uuid-arg> ports
Display information about a Segment Display information about the specified segment. Use the get segmentss command to get a list of all segments. You can use the VNI or UUID to specify the logical switch.	get segment <vni-or-uuid-arg>
Display local ARP table for a segment Display local ARP table for the specified segment.	get segment <vni-or-uuid-arg> arp-table
Display ARP table for a segment for both local and remote records Display the ARP table for the specified segment for both local and remote records.	get segment <vni-or-uuid-arg> arp-table all
Display ARP table for a segment for both local and remote records Display the ARP table for the specified segment for both local and remote records	get segment <vni-or-uuid-arg> arp-table all verbose
Display ARP table for a Segment for only remote records, show site id at column TransportNodeId Display the ARP table for the specified segment for only remote records.	get segment <vni-or-uuid-arg> arp-table remote
Display ARP table for a segment for only remote records Display the ARP table for the specified segment for only remote records.	get segment <vni-or-uuid-arg> arp-table remote verbose
Display local ARP table for a segment Display local ARP table for the specified segment.	get segment <vni-or-uuid-arg> arp-table verbose
Display local MAC table for a segment Display local MAC address table for the specified Segment.	get segment <vni-or-uuid-arg> mac-table
Display MAC table for a segment for both local and remote mac records Display the MAC address table for the specified segment for both local and remote mac records.	get segment <vni-or-uuid-arg> mac-table all
Display MAC table for a segment for both local and remote records Display the MAC address table for the specified segment for both local and remote records.	get segment <vni-or-uuid-arg> mac-table all verbose
Display MAC table for a segment for only remote mac records Display the MAC address table for the specified Segment for only remote mac records.	get segment <vni-or-uuid-arg> mac-table remote
Display MAC table for a segment for only remote records Display the MAC address table for the specified segment for only remote records.	get segment <vni-or-uuid-arg> mac-table remote verbose
Display local MAC table for a segment Display local MAC address table for the specified segment.	get segment <vni-or-uuid-arg> mac-table verbose
Display RTEP Group synced from remote site, the first row shows local RTEP Group. Display RTEP Group synced from remote site	get segment <vni-or-uuid-arg> rtep-group
Display transport nodes which joined a given segment Display transport nodes which joined a given segment.	get segment <vni-or-uuid-arg> transport-node-table
Display information about a segment Display information about the specified Segment and segment ports associated with it. Use the get segments command to get a list of all segmentss. You can use the VNI or UUID to specify the segment.	get segment <vni-or-uuid-arg> verbose
Display all virtual tunnel end points related to the specified segment Display all virtual tunnel end points related to the specified segment.	get segment <vni-or-uuid-arg> vtep
Display all virtual tunnel end points related to the specified segment Display all virtual tunnel end points related to the specified segment.	get segment <vni-or-uuid-arg> vtep verbose
Display the segment port Display information about the specified segment port.	get segment-port <uuid-arg>
Display information about all Segments Display information about all Segments.	get segments
Display statistics information about the specified segment Display statistics information about the specified Segment.	get segments <vni-or-uuid-arg> stats
Display a summary of all segment statistics Display a summary of all segment statistics.	get segments stats
Display service properties Display information about the specified service.	get service <service-name-arg>
Display global logging configuration Display global logging configuration.	get service controller logging-config
Display configuration for logger with given log level Display the logging configuration for components that have the specified log level.	get service controller logging-config logging-level <controller-logging-level-arg>
Display configuration for given logger Display the logging configuration for the specified component.	get service controller logging-config name <string-arg-controller>
Display configuration for loggers matching to given regex Display the logging configuration for components that match the specified pattern. The pattern can be a regular expression.	get service controller logging-config pattern <string-arg-controller>
Display the controller service logging level Display the log level for the controller service.	get service controller logging-level
Display service properties Display information about all services.	get services
