Skip to main content

VMware NSX — Group Export

Group Export also works against VMware NSX: it pushes a Connect Group's members to an NSX Group under NSX's Policy API, kept in sync automatically. The mechanics mirror Panorama Group Export, but the target is an NSX Group instead of a Dynamic Address Group.

Each Connect Group targeting an NSX account becomes one NSX Group, tagged so it's clearly identifiable as FireMon-managed. Every sync fully replaces that NSX Group's membership with the Connect Group's current members — so the NSX Group always reflects exactly what Connect has, with no manual reconciliation needed.

Set up a VMware NSX account​

  1. In Connect, go to Settings > Accounts and add a new account.
  2. Cloud Provider: VMware NSX. Give it an account ID and name.
  3. Save — you land on the Provision page. Fill in:
    • Connector — the Connector you paired earlier. (Required for NSX.)
    • NSX Manager Host — your NSX Manager's hostname or IP address.
    • Username / Password — an NSX user with permission to create/update Groups.
    • Manager Type — Local Manager (the default, and the common case for a single NSX site) or Global Manager (Federation) if you're connecting to an NSX Federation Global Manager. Objects created on a Global Manager propagate to every federated site, so make sure this is what you intend.
    • Allow Self-Signed Certificate — turn this on only if your NSX Manager uses a self-signed certificate (NSX Managers ship with one by default). Leave it off if you've installed a certificate from a publicly trusted CA.
  4. Save.

The Connector picks up the account on its next poll (within ~30 seconds).

Export a Group​

Same as Panorama: create or edit a Group under Groups in Connect, set Update to Automatic, and add your NSX account under Export To. A Group can target Panorama and NSX accounts at the same time.

Verify it landed​

In the NSX Manager UI, go to Inventory > Groups and look for a group named after your Connect Group. Its View Members panel shows the CIDRs/IPs pushed from Connect.

NSX applies the change asynchronously after accepting it, so allow a short delay for the group to fully realize before it's usable in policy.

What happens when you change things​

ActionResult
Edit the Group's filtersMembership recalculates on save and the NSX Group's members are replaced on the next sync.
A resource gains/loses a matching tagAutomatic groups pick up the change on the next refresh and re-sync to NSX.
Rename the GroupThe NSX Group's display name updates; its identity (and any policy referencing it) is preserved.
Add/remove a target under Export ToMembers sync to the new target and are removed from any dropped target.
Delete the GroupThe NSX Group is left in place — FireMon never deletes objects in NSX, to avoid disrupting live enforcement. Delete it manually in NSX Manager if it's no longer needed.

For common issues, see Troubleshooting.