Cloud Service Manager

Associated Commands:

CLI Description Command

Clear auth-policy vidm enabled property


Clear the vidm service's enabled property.
clear auth-policy vidm enabled

Clear auth-policy vidm lb-extern enabled property


Clear the external load balancer enabled property.
clear auth-policy vidm lb-extern enabled

Clear security banner or message of the day


Clear the security banner or message of the day. The banner is reset to the system default banner.
clear banner

Clear cluster api service redirect host


Clear the cluster api service redirect host.
clear cluster api-service redirect-host

Clear Cluster Virtual IPv4 address


Clear Cluster Virtual IPv4 address.
clear cluster vip

Clears both cluster Virtual IPv4 & IPv6 addresses


Clears both cluster Virtual IPv4 & IPv6 addresses.
clear cluster vip all

Clear Cluster Virtual IPv6 address


Clear Cluster Virtual IPv6 address.
clear cluster vip ipv6

Clear all configured logging-servers


Clear all logging server configuration.
clear logging-servers

Clear all name servers


Clear all name servers from the DNS configuration.
clear name-servers

Resets configured password complexity requirements to default


Resets configured password complexity requirements to default.
clear password-complexity

Clear search domains


Remove all domain names from the DNS search list.
clear search-domains

Clear http service redirect host


Clear the HTTP service redirect host.
clear service http redirect-host

Clear install-upgrade service enabled property


Clear the install-upgrade service's enabled property.
clear service install-upgrade enabled

Clear NTP service start on boot


Configure the NTP service to not start on boot.
clear service ntp start-on-boot

Clear snmp service start on boot


Configure the snmp service to not start on boot.
clear service snmp start-on-boot

Clear SSH service start on boot


Configure the SSH service to not start on boot.
clear service ssh start-on-boot

Clear SSH Root login property


Disable SSH Root login property
clear ssh root-login

Disable password expiration for the user


Disable password expiration for the user.
clear user <node-all-username> password-expiration

Disable password expiration warning for the user


Disable password expiration warning for the user.
clear user <node-all-username> password-expiration-warning

Copy core dumps to remote file


Copy system generated core dumps to a remote destination.
copy core-dump <core-dump-file-arg> url <scp-file-url-arg>

Copy a local file to remote file


Copy a local file to a remote destination.
copy file <existing-file-arg> url <scp-file-url-arg>

Copy a remote file to the local file store


Copy a remote file to the local file store. If no destination file is specified, the copied file has the same file name as the source file. You can use the file argument to specify a different destination file name.
To specify IPv6 remote addresses, url server should be enclosed between square brackets.
copy url <url> [file <filename>]

Copy a remote https url file with same filename


Copy a remote https url file to local file using same filename.
copy url <url> thumbprint <thumbprint> [file <filename>]

Remove all other management nodes from the cluster


Remove all other management nodes from the cluster. This will effectively convert a multi-node management cluster into a single node setup. The system will prompt for confirmation for this operation. It is recommended to use GSS guidance before using this command.
deactivate cluster

Delete core dump files in the system


Delete core dump files in the system.
del core-dump [all|<core-dump-file-arg>]

Delete local file


Delete a local file.
del file <existing-file-or-pattern-arg>

Delete logging-server


Delete the specified logging server configuration. You can use the get logging-servers command to display the current logging server configuration.
del logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> [facility <facility>] [messageid <messageid>] [structured-data <structured-data>]

Delete name server


Delete the specified name server from the DNS configuration.
del name-server <name-server-arg>

Remove NTP server


Remove an existing NTP server.
del ntp-server <hostname-or-ip-address>

Delete IPv4 or IPv6 network route


Delete the specified network IPv4 or IPv6 route. Default value for the IPv6 route metric is 1024.
del route prefix <prefix> [gateway <gateway-ip>] [interface <interface-name>] [metric <ip-route-metric>]

Delete a domain name


Delete the specified domain name from the DNS search list.
del search-domains <search-domain-arg>

Delete SNMP v2 Trap Targets


Delete SNMP v2 Trap Targets.
del snmp v2-targets <hostname-or-ip-address-optional-port-arg>

Delete SNMP v3 Trap Targets


Delete SNMP v3 Trap Targets.
del snmp v3-targets <hostname-or-ip-address-optional-port-arg>

Delete SNMP v3 Users


Delete SNMP v3 Users.
del snmp v3-users <user-id-arg>

Delete SSH service known host


Delete the specified host entry from the SSH known hosts file.
del ssh-known-host <hostname-or-ip-address-optional-port-arg>

Delete existing local users.