Show the remote site(s) and their sync status Display the remote sites along with their sync status.	get site-replicator remote-sites
Get SNMP v2 configured status Indicates whether the local SNMP agent is configured with community string(s).	get snmp v2-configured
Get SNMP v2 Trap Targets Get SNMP v2 Trap Targets.	get snmp v2-targets
Get SNMP v3 configured status Indicates whether the local SNMP agent is configured with v3 user(s).	get snmp v3-configured
Get SNMP v3 Engine ID Get SNMP v3 Engine ID.	get snmp v3-engine-id
Get SNMP v3 Protocols Get SNMP v3 Protocols auth_protocol and priv_protocol.	get snmp v3-protocols
Get SNMP v3 Trap Targets Get SNMP v3 Trap Targets.	get snmp v3-targets
Get SNMP v3 User IDs Get SNMP v3 User IDs.	get snmp v3-users
Show active network connections Display active network connections.	get sockets
Show the stretched cgroup translation on both local and remote sites Display both local and remote translations for the specified stretched container group. Optionally specify a translation type to display translations of that type.	get stretched cgroup <container-id> <translation-type>
Show the stretched group translation on both local and remote sites Display both local and remote translations for the specified stretched group. Optionally specify a translation type to display translations of that type.	get stretched group <group-id> <translation-type>
Save support bundle in filestore Display the contents of the tech support bundle. Specify the file argument to save the bundle to a file with the specified file name in the file store. This support bundle does not contain core or audit log files. To include those files, specify the all argument. Core files contain system information and all information stored in memory at the time of the dump (this may include confidential, sensitive or personal information such as passwords and encryption keys, if they are being processed in memory at that time). If you choose to send the support bundle to VMware, it will be processed in accordance with VMware’s standard processes and policies, to provide you with support, fix problems and improve the product and services.	get support-bundle [file <filename> [all]]
Display transport node agent status Display agent status information for the specified transport node.	get transport-node <uuid-arg> agent-status
Display the ARP table for the specified transport node Display the ARP table for the specified transport node.	get transport-node <uuid-arg> arp-table
Display the MAC address table for the specified transport node Display the MAC address table for the specified transport node.	get transport-node <uuid-arg> mac-table
Display routing domains joined by the specified transport node Display routing domains joined by the specified transport node.	get transport-node <uuid-arg> routing-domain
Display the routing vtep table for the specified transport node Display the routing vtep table for the specified transport node.	get transport-node <uuid-arg> routing-vtep
Display transport node status Display status information for the specified transport node.	get transport-node <uuid-arg> status
Display transport node status Display status information for the specified transport node.	get transport-node <uuid-arg> threat-status
Display VIF information for the specified transport node Display VIF information for the specified transport node.	get transport-node <uuid-arg> vifs
Display all VTEPs for the specified transport node Display all tunnel end points for the specified transport node.	get transport-node <uuid-arg> vtep
Display status of all transport nodes Display status information for all transport nodes.	get transport-nodes status
Display progress status of last upgrade step Display the status of the upgrade steps run on the node and details of last upgrade step.	get upgrade progress-status
Display playbook contents Display the contents of the specified playbook for the specified upgrade bundle.	get upgrade-bundle <bundle-name-arg> playbook <playbook-file-arg>
List all playbooks in the filestore Display all playbooks in the file store.	get upgrade-bundle playbooks
Show the system uptime Display the system uptime information.	get uptime
Get number of days the user's password is valid after a password change Get number of days the user's password is valid after a password change.	get user <node-username> password-expiration
Get SSH keys from authorized_keys file for specified user Get SSH keys from authorized_keys file for specified user.	get user <node-username> ssh-keys
Get user status for specified non-root user Get user status for specified non-root user.	get user <node-username> status
Display system version Display the version of the NSX appliance.	get version
Display VIF info Display information about the sepcified VIF. You can find VIF IDs with the get transport-node <uuid> vif command or the get logical-switch <uuid> ports command (see Child-UUID where Child-EntityType is VIF).	get vif <vif-id-arg>
