Associated Commands:

CLI Description Command

Clear NSX Intelligence flows statistics

Clear NSX Intelligence flows statistics.

clear intelligence flows stats

Clean up host state

Deletes all NSX configuration and modules from the host only. Please delete the corresponding transport node entries from NSX manager using GUI/API.

clear management-plane

Delete a configured packet capture session

Delete a packet capture session configuration.

del capture session <dpd-number-session-id-arg>

Delete an interface from a packet capture session

Delete the specified interface from a packet capture session configuration. If you are only monitoring one interface, this deletes the monitoring session configuration.

del capture session <dpd-number-session-id-arg> interface <variable-interface-name>

Delete NSX from host

Destroy NSX environment on this host without removing its transport node from management plane. If there are no resources used by the NSX host switches, this command will delete the host switches and all NSX packages. If there are any resources on the host switches, the resources will first be migrated out of the NSX host switches and then the host switches and all NSX packages will be deleted.

del nsx

Detach host from management plane

Detach this hypervisor host from the management plane. You can specify any NSX Manager in the management cluster in this command.

Use the API username and password for the specified NSX Manager. If you do not provide a password on the command line, you will be prompted to enter one.

Get the NSX Manager thumbprint by running the get certificate api thumbprint command on the specified NSX Manager.

detach management-plane <hostname-or-ip-address[:port]> username <username> thumbprint <thumbprint> [password <password>]

Exit the CLI

Exit the VRF context mode if you are in it. Otherwise, exit the CLI.

exit

Display a packet capture session

Display information about the specified packet capture session.

get capture session <dpd-number-session-id-arg>

Display packet capture sessions

Display configured packet capture sessions. Session 0 is reserved for captures started with the start capture interface <interface-name> command.

get capture sessions

Show status to display datetime stamp

Show status to display datetime stamp in command output.

get cli-output datetime

Display commands history

Display the commands history in command output.
To show all command history set size to 0.

Note:Outputs command history from version 3.2.0 and above.

get command history

Display controller connection

Display the controllers connected to this node.

get controllers

List core dump files in the system

Display information about the core dump files in the system.

get core-dumps

Display firewall address sets

get firewall <vif-uuid-arg> addrsets

Display firewall fqdn attribute of profiles

Display firewall fqdn attribute of profiles.

get firewall <vif-uuid-arg> fqdn

Display firewall attribute profiles

Display firewall attribute profiles.

get firewall <vif-uuid-arg> profile

Display firewall rules

get firewall <vif-uuid-arg> ruleset rules

Display firewall exclusion

Display firewall exclusions.

get firewall exclusion

Display firewall ipfix containers

Display firewall ipfix containers.

get firewall ipfix-containers

Display firewall ipfix filters

Display firewall ipfix filters.

get firewall ipfix-filters

Display firewall ipfix profile configuration

Display firewall ipfix profile configration.

get firewall ipfix-profiles

Display firewall ipfix statistics

Display firewall ipfix statistics.

get firewall ipfix-stats

Show DFW packet log file contents

Display the contents of the DFW packet log file.

get firewall packetlog

Show last lines of DFW packet log file contents

Display last lines of the DFW packet log file.

get firewall packetlog last <line-count-arg>

Display firewall rule statistics

Display firewall rule statistics.

get firewall rule-stats

Display total firewall rule statistics

Display total firewall rule statistics.

get firewall rule-stats total

Display the firewall status

Display the firewall status.

get firewall status

Display firewall thresholds

Display firewall thresholds.

get firewall thresholds

Display firewall VIFs

get firewall vifs

Display a gateway

Display information about the specified gateway.

get gateway <uuid-arg>

Display forwarding information for a gateway

Display forwarding for the specified gateway.

get gateway <uuid-arg> forwarding

Display forwarding information for a gateway

Display forwarding for the specified gateway, filtered by prefix.

get gateway <uuid-arg> forwarding <network46-address>

Display IPv4 forwarding for a gateway

Display IPv4 forwarding for the specified gateway.

get gateway <uuid-arg> forwarding ipv4

Display IPv6 forwarding for a gateway

Display IPv6 forwarding for the specified gateway.

get gateway <uuid-arg> forwarding ipv6

Display a gateway interface

Display interface information for the specified gateway and port.

get gateway <uuid-arg> interface <uuid-arg>

Display a gateway interface statistics

Display interface statistics for the specified gateway and port.

get gateway <uuid-arg> interface <uuid-arg> stats

Display a gateway interface statistics

Display interface statistics for the specified gateway and port.

