NSX CLI Guide

NSX on VMC

Associated Commands:

CLI Description	Command
Clear auth-policy vidm enabled property Clear the vidm service's enabled property.	clear auth-policy vidm enabled
Clear auth-policy vidm lb-extern enabled property Clear the external load balancer enabled property.	clear auth-policy vidm lb-extern enabled
Clear security banner or message of the day Clear the security banner or message of the day. The banner is reset to the system default banner.	clear banner
Clear all configured logging-servers Clear all logging server configuration.	clear logging-servers
Clear all name servers Clear all name servers from the DNS configuration.	clear name-servers
Clear search domains Remove all domain names from the DNS search list.	clear search-domains
Clear http service redirect host Clear the HTTP service redirect host.	clear service http redirect-host
Clear install-upgrade service enabled property Clear the install-upgrade service's enabled property.	clear service install-upgrade enabled
Clear NTP service start on boot Configure the NTP service to not start on boot.	clear service ntp start-on-boot
Clear snmp service start on boot Configure the snmp service to not start on boot.	clear service snmp start-on-boot
Clear SSH service start on boot Configure the SSH service to not start on boot.	clear service ssh start-on-boot
Clear SSH Root login property Disable SSH Root login property	clear ssh root-login
Disable password expiration for the user Disable password expiration for the user.	clear user <node-username> password-expiration
Copy a local file to remote file Copy a local file to a remote destination.	copy file <existing-file-arg> url <scp-file-url-arg>
Copy a remote file to the local file store Copy a remote file to the local file store. If no destination file is specified, the copied file has the same file name as the source file. You can use the file argument to specify a different destination file name.	copy url <url> [file <filename>]
Copy a remote https url file with same filename Copy a remote https url file to local file using same filename.	copy url <url> thumbprint <thumbprint> [file <filename>]
Delete local file Delete a local file.	del file <existing-file-or-pattern-arg>
Delete logging-server Delete the specified logging server configuration. You can use the get logging-servers command to display the current logging server configuration.	del logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> [facility <facility>] [messageid <messageid>] [structured-data <structured-data>]
Delete name server Delete the specified name server from the DNS configuration.	del name-server <name-server-arg>
Remove NTP server Remove an existing NTP server.	del ntp-server <hostname-or-ip-address>
Delete route Delete the specified network route.	del route prefix <prefix> gateway <gateway-ip> [interface <interface-name>]
Delete a domain name Delete the specified domain name from the DNS search list.	del search-domains <search-domain-arg>
Delete SNMP v2 Trap Targets Delete SNMP v2 Trap Targets.	del snmp v2-targets <hostname-or-ip-address-optional-port-arg>
Delete SNMP v3 Trap Targets Delete SNMP v3 Trap Targets.	del snmp v3-targets <hostname-or-ip-address-optional-port-arg>
Delete SNMP v3 Users Delete SNMP v3 Users.	del snmp v3-users <user-id-arg>
Delete SSH service known host Delete the specified host entry from the SSH known hosts file.	del ssh-known-host <hostname-or-ip-address-optional-port-arg>
Delete SSH service keys from authorized_keys file for specified user Delete any SSH key with specified label from specified user's authorized_keys file. If password is not provided in the command then you are prompted to enter it. Password is required only for users root and admin.	del user <username> ssh-keys label <key-label> [password <password>]
Exit the CLI Exit the VRF context mode if you are in it. Otherwise, exit the CLI.	exit
Show system arp cache Display the ARP table.	get arp-table
Get API account lockout period Get the amount of time, in seconds, that an account will remain locked out of the API after exceeding the maximum number of failed authentication attempts.	get auth-policy api lockout-period
Get API account lockout reset period In order to trigger an account lockout, all authentication failures must occur in this time window. If the reset period exprires, the failed login count is reset to zero.	get auth-policy api lockout-reset-period
Get API maximum authentication faliures Get the number of failed API authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.	get auth-policy api max-auth-failures