Display all VTEP records for specific VTEP GROUP Display all VTEP records for specific VTEP GROUP	get vtep-group <int-arg> vtep
Display information about all VTEP GROUPs Display information about all VTEP GROUPs	get vtep-groups
Display help for specified command or list available commands Display help information. See the example below.	help
Join this node to a NSX Cluster Join this node to a management cluster. You must provide the API username and password of a node that is already in the cluster. On that node, you can run the get cluster config command to get the cluster ID, and run the get certificate api thumbprint command to get the thumbprint. If you do not provide a password on the command line, you will be prompted to enter one.	join <ip-address[:port]> cluster-id <cluster-id> thumbprint <thumbprint> [token <api-token>] [username <username> [password <password>]] [force]
Join node with the management plane Join this keymanager with the management plane. You can specify any NSX Manager in the management cluster in this command. Use the API username and password for the specified NSX Manager. If you do not provide a password on the command line, you will be prompted to enter one. Get the NSX Manager thumbprint by running the get certificate api thumbprint command on the specified NSX Manager. Specify the network interface name used for hypervisors to request keys.	join management-plane <ip-address[:port]> username <username> thumbprint <thumbprint> [password <password>] [interface-name <interface-name>]
List available commands This command lists all available commands.	list
nslookup Get DNS lookup information. Note that when run on an NSX Manager, the responding server is reported as 127.0.0.1 instead of the configured name server.	nslookup <hostname-arg>
Run command on registered cluster/fabric nodes Run a command on the specified cluster/fabric node.	on <registered-node-uuid> exec [<command>]
Ping host Ping a host or IP address. Use Control-C to stop the command. Optionally use the repeat argument to specify how many packets to transmit.	ping <hostname-or-ip-address> [repeat <number>]
Reboot system Reboot the system. If you specify the force argument, the system will reboot immediately without prompting for confirmation.	reboot [force]
Restart service Restart the specified service.	restart service <restartable-service-name-arg>
Restore KeyManager from backed up data Restore a backup of NSX KeyManager node data. If you do not provide a passphrase on the command line, you will be prompted to enter one. If you cannot remember the passphrase used to create the backup, you will not be able to restore the backup. Important: This restore request is one part of the restore process. You must complete all backup and restore tasks in the correct order. See the NSX-T Administration Guide for information and instructions about performing backups and restores.	restore node file <filename> [passphrase <passphrase>]
Execute playbook resume action Resume an upgrade after running the command start upgrade-bundle <bundle-name> playbook <playbook-file> and the system was rebooted.	resume upgrade-bundle <bundle-name-arg> playbook
Set API account lockout period Sets the amount of time, in seconds, that an account will remain locked out of the API after exceeding the maximum number of failed authentication attempts.	set auth-policy api lockout-period <lockout-period-arg>
Set API account lockout reset period In order to trigger an account lockout, all authentication failures must occur in this time window. If the reset period exprires, the failed login count is reset to zero.	set auth-policy api lockout-reset-period <lockout-reset-period-arg>
Set API maximum authentication faliures Set the number of failed API authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.	set auth-policy api max-auth-failures <auth-failures-arg>
Set CLI account lockout period Sets the amount of time, in seconds, that an account will remain locked out of the CLI after exceeding the maximum number of failed authentication attempts. While the lockout period is in effect, additional authentication attempts restart the lockout period, even if a valid password is specified.	set auth-policy cli lockout-period <lockout-period-arg>
Set CLI maximum authentication faliures Set the number of failed CLI authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.	set auth-policy cli max-auth-failures <auth-failures-arg>
Set minimum allowable password length Set the minimum number of characters that passwords must have. The smallest value that can be set is 8.	set auth-policy minimum-password-length <password-length-arg>
Set auth-policy vidm enabled property Set the vidm service's enabled property.	set auth-policy vidm enabled
Set auth-policy vidm properties Set the vidm's properties.	set auth-policy vidm hostname <hostname-or-ip-address> thumbprint <vidm-host-thumbprint-arg> client-id <vidm-client-id-arg> client-secret <vidm-client-secret-arg> node-hostname <hostname-or-ip-address>