Delete specified user who is configured to log into the NSX appliance. Whereas local users root and administrator are not allowed to be deleted, but local user audit is deletable on-demand.

Note: Deleted users cannot be created again.
del user <username>

Delete SSH service keys from authorized_keys file for specified user


Delete any SSH key with specified label from specified user's authorized_keys file. If password is not provided in the command then you are prompted to enter it. Password is required only for users root and admin.
del user <username> ssh-keys label <key-label> [password <password>]

Detach specified node from the cluster


Detach the specified node from the cluster.
detach node <node-id-arg>

Detach specified node from the cluster without checking repository-ip modification errors


Detach specified node from the cluster without checking repository-ip modification errors.
detach node <node-id-arg> ignore-repository-ip-check

Exit the CLI


Exit the VRF context mode if you are in it. Otherwise, exit the CLI.
exit

Show system arp cache


Display the ARP table.
get arp-table

Get API account lockout period


Get the amount of time, in seconds, that an account will remain locked out of the API after exceeding the maximum number of failed authentication attempts.
get auth-policy api lockout-period

Get API account lockout reset period


In order to trigger an account lockout, all authentication failures must occur in this time window. If the reset period exprires, the failed login count is reset to zero.
get auth-policy api lockout-reset-period

Get API maximum authentication faliures


Get the number of failed API authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.
get auth-policy api max-auth-failures

Get CLI account lockout period


Get the amount of time, in seconds, that an account will remain locked out of the CLI after exceeding the maximum number of failed authentication attempts.
get auth-policy cli lockout-period

Get CLI maximum authentication faliures


Get the number of failed CLI authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.
get auth-policy cli max-auth-failures

Get minimum allowable password length


Get the minimum number of characters that passwords must have.
get auth-policy minimum-password-length

Get auth-policy vidm


Get the vidm's properties.
get auth-policy vidm

Display API server certificate


Display the API server's certificate.
get certificate api

Display API server certificate text


Display the API server's certificate text.
get certificate api text

Display API server certificate thumbprint


Display the API server's certificate thumbprint.
get certificate api thumbprint

Display cluster certificate


Display the clsuter certificate.
get certificate cluster

Display cluster certificate text


Display the cluster certificate text.
get certificate cluster text

Display cluster certificate thumbprint


Display the cluster certificate thumbprint.
get certificate cluster thumbprint

Show status to display datetime stamp


Show status to display datetime stamp in command output.
get cli-output datetime

Show inactivity timeout


Show inactivity timeout in seconds.
get cli-timeout

Display system clock


Display the current date and time.
get clock

Display cluster api-service configuration


Display cluster api-service configuration.
get cluster api-service

Get Cluster Config


Get Cluster Config.
get cluster config

Get Cluster Status


Get status of all the groups.
get cluster status

Get Cluster Status


Get status of all the groups. Show leadership if there is any.
get cluster status verbose

Get Cluster Virtual IP


Get Cluster Virtual IP.
get cluster vip

Display commands history


Display the commands history in command output.
To show all command history set size to 0.

