NSX-T 3.2.0 Advanced Load Balancer virtual service creation fails with custom Application Profile

[acravens9]

Created a custom Application Profile via the Policy REST API.  Proceeded to create a new Virtual Service.  The newly created VIP was created successfully and has a green status.  Next, the new Virtual Service was auto-created and has a red status.  The error is as follows:

Jan 18, 2022, 3:55:16 PM: Realization failure, waiting for realization of [{ALBApplicationProfile}]: my-application-profile, Realization will be reattempted in next cycle (max 5 minutes)

The "my-application-profile" was successfully created and shows up in the Application Profile drop down box, and I can select it.  However, this error indicates there is still something wrong with it.  I've found posts about other "Realization failure" errors but none in this particular context.  Any tips on this?

[acravens9]

Please note that having the username password and host name defined in the script is a security concern and should only be done that way for a test environment.  If I were going to use that script for production I would rewrite it and have the script prompt for those values.  

[grimsrue]

Thanks for that bash shell script. I am going to use it for some other API I need to push. Scripting is not my best subject.

That being said, I was trying to create a very quick Application profile. I normally use powershell7 to run quick curl commands to the NSX-T API and occasionally I use Postman. I could not figure out why I could not PUT your "simple" profile without getting all sorts of odd errors back. I realized I was missing two things.

"alb-application-id" at the end of the URL line. The "id" is the same as your Display Name or any other name you want to use (I did not know that. I kept trying to find a "id" somewhere 😐)
(i.e. https://NSX-T-Manager/policy/api/v1/infra/alb-application-profiles/test-application-profile)

and

I needed two closed brackets at the end of the JSON data. "}}"

For those that want to create a "QUICK" application profile in NSX-T using the curl command through Powershell, this worked for me.

curl --insecure -u admin:your-password  -X PUT "https://your-nsx-t-manager.fqdn/policy/api/v1/infra/alb-application-profiles/test-application-profil..." -H "Content-Type: application/json" --data '{"display_name" : "test-application-profile","resource_type" : "ALBApplicationProfile","type" : "APPLICATION_PROFILE_TYPE_HTTP","http_profile" :{"secure_cookie_enabled": false}}'

or

curl --insecure -u admin:your-password  -X PUT "https://your-nsx-t-manager.fqdn/policy/api/v1/infra/alb-application-profiles/Basic_L4-Testing" -H "Content-Type: application/json" --data '{"display_name":"Basic_L4-Testing","resource_type":"ALBApplicationProfile","type":"APPLICATION_PROFILE_TYPE_L4","preserve_client_ip": false,"preserve_client_port": false,"preserve_dest_ip_port": false}'

[acravens9]

I'm going to rewrite that script so it prompts the user to enter the username, password, hostname and application profile type (HTTP or L4).  Then I'm going to create two "template" JSON files (HTTP and L4) and comment the heck out of them so it will be fairly easy to tweak the template and send the JSON.  I was hoping vmware would come out with an update to fix the application profiles. 

I'll mention this one last time:

* When you create an application profile using the new NSX-T API, there are objects that get created and stored in both NSX-T and in AVI. 

* If an application profile was successfully created using the NSX-T API it will show up in both NSX-T and the AVI UI.

* If you used invalid JSON, the application profile objects may or may not get created in NSX-T but it absolutely will not get created in the AVI interface.  The NSX-T side will allow you to submit invalid JSON and it won't throw an error.  The error can be found in the AVI controller logs.

* If an application profile was created in the AVI interface, it will not show up in the NSX-T interface and cannot be used by an NSX-T created virtual service.

* You cannot create an application profile using the NSX-T API and then edit the application profile using the AVI web UI.  I verified this in my lab.  Well, actually, you can edit the profile in the AVI web ui but it will break the corresponding profile in the NSX-T interface. 🙂