get gateway <uuid-arg> interface <uuid-arg> stats <ip-version>

Display interfaces for a gateway

Display interface information for the specified gateway.

get gateway <uuid-arg> interfaces

Display neighbor for a gateway

Display neighbor information (ARP/ND cache) for the specified gateway, using IP or MAC.

get gateway <uuid-arg> neighbor <ipormac-address>

Display neighbors for a gateway

Display neighbor information (ARP cache) for the specified gateway.

get gateway <uuid-arg> neighbors

Display gateway summary

Display information about gateways on this hypervisor host.

get gateways

Get CIF configuration by AppID

Display the container interface (CIF) configuration for the specified app.

get hyperbus app-id <app-ID> cif-config

Get CIF configuration cache table

Display the container interface (CIF) configuration table.

get hyperbus cif-table

Get VIF connection info

Display the virtual interface (VIF) connection information.

get hyperbus connection info

Get LIP IP pool

Display the LIP allocation pool.

get hyperbus lip ip-pool

Get CIF configuration by logical switch port ID

Display the container interface (CIF) configuration for the specified logical switch port.

get hyperbus logical-switch-port <logical-switch-port-ID> cif-config

Get connection info by VIF ID

Display the connection information for the specified virtual interface (VIF).

get hyperbus vif-id <vif-ID> connection info

Get LIP by VIF ID

Display the logical IP (LIP) for the specified virtual interface (VIF).

get hyperbus vif-id <vif-ID> lip

Get VIF LIP table

Display the VIF (virtual interface) LIP (logical IP) table.

get hyperbus vif-lip-table

Get connected VIF table

Display the connected virtual interfaces (VIFs). For ESXi, all connected container host VIFs are displayed. For KVM, all connected container host VIFs and CIFs are displayed.

get hyperbus vif-table

Display NSX Intelligence flows configuration

Display NSX Intelligence flows configuration.

get intelligence flows config

Display NSX Intelligence flows aggregation mask

Display NSX Intelligence flows aggregation mask.

get intelligence flows mask

Display NSX Intelligence flows statistics

Display NSX Intelligence flows statistics.

get intelligence flows stats

Display NSX Intelligence flows acknowledgement statistics

Display NSX Intelligence flows acknowledgement statistics.

get intelligence flows stats ack

Display discovered bindings

Display discovered bindings.

get ip-discovery bindings

Display discovered bindings for a given logical port

Display discovered bindings for a given logical port.

get ip-discovery bindings <logical-port>

Display discovered bindings for a given logical port and type

Display discovered bindings for a given logical port and type.

get ip-discovery bindings <logical-port> <ip-version>

Display ip-discovery config for all logical ports

Display ip-discovery profile for all logical ports.

get ip-discovery config

Display ip-discovery config for a given logical port

Display ip-discovery config for a given logical port.

get ip-discovery config <logical-port>

Display ignore bindings list

Display ignore bindings list.

get ip-discovery ignore-list

Display ignore bindings list for a given logical port

Display ignore bindings list for a given logical port.

get ip-discovery ignore-list <logical-port>

Display ignore bindings list for a given logical port and type

Display ignore bindings list for a given logical port and type.

get ip-discovery ignore-list <logical-port> <ip-version>

Display ip-discovery ignore list stats for all logical ports

Display ip-discovery ignore list stats for all logical ports.

get ip-discovery ignore-list stats

Display ip-discovery ignore list stats for a given logical ports.

get ip-discovery ignore-list stats <logical-port>

Display ip-discovery stats for all logical ports

Display ip-discovery stats for all logical ports.

get ip-discovery stats

Display ip-discovery stats for a given logical port

Display ip-discovery profile for a given logical port.

get ip-discovery stats <logical-port>

Display LLDP configuration on all devices

Display LLDP configuration on all devices.

get lldp config

Display LLDP configuration on given device

Display LLDP configuration on given device.

get lldp config <lldp-interface-name-kvm>

Display LLDP Neighbor information on all devices

Display LLDP Neighbor information on all devices.

get lldp neighbors

Display LLDP Neighbor information on given device

Display LLDP Neighbor information on given device.

get lldp neighbors <lldp-interface-name-kvm>

Display a logical router

Display information about the specified logical router.

get logical-router <uuid-arg>

Display forwarding information for a logical router

Display forwarding for the specified logical router.

get logical-router <uuid-arg> forwarding

Display forwarding information for a logical router

Display forwarding for the specified logical router, filtered by prefix.

