NSX 3.x The case of the lost security group

Let me explain the situation. In the NSX GUI you create a normal security group. Once you have created the security group, you use a script to enumerate all security groups with ‘PRD’ (for production) in the name. After connecting to NSX with PowerCLI, you can start with a command like:

This command listed most groups, but not the once started with an underscore. These where not mentioned at all in the results. Our first thought, it must have something to do with the scripting. But after a bit of searching we discovered that the issues were in the API itself. That’s really stupid. Let’s show an example.

Create a group called Test-Blog.

Use Postman to retrieve the group. This can be done with an API call like:

GET https://<NSX Manager>/policy/api/v1/infra/domains/default/groups/

As you can see there are 4 items when searching for Test-BLOG in the results.

Rename the group in NSX to _Test-BLOG.

And repeat the same Postman query.

As you can see, the group is missing from the results. Although the group is missing from the ‘get all groups’ API call, it can be searched directly. That’s because the ID of the group has not changed.

This issue occurs in the NSX 3.x API and at least in version 4.1 of NSX it works correctly. So it appears that the NSX 3.x API is skipping security groups in the ‘get all groups’ API call when the display name starts with an ‘_’ underscore. But the group can still be found using a direct search or search query. The only question is: how does your script know if it is there…

Hopefully you enjoyed reading this blog and by reading it you avoided debugging your script. But I guess that your search started after debugging 😉

If you have any questions or would like to see more? Then use the message option below.