Note:Outputs command history from version 3.2.0 and above.
get command history

Show system configuration


Display configuration settings in command line syntax.
get configuration

Get core dump config


Get core dump generation and rotation configurations
get core-dump config

List core dump files in the system


Display information about the core dump files in the system.
get core-dumps

Show the system CPU status


Display the system CPU information.
get cpu-stats

List file in the filestore


Display information about the specified file in the filestore.
get file <existing-file-arg>

Display file thumbprint


Display the file thumbprint.
get file <existing-file-arg> thumbprint

List files in the filestore


Display information about the files in the filestore.
get files

Show the system storage capacity


Display the file system information.
get filesystem-stats

Display GRUB menu timeout


Display GRUB menu timeout.
get grub menu timeout

Display system hostname


Display the system hostname.
get hostname

Display network interface properties


Display information about the specified network interface.
get interface <interface-name-arg>

Display all network interface properties


Display information about all network interfaces.
get interfaces

Show log file contents


Display the contents of the specified log file.
get log-file <log-file-arg>

Show log file contents


Display the last 10 lines of the specified log file and all new messages that are written to the log file.
get log-file <log-file-arg> follow

Display all configured logging servers


Display logging server configuration.
get logging-servers

Show the system memory status


Display the system memory information.
get memory-stats

Get all name servers


Get all name servers in the DNS configuration.
get name-servers

Show the system network statistics


Display the system network statistics.
get network-stats

Display upgrade status of the node


Display upgrade status of the node.
get node upgrade status

Show NTP associations


Display the status of the NTP system. The delay, offset and dispersion values are in seconds.
get ntp-server associations

Show NTP servers


Display all NTP servers.
get ntp-servers

Get configured password complexity requirements


Get configured password complexity requirements.
get password-complexity

Display system processes


Display a snapshot of the system processes.
get processes

Display process monitor


Display information about processes that are running. The display is updated every few seconds.
get processes monitor

Display specific IPv4 or IPv6 routes for the prefix


Display specific IPv4 or IPv6 routes for the prefix.
get route prefix <cidr46-notation>

Display IPv4 and IPv6 routes


Display all configured IPv4 and IPv6 routes.
get routes

Display IPv4 or IPv6 routes


Display all configured IPv4 or IPv6 routes.
get routes <ip-address-type>

Get all search domains


Get all domain names in the DNS search list.
get search-domains

Display service properties


Display information about the specified service.
get service <service-name-arg>

Get Node Management service logging level


Get the log level of the Node Management service.
get service node-mgmt logging-level

Display service properties


Display information about all services.
get services

Get SNMP v2 configured status


Indicates whether the local SNMP agent is configured with community string(s).
get snmp v2-configured

Get SNMP v2 Trap Targets


Get SNMP v2 Trap Targets.
get snmp v2-targets

Get SNMP v3 configured status


Indicates whether the local SNMP agent is configured with v3 user(s).
get snmp v3-configured

Get SNMP v3 Engine ID


Get SNMP v3 Engine ID.
get snmp v3-engine-id

Get SNMP v3 Protocols


Get SNMP v3 Protocols auth_protocol and priv_protocol.
get snmp v3-protocols

Get SNMP v3 Trap Targets


Get SNMP v3 Trap Targets.
get snmp v3-targets

Get SNMP v3 User IDs


Get SNMP v3 User IDs.
get snmp v3-users

Show active network connections


Display active network connections.
get sockets

Save support bundle in filestore


Display the contents of the tech support bundle. Specify the file argument to save the bundle to a file with the specified file name in the file store. This support bundle does not contain core or audit log files. To include those files, specify the all argument.

Core files contain system information and all information stored in memory at the time of the dump (this may include confidential, sensitive or personal information such as passwords and encryption keys, if they are being processed in memory at that time). If you choose to send the support bundle to VMware, it will be processed in accordance with VMware’s standard processes and policies, to provide you with support, fix problems and improve the product and services.


get support-bundle [file <filename> [log-age <no-of-days>] [all]]

Display progress status of last upgrade step


Display the status of the upgrade steps run on the node and details of last upgrade step.
get upgrade progress-status

Display playbook contents


Display the contents of the specified playbook for the specified upgrade bundle.
get upgrade-bundle <bundle-name-arg> playbook <playbook-file-arg>

List all playbooks in the filestore


Display all playbooks in the file store.
get upgrade-bundle playbooks

Show the system uptime


Display the system uptime information.
get uptime

Get number of days od details user password expiration details


Get number of days the user's password is valid after a password change and number of days before user receives password expiration warning message.
get user <node-all-username> password-expiration