Set auth-policy vidm lb-extern enabled property Set the external load balancer enabled property.	set auth-policy vidm lb-extern enabled
Set security banner or message of the day Set the security banner or message of the day.	set banner
Set status to display datetime stamp Set status to display datetime stamp in command output.	set cli-output datetime <datetime-arg>
Set inactivity timeout Set inactivity timeout in seconds. To disable the timeout, specify 0.	set cli-timeout <timeout-arg>
Set Cluster Virtual IP Set Cluster Virtual IP.	set cluster vip <ip-address>
Set the acceptance of End User License Agreement Set the acceptance of the end user license agreement.	set eula accepted
Set commands history size Set command history size.	set history limit <history-size>
Set system hostname Set the system hostname. Changing the hostname changes the command line prompt.	set hostname <hostname-arg>
Set logging-server Configure a logging server. The logging system uses the facility codes defined in RFC 5424. Facility local7 is used for audit messages, and local6 is used for non-audit messages.	set logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> [facility <facility>] [messageid <messageid>] [serverca <filename>] [clientca <filename>] [certificate <filename>] [key <filename>] [structured-data <structured-data>]
Set logging-server Configure a logging server. The logging system uses the facility codes defined in RFC 5424. Facility local7 is used for audit messages, and local6 is used for non-audit messages.	set logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> [facility <facility>] [messageid <messageid>] [serverca <filename>] [structured-data <structured-data>]
Add name server Add a name server to the DNS configuration.	set name-servers <name-server-arg>
Set kubeconfig file of the NAPP Kubernetes cluster Set kubeconfig file of the NAPP Kubernetes cluster. This operation overrides any existing NAPP kubeconfig file.	set napp kubeconfig
Ignore Central Config from the Manager to this appliance Ignore Central Config from the Manager to this appliance.	set node central-config disabled
Synchronize Central Config from the Manager to this appliance Synchronize Central Config from the Manager to this appliance.	set node central-config enabled
Add NTP server Configure a new NTP server.	set ntp-server <hostname-or-ip-address>
Set repository state properties Set current node's IP address as repository IP. This command will restart the install-upgrade service.	set repository-ip
Add network route Add a network route. You can also just set a gateway by specifying a prefix value of 0.0.0.0/0.	set route prefix <prefix> gateway <gateway-ip> [interface <interface-name>]
Add a domain name Add a domain name to the DNS search list.	set search-domains <search-domain-arg>
Set async replicator service logging level Set the log level of the async replicator service.	set service async_replicator logging-level <async-replicator-level-arg>
Set the controller service logging level Set the log level for the controller service.	set service controller logging-level <controller-logging-level-arg>
Set log level for given logger Set the log level for the specified component.	set service controller logging-level name <string-arg-controller> <controller-logging-level-arg>
Set log level for loggers matching regex Set the log level for components that match the specified pattern. The pattern can be a regular expression.	set service controller logging-level pattern <string-arg-controller> <controller-logging-level-arg>
Enable or disable basic authentication in API calls. Enable or disable basic authentication in API calls.	set service http basic-authentication <enabled-arg>
Set http API per-client concurrency limit, 0 to disable Set the HTTP API per-client concurrency limit value.	set service http client-api-concurrency-limit <http-client-api-concurrency-limit-arg>
Set http per-client API rate limit, 0 to disable Set the HTTP API per-client rate limit value.	set service http client-api-rate-limit <http-client-api-rate-limit-arg>
Set http service connection timeout, 0 to disable Set the HTTP service connection timeout value.	set service http connection-timeout <http-conn-timeout-arg>
Enable or disable cookie-based authentication in API calls. Enable or disable cookie-based authentication in API calls.	set service http cookie-based-authentication <enabled-arg>
Set http API global concurrency limit, 0 to disable Set the HTTP API global concurrency limit value.	set service http global-api-concurrency-limit <http-global-api-concurrency-limit-arg>
Set HTTP service logging level Set the log level of the HTTP service.	set service http logging-level <http-level-arg>
Set http service redirect host Set the HTTP service redirect host.	set service http redirect-host <hostname-or-ip-address>
