Offboarding a Site During Force Deletion of SSP

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• SSP

Issue/Introduction

When choosing to Force Delete an SSP Instance, if there is a site onboarded to that instance, there is a need to clean up the NSX Manager so it no longer references the SSP Instance being force deleted. If this cleanup is not done, then there may be complications onboarding the site to a new SSP Instance in the future. Additionally, there is a chance the site will continue to try to send data to this SSP Instance, which is no longer deployed.

Environment

SSP 5.0.0

Cause

The NSX Manager is configured to send data to the SSP Instance it is onboarded to and it cannot be onboarded to a new SSP Instance until it is no longer configured to be connected to the current SSP Instance. Thus, if SSP is removed, the NSX Manager will continue to try to send data to a SSP that is no longer deployed and will not be able to be onboarded to a new SSP Instance.

 

Resolution

(1) Access SSPI via root account

(2) Copy the attached bash script  "site-offboarding-cleanup-nsx.sh" to SSPI and run it. 

Example usage:

./site-offboarding-cleanup-nsx.sh [-h|--host <mgr_host_ip>] [-u|--username <username>] [-p|--password <password>]

site-offboarding-cleanup-nsx.sh

 

(3) After copying site-offboarding-cleanup-nsx.sh to SSPI, provide permission:

chmod 777 site-offboarding-cleanup-nsx.sh

 

(4) Provide NSX manager details, for example:

./site-offboarding-cleanup-nsx.sh -h nsx_manager_ip -u admin -p nsx_manager_admin_password

 

(5) After successful cleanup, we should see something like this:

./site-offboarding-cleanup-nsx.sh -h x.x.x.x -u admin -p *******

 

Verifying connection...
Cleaning up Appliance Info Object...
cluster_id of appliance info object: 96a6ade0-65cb-4004-843c-6f7c24e6edd2
Cleaning up Site Name...
Site name unbound successfully
Cleaning up principal identities...
deleted principal identity successfully
removing certificate for pi napp_platform_egress_mutable
deleted certificate successfully
deleted principal identity successfully
removing certificate for pi napp_platform_kafka
deleted certificate successfully
deleted principal identity successfully
removing certificate for pi napp_platform_egress
deleted certificate successfully
deleted principal identity successfully
removing certificate for pi napp_platform_ingress
deleted certificate successfully
Cleaning up UI Plugin...
UI Plugin successfully deleted.
NSX Site cleanup complete.

Additional Information

In bash, the ! character is used for history expansion, which lets you recall previous commands (like !ls, !23, etc). So you run:

./site-offboarding-cleanup-nsx.sh -p 'P@ssw0rd!'

note : the ! is interpreted by the shell as a history command, not as part of the string. This causes the command to break or behave unexpectedly.