Get user status for specified non-root user


Get user status for specified non-root user.
get user <node-all-username> status

Get SSH keys from authorized_keys file for specified user


Get SSH keys from authorized_keys file for specified user.
get user <node-username> ssh-keys

Display system version


Display the version of the NSX appliance.
get version

Display help for specified command or list available commands


Display help information. See the example below.
help

Join this node to a NSX Cluster


Join this node to a management cluster. You must provide the API username and password of a node that is already in the cluster. On that node, you can run the get cluster config command to get the cluster ID, and run the get certificate api thumbprint command to get the thumbprint. If you do not provide a password on the command line, you will be prompted to enter one.
join <ip-address[:port]> cluster-id <cluster-id> thumbprint <thumbprint> [token <api-token>] [username <username> [password <password>]] [force]

List available commands


This command lists all available commands.
list

nslookup


Get DNS lookup information.

Note that when run on an NSX Manager, the responding server is reported as 127.0.0.1 instead of the configured name server.

nslookup <hostname-or-ip-address>

Ping host


Ping a host or IP address. Use Control-C to stop the command. Optionally use the repeat argument to specify how many packets to transmit.
ping <hostname-or-ip-address> [repeat <number>]

Reboot system


Reboot the system. If you specify the force argument, the system will reboot immediately without prompting for confirmation.
reboot [force]

Restart service


Restart the specified service.
restart service <restartable-service-name-arg>

Execute playbook resume action


Resume an upgrade after running the command start upgrade-bundle <bundle-name> playbook <playbook-file> and the system was rebooted.
resume upgrade-bundle <bundle-name-arg> playbook

Set API account lockout period


Sets the amount of time, in seconds, that an account will remain locked out of the API after exceeding the maximum number of failed authentication attempts.
set auth-policy api lockout-period <lockout-period-arg>

Set API account lockout reset period


In order to trigger an account lockout, all authentication failures must occur in this time window. If the reset period exprires, the failed login count is reset to zero.
set auth-policy api lockout-reset-period <lockout-reset-period-arg>

Set API maximum authentication faliures


Set the number of failed API authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.
set auth-policy api max-auth-failures <auth-failures-arg>

Set CLI account lockout period


Sets the amount of time, in seconds, that an account will remain locked out of the CLI after exceeding the maximum number of failed authentication attempts. While the lockout period is in effect, additional authentication attempts restart the lockout period, even if a valid password is specified.
set auth-policy cli lockout-period <lockout-period-arg>

Set CLI maximum authentication faliures


Set the number of failed CLI authentication attempts that are allowed before the account is locked. If set to 0, account lockout is disabled.
set auth-policy cli max-auth-failures <auth-failures-arg>

Set minimum allowable password length


Set the minimum number of characters that passwords must have. The smallest value that can be set is 8.
set auth-policy minimum-password-length <password-length-arg>

Set auth-policy vidm enabled property


Set the vidm service's enabled property.
set auth-policy vidm enabled

Set auth-policy vidm properties


Set the vidm's properties.
set auth-policy vidm hostname <hostname-or-ip-address> thumbprint <vidm-host-thumbprint-arg> client-id <vidm-client-id-arg> client-secret <vidm-client-secret-arg> node-hostname <hostname-or-ip-address>

Set auth-policy vidm lb-extern enabled property


Set the external load balancer enabled property.
set auth-policy vidm lb-extern enabled

Set security banner or message of the day


Set the security banner or message of the day.
set banner

Set status to display datetime stamp


Set status to display datetime stamp in command output.
set cli-output datetime <datetime-arg>

Set inactivity timeout


Set inactivity timeout in seconds. To disable the timeout, specify 0.
set cli-timeout <timeout-arg>

Enable or disable basic authentication in API calls


Enable or disable basic authentication in API calls.
set cluster api-service basic-authentication <enabled-arg>