Get CLI account lockout period Get the amount of time, in seconds, that an account will remain locked out of the CLI after exceeding the maximum number of failed authentication attempts.	get auth-policy cli lockout-period
Get CLI maximum authentication faliures Get the number of failed CLI authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.	get auth-policy cli max-auth-failures
Get minimum allowable password length Get the minimum number of characters that passwords must have.	get auth-policy minimum-password-length
Get auth-policy vidm Get the vidm's properties.	get auth-policy vidm
Display API server certificate Display the API server's certificate.	get certificate api
Display API server certificate thumbprint Display the API server's certificate thumbprint.	get certificate api thumbprint
Display cluster certificate Display the clsuter certificate.	get certificate cluster
Display cluster certificate text Display the cluster certificate text.	get certificate cluster text
Display cluster certificate thumbprint Display the cluster certificate thumbprint.	get certificate cluster thumbprint
Show status to display datetime stamp Show status to display datetime stamp in command output.	get cli-output datetime
Show inactivity timeout Show inactivity timeout in seconds.	get cli-timeout
Display system clock Display the current date and time.	get clock
Display commands history Display the commands history in command output. To show all command history set size to 0. Note:Outputs command history from version 3.2.0 and above.	get command history
Show system configuration Display configuration settings in command line syntax.	get configuration
Show the system CPU status Display the system CPU information.	get cpu-stats
List file in the filestore Display information about the specified file in the filestore.	get file <existing-file-arg>
Display file thumbprint Display the file thumbprint.	get file <existing-file-arg> thumbprint
List files in the filestore Display information about the files in the filestore.	get files
Show the system storage capacity Display the file system information.	get filesystem-stats
Display system hostname Display the system hostname.	get hostname
Display network interface properties Display information about the specified network interface.	get interface <interface-name-arg>
Display all network interface properties Display information about all network interfaces.	get interfaces
Show log file contents Display the contents of the specified log file.	get log-file <log-file-arg>
Show log file contents Display the last 10 lines of the specified log file and all new messages that are written to the log file.	get log-file <log-file-arg> follow
Display all configured logging servers Display logging server configuration.	get logging-servers
Show the system memory status Display the system memory information.	get memory-stats
Get all name servers Get all name servers in the DNS configuration.	get name-servers
Show the system network statistics Display the system network statistics.	get network-stats
Display upgrade status of the node Display upgrade status of the node.	get node upgrade status
Show NTP associations Display the status of the NTP system. The delay, offset and dispersion values are in seconds.	get ntp-server associations
Show NTP servers Display all NTP servers.	get ntp-servers
Display system processes Display a snapshot of the system processes.	get processes
Monitor system processes Display information about processes that are running. The display is updated every few seconds.	get processes monitor
Display a specific IPv4 route Display the specified IPv4 route.	get route prefix <cidr-notation>
Display IPv4 routes Display all configured IPv4 routes.	get routes
Get all search domains Get all domain names in the DNS search list.	get search-domains
Display service properties Display information about the specified service.	get service <service-name-arg>
Display service properties Display information about all services.	get services
Get SNMP v2 configured status Indicates whether the local SNMP agent is configured with community string(s).	get snmp v2-configured
Get SNMP v2 Trap Targets Get SNMP v2 Trap Targets.	get snmp v2-targets
Get SNMP v3 configured status Indicates whether the local SNMP agent is configured with v3 user(s).	get snmp v3-configured
Get SNMP v3 Engine ID Get SNMP v3 Engine ID.	get snmp v3-engine-id
Get SNMP v3 Protocols Get SNMP v3 Protocols auth_protocol and priv_protocol.	get snmp v3-protocols
