Configure NSX-T exclusion list

Home > VMWare platform > VMWare NSX > Configure NSX-T exclusion list

Sometimes it is desired to exclude a few VMs such as NSX controller cluster / NSX manager cluster, vCenter, AD etc. from NSX so that even if we make a mistake in writing an NSX distributed firewall policy, we can at least login into vCenter / NSX manager etc. and revert the changes.

To configure a group (list) of VMs that should be excluded from NSX policies use:

1. Login into NSX Manager.
2. Go to Security -> Distribution firewall.
3. Go to actions -> Exclusion list.
4. Create required group of objects (VMs) that should be excluded.
5. (Optionally) Add a test VM to this exclusion group. Try to block access to this test VM via distributed firewall North/South or East/West policies. Validate that NSX is not blocking any communication with this test VM.

   We can remove this test VM from exclusion list and validate that NSX is blocking the connections as per configured policy.

Refer:

• https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/administration/GUID-12617811-D760-48EF-A58E-8CB4AA227B21.html

Home > VMWare platform > VMWare NSX > Configure NSX-T exclusion list