Set cluster API service API per-client concurrency limit, 0 to disable


Set the cluster API service API per-client concurrency limit value.
set cluster api-service client-api-concurrency-limit <api-service-client-api-concurrency-limit-arg>

Set per-client API rate limit, 0 to disable


Set the cluster API service API per-client rate limit value.
set cluster api-service client-api-rate-limit <api-service-client-api-rate-limit-arg>

Set cluster api service connection timeout, 0 to disable


Set the cluster api service connection timeout value.
set cluster api-service connection-timeout <api-service-conn-timeout-arg>

Enable or disable cookie-based authentication in API calls


Enable or disable cookie-based authentication in API calls.
set cluster api-service cookie-based-authentication <enabled-arg>

Set cluster API service API global concurrency limit, 0 to disable


Set the Cluster API ServiceAPI global concurrency limit value.
set cluster api-service global-api-concurrency-limit <api-service-global-api-concurrency-limit-arg>

Set cluster api service redirect host


Set the cluster api service redirect host.
set cluster api-service redirect-host <hostname-or-ip-address>

Set cluster api service session timeout, 0 to disable


Set the cluster api service session timeout value.
set cluster api-service session-timeout <api-service-timeout-arg>

Set Cluster Virtual IP


Set Cluster Virtual IP.
set cluster vip <ip46-address>

Set core dump file limit global config


Global limit for count to preserve latest core dump files generated for all processes or applications. By default lastest 2 core dump files will be preserved. To disable this config, set value to 0.

Note, disabling config may consume higher disk space and can cause disk outage.


set core-dump global file-limit <core-dump-limit>

Set core dump frequency threshold global config


Global limit for setting threshold in seconds for frequency of generated core dump files for all processes or applications. Any application generating core dump within threshold seconds will be neglected and new core dump request will only be in effect after expired threshold period. By default processes generating core dump within threshold frequency of 600 seconds will be denied. To disable this config, set value to 0.

Note, disabling config may consume higher disk space and can cause disk outage.


set core-dump global frequency-threshold <core-dump-limit>

Set Core dump limit config per application


Limit for count to preserve latest core dump files generated per process or application. To disable this config, set value to 0.

Note, disabling config may consume higher disk space and can cause disk outage.


set core-dump process <process-name> file-limit <core-dump-limit>

Set GRUB menu timeout


Set GRUB menu timeout.
set grub menu timeout <grub-menu-timeout>

Set GRUB user password


Set GRUB user password.
set grub user <grub-username> password [<grub-password>]

Set commands history size


Set command history size.
set history limit <history-size>

Set system hostname


Set the system hostname. Changing the hostname changes the command line prompt.
set hostname <hostname-arg>

Set logging-server


Configure a logging server. The logging system uses the facility codes defined in RFC 5424. Facility local7 is used for audit messages, and local6 is used for non-audit messages.
set logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> [facility <facility>] [messageid <messageid>] [serverca <filename>] [clientca <filename>] [certificate <filename>] [key <filename>] [structured-data <structured-data>]

Set logging-server


Configure a logging server. The logging system uses the facility codes defined in RFC 5424. Facility local7 is used for audit messages, and local6 is used for non-audit messages.
set logging-server <hostname-or-ip-address[:port]> proto <proto> level <level> [facility <facility>] [messageid <messageid>] [serverca <filename>] [structured-data <structured-data>]

Add name server


Add a name server to the DNS configuration.
set name-servers <name-server-arg>

Set kubeconfig file of the NAPP Kubernetes cluster


Set kubeconfig file of the NAPP Kubernetes cluster. This operation overrides any existing NAPP kubeconfig file.
set napp kubeconfig

Add NTP server


Configure a new NTP server.
set ntp-server <hostname-or-ip-address>

Configure password complexity requirements


Configure password complexity requirements.
  • Minimum password length: minimum number of characters expected in password; user can not set their password of length lesser than this parameter. Default: 12, Minimum: 8, Maximum: 128

  • Maximum password length: maximum number of characters allowed in password; user can not set their password of length greater than this parameter. Default: 128, Minimum: 8, Maximum: 128

  • Lower characters: number of lower case characters (a..z) expected in user password.

