NSX 6.2 to vCenter 6.0 u1 registration

[yak9]

Hello,

I was playing with NSX 6.2 in my lab and noticed some strange behavior when trying to register my NSX manager 6.2 to vCenter Server 6.0 u1 with external PSC.

I usually try to connect all services with their respective accounts. So instead of using administrator@vsphere.local to register to vCenter and PSC, I used precreated nsxmgr@vsphere.local user which was part of Administrator group and therefore had full access to the system.

So, NSX to vCenter connection was a success, but as I logged in vSphere Web Client as administrator@vsphere.local, I was unable to see newly registered NSX manager under Networking & Security section of Web Client. Workaround for this situation was:

1. Re-register NSX Manager to vCenter with administrator@vsphere.local account
2. Login to Web Client with administrator@vsphere.local account, switch to Networking & Security section and make sure that NSX Manager is visible
3. Re-register NSX Manager to vCenter with nsxmgr@vsphere.local account

So, my questions (or invitations to discussion) are:

1. Has anyone seen behavior like this? What is the cause of this issue?
2. What user with which rights do you use to register NSX to vCenter? Install guide says best practice is to use administrator@vsphere.local, but I just don't feel like it. What if someone changes administrator@vsphere.local password, for example?

[larsonm]

After your initial registration, did you try logging in as nsxmgr@vsphere.local?

The account used to register NSX Manager to vCenter is the account that has access to the Networking & Security plug-in.

If the account used to register NSX Manager to vCenter changes, NSX Manager will need to be updated to reflect the new password, or the NSX Management Service will be unable to receive inventory updates from vCenter.

[yak9]

No, after initial registration i've tried to login as administrator@vsphere.local

The account used to register NSX Manager to vCenter is the account that has access to the Networking & Security plug-in.

Funny thing is nsxmgr@vsphere.local has Enterprise Administrator rights on NSX. Most likely, they were automatically added during first registration attempt. What puzzles me is why first registration attempts was unsuccessful. Looks like a bug.

[linotelera · Accepted solution]

Hi, just to update checking official documents (VMware NSX 6.2 for vSphere Documentation Center), after NSX registration, you should access with the same user, used in registration process.

From doc:

--------------

Required If vCenter Web Client is already open, log out of vCenter and log back in with the same Administrator role used to register NSX Manager with vCenter. If you do not do this, vCenter Web Client will not display the Networking & Security icon on the Home tab. Click the Networking & Security icon and confirm that you can see the newly deployed NSX Manager.

[yak9]

Thanks, linotelera‌, missed that part of doc somehow

[larsonm]

If you used nsxmgr@vsphere.local to register NSX Manager to vCenter for the first time, and then tried to log in as administrator@vsphere.local, administrator@vsphere.local was not granted access to the NSX Manager instance in the Networking and Security plug-in.  You would have needed to log in as nsxmgr@vsphere.local after initial registration using this account, and then grant others access to the NSX environment.