Get SNMP v3 Trap Targets Get SNMP v3 Trap Targets.	get snmp v3-targets
Get SNMP v3 User IDs Get SNMP v3 User IDs.	get snmp v3-users
Show active network connections Display active network connections.	get sockets
Save support bundle in filestore Display the contents of the tech support bundle. Specify the file argument to save the bundle to a file with the specified file name in the file store. This support bundle does not contain core or audit log files. To include those files, specify the all argument. Core files contain system information and all information stored in memory at the time of the dump (this may include confidential, sensitive or personal information such as passwords and encryption keys, if they are being processed in memory at that time). If you choose to send the support bundle to VMware, it will be processed in accordance with VMware’s standard processes and policies, to provide you with support, fix problems and improve the product and services.	get support-bundle [file <filename> [all]]
Display progress status of last upgrade step Display the status of the upgrade steps run on the node and details of last upgrade step.	get upgrade progress-status
Display playbook contents Display the contents of the specified playbook for the specified upgrade bundle.	get upgrade-bundle <bundle-name-arg> playbook <playbook-file-arg>
List all playbooks in the filestore Display all playbooks in the file store.	get upgrade-bundle playbooks
Show the system uptime Display the system uptime information.	get uptime
Get number of days the user's password is valid after a password change Get number of days the user's password is valid after a password change.	get user <node-username> password-expiration
Get SSH keys from authorized_keys file for specified user Get SSH keys from authorized_keys file for specified user.	get user <node-username> ssh-keys
Get user status for specified non-root user Get user status for specified non-root user.	get user <node-username> status
Display system version Display the version of the NSX appliance.	get version
Display help for specified command or list available commands Display help information. See the example below.	help
List available commands This command lists all available commands.	list
nslookup Get DNS lookup information. Note that when run on an NSX Manager, the responding server is reported as 127.0.0.1 instead of the configured name server.	nslookup <hostname-arg>
Ping host Ping a host or IP address. Use Control-C to stop the command. Optionally use the repeat argument to specify how many packets to transmit.	ping <hostname-or-ip-address> [repeat <number>]
Reboot system Reboot the system. If you specify the force argument, the system will reboot immediately without prompting for confirmation.	reboot [force]
Restart service Restart the specified service.	restart service <restartable-service-name-arg>
Execute playbook resume action Resume an upgrade after running the command start upgrade-bundle <bundle-name> playbook <playbook-file> and the system was rebooted.	resume upgrade-bundle <bundle-name-arg> playbook
Set API account lockout period Sets the amount of time, in seconds, that an account will remain locked out of the API after exceeding the maximum number of failed authentication attempts.	set auth-policy api lockout-period <lockout-period-arg>
Set API account lockout reset period In order to trigger an account lockout, all authentication failures must occur in this time window. If the reset period exprires, the failed login count is reset to zero.	set auth-policy api lockout-reset-period <lockout-reset-period-arg>
Set API maximum authentication faliures Set the number of failed API authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.	set auth-policy api max-auth-failures <auth-failures-arg>
Set CLI account lockout period Sets the amount of time, in seconds, that an account will remain locked out of the CLI after exceeding the maximum number of failed authentication attempts. While the lockout period is in effect, additional authentication attempts restart the lockout period, even if a valid password is specified.	set auth-policy cli lockout-period <lockout-period-arg>
Set CLI maximum authentication faliures Set the number of failed CLI authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.	set auth-policy cli max-auth-failures <auth-failures-arg>
Set minimum allowable password length Set the minimum number of characters that passwords must have. The smallest value that can be set is 8.	set auth-policy minimum-password-length <password-length-arg>