get logical-router <uuid-arg> forwarding <network46-address>

Display IPv4 forwarding for a logical router

Display IPv4 forwarding for the specified logical router.

get logical-router <uuid-arg> forwarding ipv4

Display IPv6 forwarding for a logical router

Display IPv6 forwarding for the specified logical router.

get logical-router <uuid-arg> forwarding ipv6

Display a logical router interface

Display interface information for the specified logical router and port.

get logical-router <uuid-arg> interface <uuid-arg>

Display a logical router interface statistics

Display interface statistics for the specified logical router and port.

get logical-router <uuid-arg> interface <uuid-arg> stats

Display a logical router interface statistics

Display interface statistics for the specified logical router and port.

get logical-router <uuid-arg> interface <uuid-arg> stats <ip-version>

Display interfaces for a logical router

Display interface information for the specified logical router.

get logical-router <uuid-arg> interfaces

Display neighbor for a logical router

Display neighbor information (ARP/ND cache) for the specified logical router, using IP or MAC.

get logical-router <uuid-arg> neighbor <ipormac-address>

Display neighbors for a logical router

Display neighbor information (ARP cache) for the specified logical router.

get logical-router <uuid-arg> neighbors

Display logical router summary

Display information about logical routers on this hypervisor host.

get logical-routers

Display information about a logical switch

Display information about the specified logical switch.

get logical-switch <ls-id-arg-kvm>

Display ARP table for a logical switch

Display the ARP table for the specified logical switch.

get logical-switch <ls-id-arg-kvm> arp-table

Display MAC table for a logical switch

Display the MAC table for the specified logical switch.

get logical-switch <ls-id-arg-kvm> mac-table

Display ports on a logical switch

Display ports on the specified logical switch.

get logical-switch <ls-id-arg-kvm> ports

Display VTEP table for a logical switch

Display the VTEP table for the specified logical switch.

get logical-switch <ls-id-arg-kvm> vtep

Get logical switch local mac

Display a specific logical switch's local or remote MAC, ARP, or VTEP information.

get logical-switch {local | remote} {mac-cache | arp-cache | vtep-cache} <vni>

Display logical switches

Display all logical switches on this host.

get logical-switches

Get maintenance mode

Get maintenance mode status.

get maintenance-mode

Show managers

Show the current list of configured managers.

get managers

Display information about a mirror session

Display information about the specified mirror session.

get mirror-session <ms-id-arg>

Display mirror sessions

Display all mirror sessions on this host.

get mirror-sessions

Get central-config properties

Get central-config properties.

get node central-config

Show host UUID

Display the UUID for the host.

get node-uuid

Display a routing domain

Display information about the specified routing domain.

get routing-domain <uuid-arg>

Display routing domain

Display information about all routing domains.

get routing-domains

Display information about a segment

Display information about the specified segment.

get segment <segment-id-arg-kvm>

Display ARP table for a segment

Display the ARP table for the specified segment.

get segment <segment-id-arg-kvm> arp-table

Display MAC table for a segment

Display the MAC table for the specified segment.

get segment <segment-id-arg-kvm> mac-table

Display ports on a segment

Display ports on the specified segment.

get segment <segment-id-arg-kvm> ports

Display VTEP table for a segment

Display the VTEP table for the specified segment.

get segment <segment-id-arg-kvm> vtep

Get segment local mac

Display a specific segment's local or remote MAC, ARP, or VTEP information.

get segment {local | remote} {mac-cache | arp-cache | vtep-cache} <vni>

Display segments

Display all segments on this host.

get segments

Get the log level of NSX Agent service.

Get service nsx-agent logging level.

get service nsx-agent logging-level

Get service exporter SmartNIC demux logging level

Get service exporter SmartNIC demux logging level.

get service nsx-exporter lib-sndemux logging-level

Get service opsagent SHA client logging level

Get service opsagent SHA client logging level.

get service nsx-opsagent lib-sha logging-level

Get service opsagent SmartNIC demux logging level

Get service opsagent SmartNIC demux logging level.

get service nsx-opsagent lib-sndemux logging-level

Get service opsagent workflow logging level

Get service opsagent workflow logging level.

get service nsx-opsagent lib-wft logging-level

Get service opsagent workflow trace level

Get service opsagent workflow trace level.

get service nsx-opsagent lib-wft trace-level

Get service OpsAgent logging level

Get service OpsAgent logging level.

get service nsx-opsagent logging-level

Get service nsx-proxy central logging level

Get service nsx-proxy central logging level.