    N < 0, to set minimum credit for having lower case character in the new password, i.e. this is the minimum number of lower case character that must be met for a new password.

    N > 0, to set maximum credit for having lower case character in the new password, i.e. per occurrence of lower case character in password will attribute additional credit of +1 towards meeting the current minimum password length value upto N lower case characters.

    N = 0, to disable the policy check.

    Default: -1, Minimum: -128, Maximum: 128

  • Upper characters: number of upper case characters (A..Z) expected in user password.

    N < 0, to set minimum credit for having upper case character in the new password, i.e. this is the minimum number of lower case characters that must be met for a new password.

    N > 0, to set maximum credit for having upper case characters in the new password, i.e. per occurrence of upper case character in password will attribute additional credit of +1 towards meeting the current minimum password length value upto N upper case characters.

    N = 0, to disable the policy check.

    Default: -1, Minimum: -128, Maximum: 128

  • Numeric characters: number of digits (0..9) expected in user password.

    N < 0, to set minimum credit for having digits in the new password, i.e. this is the minimum number of digits that must be met for a new password.

    N > 0, to set maximum credit for having digits in the new password, i.e. per occurrence of digit in password will attribute additional credit of +1 towards meeting the current minimum password length value upto N digits.

    N = 0, to disable the policy check.

    Default: -1, Minimum: -128, Maximum: 128

  • Special characters: number of special characters (!@#$&*..) expected in user password.

    N < 0, to set minimum credit for having special characters in the new password, i.e. this is the minimum number of special characters that must be met for a new password.

    N > 0, to set maximum credit for having special characters in the new password, i.e. per occurrence of special case character in password will attribute additional credit of +1 towards meeting the current minimum password length value upto N special case characters..

    N = 0, to disable the policy check.

    Default: -1, Minimum: -128, Maximum: 128

  • Minimum unique characters: number of character changes in the new password that differentiate it from the old password. To disable the check, value should be set to 0. Default: 0, Minimum: 0, Maximum: 128

  • Allowed similar consecutives: reject passwords which contain more than N same consecutive characters. To disable the check, value should be set to 0. Default: 0, Minimum: 0, Maximum: 128

  • Allowed monotonic sequence: reject passwords which contain more than N monotonic character sequences. Monotonic sequences can be '12345' or 'fedcb'. To disable the check, value should be set to 0. Default: 0, Minimum: 0, Maximum: 128

  • Hash algorithm: sets hash/cryptographic algorithm type for new passwords. Default: sha512. Enum: [ sha512, sha256 ]

  • Password remembrance: limit using a password that was used in past; users can not set the same password within the N generations. To disable the check, value should be set to 0. Default: 0, Minimum: 0

Understanding PAM's maximum credit values with an example, consider password complexity configured as follows:
  • Minimum password length: 12
  • Lower case characters: -1
  • Upper case characters: 2
  • Digits: -1
  • Special case characters: -1
above values represent a password to be atleast of length 12 (or credits) which should consist atleast 1 lower case character, atleast 1 digit, atleast 1 special case character and any number of upper case characters.
If included, for first 2 upper case characters additional credit of +2 will be secured.
Which signifies password having 1 upper case character with additional 10 or more characters of required complexity will be allowed to set where total password length would be 11 or more,
password having 2 upper case characters with additional 8 or more characters of required complexity will be allowed to set where total password length would be 10 or more,
whereas password with 3 upper case characters shall still require 7 or more characters with above minimum value requirements, as there's only maximum credit of 2 configured for upper case characters.

