Migrating TAGs up to a Global Manager group from a Local Manager for a Federation deployment

Products

• VMware NSX
• VMware vDefend Firewall

Issue/Introduction

Migrating TAGs from a Local Manager (LM) up to the Global Manager (GM) is possible but, it doesn't auto populate in the TAGs input nor the TAG-Scope input for member criteria creating a group. 

Environment

Federated Environment with Global Managers
NSX-T 4.x

Cause

This affects NSX Federation deployments because of UI discrepancy.   

Resolution

A workaround can be used to utilize LM Tags to GM groups.  

First, create the Tags in the Local Manager (LM) inventory, in this example you can see Tag LMTAGTEST | LMTAGTEST2 with corresponding Scope LM_TAG_TEST |  LM_TAG_TEST2, and assign 1 or more VM's. Adding the scope option not mandatory 

Second, switch to the Global Manager (GM) inventory and create a group with criteria. You can add the Tag name or the Tag scope. 
You will have to type out the TAG name/scope exactly how its labeled in the LM, and click the Add items dropdown when it matches the LM Tag. (This pic below is TAG name) 

AND/OR (This pic below is scope)

Result Shows

After saving check Effective Members. This was applied to the LM SiteA with VM UPSA1 from Tag LMTAGTEST and Scope LM_TAG_TEST.


You now can apply these groups at the GM level and utilizing in DFW. 

Additional Information

LM = Local Manager
GM = Global Manager