Set http service session timeout, 0 to disable Set the HTTP service session timeout value.	set service http session-timeout <http-timeout-arg>
Set install-upgrade service enabled property Set the install-upgrade service's enabled property.	set service install-upgrade enabled
Set keymanager service logging level Set the log level of the keymanager service.	set service keymanager logging-level <keymanager-level-arg>
Set manager service logging level Set the log level of the manager service.	set service manager logging-level <manager-level-arg>
Set manager service package logging level Set the log level of the specified package in manager service.	set service manager logging-level <manager-level-arg> package <manager-package-name-arg>
Set the log level of exporter service. Dynamically set service daemon log level.	set service nsx-exporter logging-level <level>
Set the log level of platform client service. Dynamically set service daemon log level.	set service nsx-platform-client logging-level <platform-client-logging-level-arg>
Set NTP service start on boot Configure the NTP service to start on boot.	set service ntp start-on-boot
Set policy service logging level Set the log level of the policy service.	set service policy logging-level <policy-level-arg>
Set snmp service start on boot Configure the snmp service to start on boot.	set service snmp start-on-boot
Set SSH service start on boot Configure the SSH service to start on boot.	set service ssh start-on-boot
Set SNMP service v1/v2c community string Set the SNMP service v1/v2c community string in ciper text. This must be set before MIBs can be queried. Choose a string that is difficult to guess.	set snmp community
Set SNMP service v1/v2c community string Set the SNMP service v1/v2c community string. This must be set before MIBs can be queried. Choose a string that is difficult to guess.	set snmp community <snmp-community-arg>
Set SNMP v2 Trap Targets Set SNMP v2 Trap Targets.	set snmp v2-targets <hostname-or-ip-address-optional-port-arg> community <snmp-community-arg>
Set SNMP v3 Engine ID Set SNMP v3 Engine ID.	set snmp v3-engine-id <v3-engine-id-arg>
Set SNMP v3 Protocols Set SNMP v3 Protocols auth_protocol and priv_protocol.	set snmp v3-protocols auth-protocol <v3-auth-protocol-arg> priv-protocol <v3-priv-protocol-arg>
Set SNMP v3 Trap Targets Set SNMP v3 Trap Targets.	set snmp v3-targets <hostname-or-ip-address-optional-port-arg> user <user-id-arg>
Set SNMP v3 users Set SNMP v3 users,auth-password,priv-password in cipher text.	set snmp v3-users <user-id-arg>
Set SNMP v3 users Set SNMP v3 users auth-password,priv-password in plain text.	set snmp v3-users <user-id-arg> auth-password <auth-password-arg> priv-password <priv-password-arg>
Set SSH Root login property Enable SSH Root login property	set ssh root-login
Set system timezone Set the system timezone.	set timezone <timezone-arg>
Set number of days the user's password is valid after a password change Set number of days the user's password is valid after a password change.	set user <node-username> password-expiration <password-expiration-arg>
Set new username for specified non-root user Set new user name for the specified non-root user.	set user <node-username> username <new-node-username>
Set user password Set the password for the specified user. If you do not specify the password on the command line, you will be prompted for it. For details on setting passwords during installation, see the NSX-T Installation Guide.	set user <username> password [<password> [old-password <old-password>]]
Add SSH service key to authorized_keys file for specified user Add SSH service key to authorized_keys file for specified user. If password is not provided in the command then you are prompted to enter it. Password is required only for users root and admin.	set user <username> ssh-keys label <key-label> type <key-type> value <key-value> [password <password>]
Shutdown system Shut down the system. If you specify the force argument, the system will shut down immediately without prompting for confirmation.	shutdown [force]
Start packet capture on given interface with multiple options and save to file Start a packet capture on the specified interface in the given direction. If you do not specify a file, the output is displayed on the terminal. Type Control-C to end the packet capture. You can filter the capture using tcpdump expressions. The expression must be the last argument of the command. The expression is a keyword followed by a value. You can specify multiple keyword-value pairs. The list of keywords and acceptable values are: Keyword Value ethtype Ethernet type in HEX format. 0x<ETHTYPE> mac Source or destination MAC address srcmac Source MAC address dstmac Destination MAC address ipproto IP protocol in HEX format. 0x<PROTO> ip Source or destination IPv4 address srcip Source IPv4 address dstip Destination IPv4 address port Source or destination TCP port srcport Source TCP port dstport Destination TCP port vni VNI of the flow vlan VLAN ID	start capture interface <interface-name> [direction <direction>] [file <filename>] [count <packet-count>] [expression <expression>]