Few valid passwords with respect to configured example complexity requirements:

  • hivmware@123 - consists of required minimum 1 - lower case character, special case character, digit and overall length is 12
  • Hivmware@12 - consists of required minimum 1 - lower case character, special case character, digit; whereas length is 11 but inclusion of 1 upper case character attributes an extra +1 credit, hence password is valid
  • HiVmware@1 - consists of required minimum 1 - lower case character, special case character, digit; whereas length is 10 but inclusion of 2 upper case characters attributes an extra +2 credit, hence password is valid

whereas following passwords will be invalid:

  • hivmware@12 - required length of 12 is not fulfilled
  • hivmware1234 - required minimum 1 special case character is not fulfilled
  • HiVMwar@1 - there are 3 upper case characters out which only maximum 2 characters will be considered for extra credit, third occurrence of upper case character will be attributed as 1 credit only, hence the overall credit score 11 does not fulfills complexity

Note, passwords less than 8 characters are never allowed.


set password-complexity [<complexity-name> <complexity-value>]

Set repository state properties


Set current node's IP address as repository IP. This command will restart the install-upgrade service.
set repository-ip

Add IPv4 or IPv6 network route


Add IPv4 or IPv6 network route. You can also just set a gateway by specifying a prefix value of 0.0.0.0/0 for Ipv4 and ::/0 for Ipv6. Default value for the IPv6 route metric is 1024.
set route prefix <prefix> [gateway <gateway-ip>] [interface <interface-name>] [metric <ip-route-metric>]

Add a domain name


Add a domain name to the DNS search list.
set search-domains <search-domain-arg>

Set async replicator service logging level


Set the log level of the async replicator service.
set service async_replicator logging-level <async-replicator-level-arg>

Set Auth service logging level


Set the log level of the Auth service.
set service auth logging-level <auth-level-arg>

Enable or disable basic authentication in API calls.


Enable or disable basic authentication in API calls.
set service http basic-authentication <enabled-arg>

Set http API per-client concurrency limit, 0 to disable


Set the HTTP API per-client concurrency limit value.
set service http client-api-concurrency-limit <http-client-api-concurrency-limit-arg>

Set http per-client API rate limit, 0 to disable


Set the HTTP API per-client rate limit value.
set service http client-api-rate-limit <http-client-api-rate-limit-arg>

Set http service connection timeout, 0 to disable


Set the HTTP service connection timeout value.
set service http connection-timeout <http-conn-timeout-arg>

Enable or disable cookie-based authentication in API calls.


Enable or disable cookie-based authentication in API calls.
set service http cookie-based-authentication <enabled-arg>

Set http API global concurrency limit, 0 to disable


Set the HTTP API global concurrency limit value.
set service http global-api-concurrency-limit <http-global-api-concurrency-limit-arg>

Set HTTP service logging level


Set the log level of the HTTP service.
set service http logging-level <http-level-arg>

Set http service redirect host


Set the HTTP service redirect host.
set service http redirect-host <hostname-or-ip-address>

Set http service session timeout, 0 to disable


Set the HTTP service session timeout value.
set service http session-timeout <http-timeout-arg>

Set install-upgrade service enabled property


Set the install-upgrade service's enabled property.
set service install-upgrade enabled

Set Node Management service logging level


Set the log level of the Node Management service.
set service node-mgmt logging-level <node-mgmt-level-arg>

Set NTP service start on boot


Configure the NTP service to start on boot.
set service ntp start-on-boot

Set snmp service start on boot


Configure the snmp service to start on boot.
set service snmp start-on-boot

Set SSH service start on boot


Configure the SSH service to start on boot.
set service ssh start-on-boot

Set Telemetry service logging level


Set the log level of the Telemetry service.
set service telemetry logging-level <telemetry-level-arg>

Set SNMP service v1/v2c community string


Set the SNMP service v1/v2c community string in ciper text. This must be set before MIBs can be queried. Choose a string that is difficult to guess.
set snmp community

Set SNMP service v1/v2c community string


Set the SNMP service v1/v2c community string. This must be set before MIBs can be queried. Choose a string that is difficult to guess.
set snmp community <snmp-community-arg>

Set SNMP v2 Trap Targets


Set SNMP v2 Trap Targets.
set snmp v2-targets <hostname-or-ip-address-optional-port-arg> community <snmp-community-arg>