Set auth-policy vidm enabled property Set the vidm service's enabled property.	set auth-policy vidm enabled
Set auth-policy vidm properties Set the vidm's properties.	set auth-policy vidm hostname <hostname-or-ip-address> thumbprint <vidm-host-thumbprint-arg> client-id <vidm-client-id-arg> client-secret <vidm-client-secret-arg> node-hostname <hostname-or-ip-address>
Set auth-policy vidm lb-extern enabled property Set the external load balancer enabled property.	set auth-policy vidm lb-extern enabled
Set security banner or message of the day Set the security banner or message of the day.	set banner
Set status to display datetime stamp Set status to display datetime stamp in command output.	set cli-output datetime <datetime-arg>
Set inactivity timeout Set inactivity timeout in seconds. To disable the timeout, specify 0.	set cli-timeout <timeout-arg>
Set commands history size Set command history size.	set history limit <history-size>
Set system hostname Set the system hostname. Changing the hostname changes the command line prompt.	set hostname <hostname-arg>
Set logging-server Configure a logging server. The logging system uses the facility codes defined in RFC 5424. Facility local7 is used for audit messages, and local6 is used for non-audit messages.	set logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> [facility <facility>] [messageid <messageid>] [serverca <filename>] [clientca <filename>] [certificate <filename>] [key <filename>] [structured-data <structured-data>]
Set logging-server Configure a logging server. The logging system uses the facility codes defined in RFC 5424. Facility local7 is used for audit messages, and local6 is used for non-audit messages.	set logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> [facility <facility>] [messageid <messageid>] [serverca <filename>] [structured-data <structured-data>]
Add name server Add a name server to the DNS configuration.	set name-servers <name-server-arg>
Set kubeconfig file of the NAPP Kubernetes cluster Set kubeconfig file of the NAPP Kubernetes cluster. This operation overrides any existing NAPP kubeconfig file.	set napp kubeconfig
Add NTP server Configure a new NTP server.	set ntp-server <hostname-or-ip-address>
Set repository state properties Set current node's IP address as repository IP. This command will restart the install-upgrade service.	set repository-ip
Add network route Add a network route. You can also just set a gateway by specifying a prefix value of 0.0.0.0/0.	set route prefix <prefix> gateway <gateway-ip> [interface <interface-name>]
Add a domain name Add a domain name to the DNS search list.	set search-domains <search-domain-arg>
Set async replicator service logging level Set the log level of the async replicator service.	set service async_replicator logging-level <async-replicator-level-arg>
Enable or disable basic authentication in API calls. Enable or disable basic authentication in API calls.	set service http basic-authentication <enabled-arg>
Set http API per-client concurrency limit, 0 to disable Set the HTTP API per-client concurrency limit value.	set service http client-api-concurrency-limit <http-client-api-concurrency-limit-arg>
Set http per-client API rate limit, 0 to disable Set the HTTP API per-client rate limit value.	set service http client-api-rate-limit <http-client-api-rate-limit-arg>
Set http service connection timeout, 0 to disable Set the HTTP service connection timeout value.	set service http connection-timeout <http-conn-timeout-arg>
Enable or disable cookie-based authentication in API calls. Enable or disable cookie-based authentication in API calls.	set service http cookie-based-authentication <enabled-arg>
Set http API global concurrency limit, 0 to disable Set the HTTP API global concurrency limit value.	set service http global-api-concurrency-limit <http-global-api-concurrency-limit-arg>
Set HTTP service logging level Set the log level of the HTTP service.	set service http logging-level <http-level-arg>
Set http service redirect host Set the HTTP service redirect host.	set service http redirect-host <hostname-or-ip-address>
Set http service session timeout, 0 to disable Set the HTTP service session timeout value.	set service http session-timeout <http-timeout-arg>
Set install-upgrade service enabled property Set the install-upgrade service's enabled property.	set service install-upgrade enabled
Set NTP service start on boot Configure the NTP service to start on boot.	set service ntp start-on-boot
Set snmp service start on boot Configure the snmp service to start on boot.	set service snmp start-on-boot