get service nsx-proxy central logging-level

Get service nsx-proxy metrics logging level

Get service nsx-proxy metrics logging level.

get service nsx-proxy lib-metrics logging-level

Get service nsx-proxy nestdb logging level

Get service nsx-proxy nestdb logging level.

get service nsx-proxy lib-nestdb logging-level

Get service nsx-proxy net logging level

Get service nsx-proxy net logging level.

get service nsx-proxy lib-net logging-level

Get service nsx-proxy rpc logging level

Get service nsx-proxy rpc logging level.

get service nsx-proxy lib-rpc logging-level

Get service nsx-proxy logging level

Get service nsx-proxy logging level.

get service nsx-proxy logging-level

Display Spoof Guard config for a logical port

Displays Spoof Guard config for a logical port.

get spoof-guard config <logical-port>

Display Spoof Guard stats for a logical port

Displays Spoof Guard stats for a logical port.

get spoof-guard stats <logical-port>

Display Spoof Guard whitelist for a logical port

Displays Spoof Guard whitelist for a logical port.

get spoof-guard whitelist <logical-port>

Display information about a IPFIX configuration

Display information about the specified IPFIX configuration.

get switch-ipfix logical-switch-port <logical-port-id-arg> setting

Display Switch Security config for a logical port

Displays Switch Security config for a logical port.

get switch-security config <logical-port>

Display Switch Security stats for a logical port

Displays Switch Security stats for a logical port.

get switch-security stats <logical-port>

Display system version

Display the version of the NSX appliance.

get version

Display help for specified command or list available commands

Display help information. See the example below.

help

Join host with management plane

Join this hypervisor host with the management plane. You can specify any NSX Manager in the management cluster in this command.

Use the API username and password for the specified NSX Manager. If you do not provide a password on the command line, you will be prompted to enter one.

Get the NSX Manager thumbprint by running the get certificate api thumbprint command on the specified NSX Manager.

join management-plane <hostname-or-ip-address[:port]> username <username> thumbprint <thumbprint> [password <password>]

List available commands

This command lists all available commands.

list

Push certificate to management plane

Pushes host certificate to management plane.

Use the API username and password for the specified NSX Manager. If you do not provide a password on the command line, you will be prompted to enter one.

Get the NSX Manager thumbprint by running the get certificate api thumbprint command on the specified NSX Manager.

push host-certificate <manager-hostname-or-ip-address-and-optional-port-arg> username <api-username> thumbprint <api-thumbprint>

Recover management plane account on the host

Recover management plane account on the host. You can specify any NSX Manager in the management cluster in this command.

Use the API username and password for the specified NSX Manager. If you do not provide a password on the command line, you will be prompted to enter one.

Get the NSX Manager thumbprint by running the get certificate api thumbprint command on the specified NSX Manager.

reset management-plane <hostname-or-ip-address[:port]> username <username> thumbprint <thumbprint> [password <password>]

Display packet capture on session

Start a packet capture. You must have already configured the packet capture with the set capture session <session-number> interface <port-uuid-name> direction <direction> command in basic mode, or with the set capture session <session-number> direction <direction> command in path mode.

Use the get capture sessions command in basic mode to see all configured capture sessions.

set capture session <dpd-number-session-id-arg>

Monitor a port in a packet capture session

Configure a packet capture using the specified interface. You can run this command multiple times to configure multiple interfaces on the same packet capture session.

To run the packet capture using this configuration, use the set capture session <session-number> [file <filename>] [count <packet-count>] [expression <expression>] command.

If you need to capture packets from only one interface, you can configure and run the packet capture with a single command: start capture interface <interface-name> [file <filename>] [count <packet-count>] [expression <expression>].

Use the get capture sessions command to see all configured capture sessions.

set capture session <dpd-number-session-id-arg> interface <variable-interface-name> direction <capture-direction-arg>

Start packet capture for the specified session

Start a packet capture. You must have already configured the packet capture with the

set capture session
<session-number> interface <port-uuid-name>
direction <direction>

command.

If you don't specify a file, the output displays on the terminal.

Type Control-C to end the packet capture.

You can filter the capture using tcpdump expressions. The expression must be the last argument of the command.