Set SNMP v3 Engine ID


Set SNMP v3 Engine ID.
set snmp v3-engine-id <v3-engine-id-arg>

Set SNMP v3 Protocols


Set SNMP v3 Protocols auth_protocol and priv_protocol.
set snmp v3-protocols auth-protocol <v3-auth-protocol-arg> priv-protocol <v3-priv-protocol-arg>

Set SNMP v3 Trap Targets


Set SNMP v3 Trap Targets.
set snmp v3-targets <hostname-or-ip-address-optional-port-arg> user <user-id-arg>

Set SNMP v3 users


Set SNMP v3 users,auth-password,priv-password in cipher text.
set snmp v3-users <user-id-arg>

Set SNMP v3 users


Set SNMP v3 users auth-password,priv-password in plain text.
set snmp v3-users <user-id-arg> auth-password <auth-password-arg> priv-password <priv-password-arg>

Set SSH Root login property


Enable SSH Root login property
set ssh root-login

Set system timezone


Set the system timezone.
set timezone <timezone-arg>

Set number of days the user's password is valid after a password change


Set number of days the user's password is valid after a password change.
set user <node-all-username> password-expiration <password-expiration-arg>

Set number of days prior user receives warning message before password expires


Set number of days prior user receives warning message before password expires. Set 0 to disable warning messages for password expiry.
set user <node-all-username> password-expiration-warning <password-expiration-warn-arg>

Set new username for specified non-root user


Set new user name for the specified non-root user.
set user <node-all-username> username <new-node-username>

Set user password


Set the password for the specified user. If you do not specify the password on the command line, you will be prompted for it. For details on setting passwords during installation, see the NSX Installation Guide.
set user <username> password [<password> [old-password <old-password>]]

Add SSH service key to authorized_keys file for specified user


Add SSH service key to authorized_keys file for specified user. If password is not provided in the command then you are prompted to enter it. Password is required only for users root and admin.
set user <username> ssh-keys label <key-label> type <key-type> value <key-value> [password <password>]

Shutdown system


Shut down the system. If you specify the force argument, the system will shut down immediately without prompting for confirmation.
shutdown [force]

Start packet capture on given interface with multiple options and save to file


Start a packet capture on the specified interface in the given direction. If you do not specify a file, the output is displayed on the terminal. Type Control-C to end the packet capture. You can filter the capture using tcpdump expressions. The expression must be the last argument of the command. The expression is a keyword followed by a value. You can specify multiple keyword-value pairs. The list of keywords and acceptable values are:

Keyword Value
ethtype Ethernet type in HEX format. 0x<ETHTYPE>
mac Source or destination MAC address
srcmac Source MAC address
dstmac Destination MAC address
ipproto IP protocol in HEX format. 0x<PROTO>
ip Source or destination IPv4 address
ip6 Source or destination IPv6 address
srcip Source IPv4 address
dstip Destination IPv4 address
srcip6 Source IPv6 address
dstip6 Destination IPv6 address
port Source or destination TCP port
srcport Source TCP port
dstport Destination TCP port
srcudpport Source UDP port
dstudpport Destination UDP port
vni VNI of the flow. When specified, the decoding offset for the remainder of the expression changes to the inner packet.
vlan VLAN ID

start capture interface <interface-name> [direction <direction>] [file <filename>] [count <packet-count>] [expression <expression>]

Re-sync search service


Execute full or partial re-sync of search service datastore.
start search resync <search-scope-arg>

Start service


Start the specified service.
start service <start-stoppable-service-name-arg>

Execute a playbook given a valid playbook file


Start an upgrade with the specified upgrade bundle and according to the specified playbook.
start upgrade-bundle <bundle-name-arg> playbook <playbook-file-arg>

Stop service


Stop the specified service.
stop service <service name> [force]

traceroute


Trace the route to the specified IPv4 address or host.
traceroute <hostname-or-ip-address>

Verify all configured logging servers


Verify iptables rules for all logging servers and update if needed
verify logging-servers

Verify and extract bundle to default location


Verify and extract the specified upgrade bundle to the default location.
verify upgrade-bundle <bundle-name-arg>
Total commands: 197