Set SSH service start on boot Configure the SSH service to start on boot.	set service ssh start-on-boot
Set SNMP service v1/v2c community string Set the SNMP service v1/v2c community string in ciper text. This must be set before MIBs can be queried. Choose a string that is difficult to guess.	set snmp community
Set SNMP service v1/v2c community string Set the SNMP service v1/v2c community string. This must be set before MIBs can be queried. Choose a string that is difficult to guess.	set snmp community <snmp-community-arg>
Set SNMP v2 Trap Targets Set SNMP v2 Trap Targets.	set snmp v2-targets <hostname-or-ip-address-optional-port-arg> community <snmp-community-arg>
Set SNMP v3 Engine ID Set SNMP v3 Engine ID.	set snmp v3-engine-id <v3-engine-id-arg>
Set SNMP v3 Protocols Set SNMP v3 Protocols auth_protocol and priv_protocol.	set snmp v3-protocols auth-protocol <v3-auth-protocol-arg> priv-protocol <v3-priv-protocol-arg>
Set SNMP v3 Trap Targets Set SNMP v3 Trap Targets.	set snmp v3-targets <hostname-or-ip-address-optional-port-arg> user <user-id-arg>
Set SNMP v3 users Set SNMP v3 users,auth-password,priv-password in cipher text.	set snmp v3-users <user-id-arg>
Set SNMP v3 users Set SNMP v3 users auth-password,priv-password in plain text.	set snmp v3-users <user-id-arg> auth-password <auth-password-arg> priv-password <priv-password-arg>
Set SSH Root login property Enable SSH Root login property	set ssh root-login
Set system timezone Set the system timezone.	set timezone <timezone-arg>
Set number of days the user's password is valid after a password change Set number of days the user's password is valid after a password change.	set user <node-username> password-expiration <password-expiration-arg>
Set new username for specified non-root user Set new user name for the specified non-root user.	set user <node-username> username <new-node-username>
Set user password Set the password for the specified user. If you do not specify the password on the command line, you will be prompted for it. For details on setting passwords during installation, see the NSX-T Installation Guide.	set user <username> password [<password> [old-password <old-password>]]
Add SSH service key to authorized_keys file for specified user Add SSH service key to authorized_keys file for specified user. If password is not provided in the command then you are prompted to enter it. Password is required only for users root and admin.	set user <username> ssh-keys label <key-label> type <key-type> value <key-value> [password <password>]
Shutdown system Shut down the system. If you specify the force argument, the system will shut down immediately without prompting for confirmation.	shutdown [force]
Start packet capture on given interface with multiple options and save to file Start a packet capture on the specified interface in the given direction. If you do not specify a file, the output is displayed on the terminal. Type Control-C to end the packet capture. You can filter the capture using tcpdump expressions. The expression must be the last argument of the command. The expression is a keyword followed by a value. You can specify multiple keyword-value pairs. The list of keywords and acceptable values are: Keyword Value ethtype Ethernet type in HEX format. 0x<ETHTYPE> mac Source or destination MAC address srcmac Source MAC address dstmac Destination MAC address ipproto IP protocol in HEX format. 0x<PROTO> ip Source or destination IPv4 address srcip Source IPv4 address dstip Destination IPv4 address port Source or destination TCP port srcport Source TCP port dstport Destination TCP port vni VNI of the flow vlan VLAN ID	start capture interface <interface-name> [direction <direction>] [file <filename>] [count <packet-count>] [expression <expression>]
Start service Start the specified service.	start service <start-stoppable-service-name-arg>
Execute a playbook given a valid playbook file Start an upgrade with the specified upgrade bundle and according to the specified playbook.	start upgrade-bundle <bundle-name-arg> playbook <playbook-file-arg>
Stop service Stop the specified service.	stop service <service name> [force]
traceroute Trace the route to the specified IPv4 address or host.	traceroute <hostname-or-ip-address>
Verify all configured logging servers Verify iptables rules for all logging servers and update if needed	verify logging-servers
Verify and extract bundle to default location Verify and extract the specified upgrade bundle to the default location.	verify upgrade-bundle <bundle-name-arg>

Total commands: 152