Configuring a NSX load balancer from API

A customer asked me this week if there was any examples of customers configuring the NSX load balancer via vRealize Automation.   I was surprised when google didn’t turn up any examples.  The NSX API guide (which is one of the best guides around) provides the details for how to call each element.  You can download it here. Once you have the PDF you can navigate to page 200 which is the start of the load balancer section.

Too many Edge devices

NSX load balancers are Edge service gateways.   A normal NSX environment may have a few while others may have hundreds but not all are load balancers.   A quick API lookup of all Edges provides this information: (my NSX manager is hence the usage in all examples)


This is for a single Edge gateway in my case I have 57 Edges deployed over the life of my NSX environment and 15 active right now.   But only Edge-57 is a load balancer.   This report does not provide anything that can be used to identify it as a load balancer from a Edge as a firewall.   In order to identify if it’s a load balancer I have to query it’s load balancer configuration using:

Notice the addition of the edge-57 name to the query.   It returns:

Notice that this edge has load balancer enabled as true with some default monitors.   To compare here is a edge without the feature enabled:

Enabled is false with the same default monitors.   So now we know how to identify which edges are load balancers:

  • Get list of all Edges via API and pull out id element
  • Query each id element for load balancer config and match on true



Adding virtual servers

You can add virtual servers assuming the application profile and pools are already in place with a POST command with a XML body payload like this (the virtual server IP must already be assigned to the Edge as an interface):


You can see it’s been created.  A quick query:


Shows it’s been created.  To delete just use the virtualServerId and pass to DELETE


Pool Members

For pools you have to update the full information to add a backend member or for that matter remove a member.  So you first query it:

Then you form your PUT with the data elements you need (taken from API guide).

In the client we see a member added:

Your ads will be inserted here by

Easy Plugin for AdSense.

Please go to the plugin admin page to
Paste your ad code OR
Suppress this ad slot.


Tie it all together

Each of these actions have a update delete and query function that can be done.  The real challenge is taking the API inputs and creating user friendly data into vRealize Input to make it user friendly.    NSX continues to amaze me as a great product that has a very powerful and documented API.    I have run into very little issues trying to figure out how to do anything in NSX with the API.  In a future post I may provide some vRealize Orchestrator actions to speed up configuration of load balancers.










vRO scriptable task to return top level folder of a VM

Every so often you have nested folders in a vCenter and want to return only the top level folder.  Here is a function to return the top level folder only:


vRO add all virtual machines to NSX exception list

Almost everyone is using a brownfield environment to implement NSX.   Switching the DFW firewall to deny all is the safest bet but hard to do with brownfield environments.   Denying all traffic is a bad idea.  Doing a massive application conversion at once into DFW rules is not practical.  One method to solve this issue is to create an exception for all virtual machines then move them out of exception once you have created the correct allow rules for the machine.   I didn’t want to manually via the GUI add all my machines so I explored the API.

How to explore the API for NSX

VMware’s beta developer center provides the easiest way to explore the NSX API.   You can find the NSX section here.  Searching the api for “excep” quickly turned up the following answer:


As you can see there are three methods (get, put, delete).  It’s always safe to start with a get as it does not produce changes.   Using postman for chrome.  I was quickly connected to NSX see my setting below:


The return from this get was lots of lines of machines that I had manually added to the exception list.  For example the following


Looking at this virtual machine you can see it’s identified by the objectID which aligns with the put and delete functions the following worked perfectly:



A quick get showed the vm-47 was back on the list.  Now we had one issue the designation and inventory of objectID’s is not a construct of NSX but of vCenter.

The Plan

In order to be successful in my plans I needed to do the following

  • Gather list of all objectID’s from vCenter
  • Put the list one at a time into NSX’s exclude list
  • Have some way to orchestrate it all together

No surprise I turned to vRealize orchestrator.   I wanted to keep it generic rest connections and not use NSX plugins.   So my journey began.

Orchestrator REST for NSX

  • Login to orchestrator
  • Switch to workflow view
  • Expand the library and locate the add rest host workflow
  • Run the workflow





  • Hit submit and wait for it to complete
  • You can verify the connect by visiting the administration section and expanding rest connections

Now we need to add a rest operation for addition to the exception list.

  • Locate the Add REST operation workflow
  • Run it
  • Fill out as shown


You now have a put method that takes input of {vm-id} before it can run.  In order to test we go back to our Postman and delete vm-47 and do a get to verify it’s gone:




It’ is missing from the get.   Now we need to run our REST operation

  • Locate the workflow called: Invoke a REST operation
  • Run it as shown below




Once completed a quick postman get showed me vm-47 is back on the exclude list.   Now I am ready for prime time.

Creation of an Add to Exclude List workflow

I need to create a workflow that just runs the rest operation to add to exclude list.