Start packet capture on node with given parameters Start packet capture in standalone mode with given fcport.	start capture node <cap-node-id-arg> fcport <fcport-id-arg> direction <capture-direction-arg>
Start packet capture on node with given parameters Start packet capture in standalone mode with given fcport.	start capture node <cap-node-id-arg> fcport <fcport-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>
Start packet capture on node with given parameters Start packet capture in steam mode with given fcport.	start capture node <cap-node-id-arg> fcport <fcport-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>
Start packet capture on node with given parameters Start packet capture in steam mode with given fcport.	start capture node <cap-node-id-arg> fcport <fcport-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>
Start packet capture on node with given filter Start packet capture in standalone mode with given filter.	start capture node <cap-node-id-arg> filter <filter-name-arg> stage <stage-type-arg>
Start packet capture on node with given filter Start packet capture in standalone mode with given filter.	start capture node <cap-node-id-arg> filter <filter-name-arg> stage <stage-type-arg> parameters <capture-options-arg>
Start packet capture on node with given filter Start packet capture in stream mode with given filter.	start capture node <cap-node-id-arg> filter <filter-name-arg> stage <stage-type-arg> stream-to <receiver-address-arg> port <receiver-port-arg>
Start packet capture on node with given filter Start packet capture in stream mode with given filter.	start capture node <cap-node-id-arg> filter <filter-name-arg> stage <stage-type-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>
Start packet capture on node with given parameters Start packet capture in standalone mode with given interface.	start capture node <cap-node-id-arg> interface <cap-interface-id-arg> direction <capture-direction-arg>
Start packet capture on node with given parameters Start packet capture in standalone mode with given interface.	start capture node <cap-node-id-arg> interface <cap-interface-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>
Start packet capture on node with given parameters Start packet capture in stream mode with given interface.	start capture node <cap-node-id-arg> interface <cap-interface-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>
Start packet capture on node with given parameters Start packet capture in stream mode with given interface.	start capture node <cap-node-id-arg> interface <cap-interface-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>
Start packet capture on node with given parameters Start packet capture in standalone mode with given pnic.	start capture node <cap-node-id-arg> pnic <pnic-value-arg> direction <capture-direction-arg>
Start packet capture on node with given parameters Start packet capture in standalone mode with given pnic.	start capture node <cap-node-id-arg> pnic <pnic-value-arg> direction <capture-direction-arg> parameters <capture-options-arg>
Start packet capture on node with given parameters Start packet capture in steam mode with given pnic.	start capture node <cap-node-id-arg> pnic <pnic-value-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>
Start packet capture on node with given parameters Start packet capture in steam mode with given pnic.	start capture node <cap-node-id-arg> pnic <pnic-value-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>
Start packet capture on ESXi node with given parameters Start packet capture in standalone mode with given parameters.	start capture node <cap-node-id-arg> vdrport <vdrport-id-arg> direction <capture-direction-arg>
Start packet capture on ESXi node with given parameters Start packet capture in standalone mode with given parameters.	start capture node <cap-node-id-arg> vdrport <vdrport-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>
Start packet capture on ESXi node with given parameters Start packet capture on ESXi node with given parameters.	start capture node <cap-node-id-arg> vdrport <vdrport-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>
Start packet capture on ESXi node with given parameters Start packet capture on ESXi node with given parameters.	start capture node <cap-node-id-arg> vdrport <vdrport-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>
Start packet capture on node with given parameters Start packet capture in standalone mode with given vif.	start capture node <cap-node-id-arg> vif <vif-id-arg> direction <capture-direction-arg>
Start packet capture on node with given parameters Start packet capture in standalone mode with given vif.	start capture node <cap-node-id-arg> vif <vif-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>