Use the get capture sessions command to see all configured capture sessions.

set capture session <session-number> [file <filename>] [count <packet-count>] [expression <expression>]

Set status to display datetime stamp

Set status to display datetime stamp in command output.

set cli-output datetime <datetime-arg>

Set commands history size

Set command history size.

set history limit <history-size>

Set maintenance mode

Enable or disable maintenance mode. Maintenance mode can be used during upgrade and debugging. When an TN is in maintenance mode only management traffic will be passed; data traffic will be dropped.

set maintenance-mode <nsxproxy-maintenance-mode-arg>

Ignore Central Config from the Manager to this appliance

Ignore Central Config from the Manager to this appliance.

set node central-config disabled

Synchronize Central Config from the Manager to this appliance

Synchronize Central Config from the Manager to this appliance.

set node central-config enabled

Set the log level of NSX Agent service.

Dynamically set service daemon log level.

set service nsx-agent logging-level <nsx-agent-logging-level-arg>

Set service exporter SmartNIC demux logging level

Set service exporter SmartNIC demux logging level.

set service nsx-exporter lib-sndemux logging-level <logging-level-arg>

Set the log level of exporter service.

Dynamically set service daemon log level.

set service nsx-exporter logging-level <level>

Set service opsagent SHA client logging level

Set service opsagent SHA client logging level.

set service nsx-opsagent lib-sha logging-level <opsagent-logging-level-arg>

Set service opsagent SmartNIC demux logging level

Set service opsagent SmartNIC demux logging level.

set service nsx-opsagent lib-sndemux logging-level <opsagent-logging-level-arg>

Set service opsagent workflow logging level

Set service opsagent workflow logging level.

set service nsx-opsagent lib-wft logging-level <opsagent-logging-level-arg>

Set service opsagent workflow trace level

Set service opsagent workflow trace level.

set service nsx-opsagent lib-wft trace-level <opsagent-workflowtrace-level-arg>

Set service OpsAgent logging level

Set service OpsAgent logging level.

set service nsx-opsagent logging-level <opsagent-logging-level-arg>

Set the log level of platform client service.

Dynamically set service daemon log level.

set service nsx-platform-client logging-level <platform-client-logging-level-arg>

Set service nsx-proxy central logging level

set service nsx-proxy central logging-level <nsxproxy-logging-level-arg>

Set service nsx-proxy metrics logging level

Set service nsx-proxy metrics logging level.

set service nsx-proxy lib-metrics logging-level <nsxproxy-logging-level-arg>

Set service nsx-proxy nestdb logging level

Set service nsx-proxy nestdb logging level.

set service nsx-proxy lib-nestdb logging-level <nsxproxy-logging-level-arg>

Set service nsx-proxy net logging level

Set service nsx-proxy net logging level.

set service nsx-proxy lib-net logging-level <nsxproxy-logging-level-arg>

Set service nsx-proxy rpc logging level

Set service nsx-proxy rpc logging level.

set service nsx-proxy lib-rpc logging-level <nsxproxy-logging-level-arg>

Set service nsx-proxy logging level

Set service nsx-proxy logging level.

set service nsx-proxy logging-level <nsxproxy-logging-level-arg>

Start packet capture on given interface with multiple options and save to file

Start a packet capture on the specified interface in the given direction. If you do not specify a file, the output is displayed on the terminal. Type Control-C to end the packet capture. You can filter the capture using tcpdump expressions. The expression must be the last argument of the command. The expression is a keyword followed by a value. You can specify multiple keyword-value pairs. The list of keywords and acceptable values are:

Keyword	Value
ethtype	Ethernet type in HEX format. 0x<ETHTYPE>
mac	Source or destination MAC address
srcmac	Source MAC address
dstmac	Destination MAC address
ipproto	IP protocol in HEX format. 0x<PROTO>
ip	Source or destination IPv4 address
ip6	Source or destination IPv6 address
srcip	Source IPv4 address
dstip	Destination IPv4 address
srcip6	Source IPv6 address
dstip6	Destination IPv6 address
port	Source or destination TCP port
srcport	Source TCP port
dstport	Destination TCP port
srcudpport	Source UDP port
dstudpport	Destination UDP port
vni	VNI of the flow. When specified, the decoding offset for the remainder of the expression changes to the inner packet.
vlan	VLAN ID

start capture interface <interface-name> [direction <direction>] [file <filename>] [count <packet-count>] [expression <expression>]

Sync APH certificates from management plane

Syncs APH certificates from management plane to host. If you do not provide a password on the command line, you will be prompted to enter one.

Get the NSX Manager thumbprint by running the get certificate api thumbprint command on the specified NSX Manager.

sync-aph-certificates <manager-hostname-or-ip-address[:port]> username <username> thumbprint <thumbprint> [password <password>]

Total commands: 154