  • Copy the Invoke a REST operation
  • New workflow should be called AddNSXExclude
  • Edit new workflow
  • Go to inputs and remove all param_xxx except param_0
  • Move everything else but param_0 to Attributes


  • Let’s edit the attributes next
  • Click on the value for ther restOperation and set it to “Put on Exclude List ..” operation you created earlier


  • Go to the Schema and edit the REST call scriptable task
  • Remove all param_xxx except param_0 from the IN on the scriptable task


  • Edit the top line of the scripting to read like this:

var inParamtersValues = [param_0];

  • Close the scriptable task
  • Click on presentation and remove everything but the content question


Now we have a new issue.  We need to have it not error when the return code is not 200.  For example if the object is already on the exception list.   We just want everything on the list right away.   So edit your schema to remove everything but the rest call:



Put it all together with a list of virtual machines

Time for a new workflow with a scriptable task.

  • In the general tab put a single attribute that is an array of string


  • Add a scriptable task to the schema
  • Add a foreach element to the schema after the scriptable task
    • Link the foreach look to the AddNSX workflow you made in the last step
    • Link vmid to param_0


  • Edit the scriptable task and add the following code:

//get list of all VM’s
vms = System.getModule(“”).getAllVMs();

var vmid = new Array();

for each (vm in vms)




  • Add an IN for vmid and an OUT for vmid
  • Run it and your complete you can see the response headers in the logs section

Hope it helps you automate some NSX.

vRO Scriptable tasks

An old friend contacted me today with some vRO questions.  He is struggling with learning vRO like so many administrators before him.  It’s not easy to learn vRO it’s a very different type of programming.  Once you learn the basics of the editor and especially JavaScript in scriptable tasks it becomes really powerful.  So a few tips that I provided to my friend that may help you out when learning vRO:

  • JavaScript is case sensitive – this is hard for PowerShell or Windows users to remember
  • Variables are local to your scriptable task unless you make them an input or output (or both)
  • JavaScript variables don’t have defined types during creation (they are just pointers to memory locations)
  • Errors from JavaScript are not always very helpful (they point you to the incorrect or offending line)
  • You really should validate your input before taking an action


Case Sensitivity

I have rewritten a whole script to find out I missed a case for example a common one would be that is valid is:


Will all fail with a odd error.  You have to watch case on reserved commands.  This is true of API explorer objects VcVirtualMachine is VcVirtualMachine not VCvirtualmachine etc…


Javascript has lots of different variable types including user defined objects.   You can discover the object type using System.log.  Assume that my object / variable is called new.


Will output the type of object into the log window when run.  This is very useful for discovering the object type.  In the vCenter API you might have something like

If you want to understand your object type just use:

And it will tell you the object.  (this is a example and will not work)

Almost everything in vRO is a complex object which can be loosely defined as a combination of key value pairs in an array.   A traditional array have multiple objects referenced like this:

This is a array of strings with a length of 3.   If I called this:

The log would display “magic”

An object is an array with multiple key value pairs for each array element for example

This allows me to store multiple elements that are connected and entries in the object don’t have to be the same type (e.g. firstname and lastname are both strings but I could add a age entry to hold a number).  This provides a huge flexibility… those familiar with powercli this is the same as:

This will display all vm’s with a full list of the elements on the object of vm.

Error Handling

Errors will display the line number.  Use that to determine the cause or source.   I know almost every programmer needs to have the ability to test their assumptions around variables when writing programs use the System.log for this:

System log is readable only by someone in vRO and not exposed to customers (unless they are running it from vRO)

Input validation

First check for null

Then validate your object type using the System.log method above.  There is a way for checking for complex system defined objects like this:

if (vm instanceof VcVirtualMachine)


//Do some action


This can be very useful when working with objects validate before you act.


Hope it helps

vRo scriptable task to return the top level folder for a VM

Have you been nesting your virtual machines deep into folders.  If you want to return only the top level folder you can do it with this simple javascript function.  It can also be turned into a action if you would rather:



Execute it by calling :

folder = return_top_folder(vm);

The vm must be an object of VCVirtualMachine.  Enjoy the scriptable task. You can download it here: topfolder

vRO Scriptable task issue with get all hosts

I was working with some scriptable tasks in vRO around hosts and ran into an issue calling the script.  It would fail when hosts were disconnected.  This brings up a good point that you should use good programming practices including checking for valid input (or null) in everything you do.  In this case I can filter my select into only hosts that are connected like this:


for each (host in hosts)


if (host.runtime.connectionState.value == “connected”)



Hope it saves you some time troubleshooting.


vRO scriptable task to expand a datastore

A quick vRO time saver.  Here is the scriptable task to expand a datastore.  This is not extents it’s an expand.  In other words the lun has expanded and you want the datastore to use newly available space.   In the next article I will show how to create a vRA service to expand the datastore.

You can download it here: datastore_Expand

Let me know if you have any questions.