Start packet capture on node with given parameters Start packet capture in stream mode with given vif.	start capture node <cap-node-id-arg> vif <vif-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>
Start packet capture on node with given parameters Start packet capture in stream mode with given vif.	start capture node <cap-node-id-arg> vif <vif-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>
Start packet capture on ESXi node with given vmknic Start packet capture in standalone mode on ESXi node with given vmknic.	start capture node <cap-node-id-arg> vmknic <vmknic-id-arg> direction <capture-direction-arg>
Start packet capture on ESXi node with given parameters Start packet capture in standalone mode with given parameters.	start capture node <cap-node-id-arg> vmknic <vmknic-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>
Start packet capture on ESXi node with given vmknic Start packet capture on ESXi node with given vmknic.	start capture node <cap-node-id-arg> vmknic <vmknic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>
Start packet capture on ESXi node with given vmknic Start packet capture on ESXi node with given vmknic.	start capture node <cap-node-id-arg> vmknic <vmknic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>
Start packet capture on ESXi node with given vmnic Start packet capture in standalone mode on ESXi node with given vmnic.	start capture node <cap-node-id-arg> vmnic <vmnic-id-arg> direction <capture-direction-arg>
Start packet capture on ESXi node with given parameters Start packet capture in standalone mode with given parameters.	start capture node <cap-node-id-arg> vmnic <vmnic-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>
Start packet capture on ESXi node with given vmnic Start packet capture on ESXi node with given vmnic.	start capture node <cap-node-id-arg> vmnic <vmnic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>
Start packet capture on ESXi node with given vmnic Start packet capture on ESXi node with given vmnic.	start capture node <cap-node-id-arg> vmnic <vmnic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>
Start packet capture on ESXi node with given vnic Start packet capture in standalone mode on ESXi node with given vnic.	start capture node <cap-node-id-arg> vnic <vnic-id-arg> direction <capture-direction-arg>
Start packet capture on ESXi node with given parameters Start packet capture in standalone mode with given parameters.	start capture node <cap-node-id-arg> vnic <vnic-id-arg> direction <capture-direction-arg> parameters <capture-options-arg>
Start packet capture on ESXi node with given vnic Start packet capture on ESXi node with given vnic.	start capture node <cap-node-id-arg> vnic <vnic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg>
Start packet capture on ESXi node with given vnic Start packet capture on ESXi node with given vnic.	start capture node <cap-node-id-arg> vnic <vnic-id-arg> direction <capture-direction-arg> stream-to <receiver-address-arg> port <receiver-port-arg> parameters <capture-options-arg>
Re-sync search service Execute full or partial re-sync of search service datastore.	start search resync <search-scope-arg>
Start service Start the specified service.	start service <start-stoppable-service-name-arg>
Execute a playbook given a valid playbook file Start an upgrade with the specified upgrade bundle and according to the specified playbook.	start upgrade-bundle <bundle-name-arg> playbook <playbook-file-arg>
Stop packet capture Stop packet capture by session id.	stop capture session <session-id-arg>
Stop service Stop the specified service.	stop service <service name> [force]
traceroute Trace the route to the specified IPv4 address or host.	traceroute <hostname-or-ip-address>
VDS Migrate Apply Topology VDS Migrate Apply Topology	vds-migrate apply-topology
VDS Migrate delete Topology VDS Migrate delete Topology	vds-migrate delete-topology
VDS Migrate Disable VDS Migrate Disable	vds-migrate disable-migrate
Migrate NVDS to VDS By Cluster Id Migrate NVDS to VDS By Cluster Id	vds-migrate esxi-cluster-id <cluster-id> [maintenance-timeout <timeout>]
Migrate NVDS to VDS By Cluster Name Migrate NVDS to VDS By Cluster Name	vds-migrate esxi-cluster-name <cluster-name> [maintenance-timeout <timeout>]
VDS Migrate Precheck VDS Migrate Precheck	vds-migrate precheck
VDS Migrate Show Topology VDS Migrate Show Topology	vds-migrate show-topology
Migrate NVDS to VDS By Tn List Migrate NVDS to VDS By Tn List	vds-migrate tn-list <configfile> [maintenance-timeout <timeout>]
Verify all configured logging servers Verify iptables rules for all logging servers and update if needed	verify logging-servers
Verify and extract bundle to default location Verify and extract the specified upgrade bundle to the default location.	verify upgrade-bundle <bundle-name-arg>

Total commands: 343