VM Not Included in NSX Group Due to Incorrect Tag Criteria

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

After configuring a criteria based group for tagging, the VM is not populated with the tags applied. This could be due to incorrectly applying VM criteria that doesn't align with tag operation.

Example of problematic criteria used for group tagging with 'Operators' scope (Red Square)

• The incorrect spelling 'Operator' does not algin with the 'Operators' scope and will not be included in the group
• The incorrect lower case format 'operator' does not algin with the 'Operators' scope and will not be included in the group

 

Environment

NSX 4.x
NSX 9.x

Cause

Only the 'Operators' scope is utilized with group inventory and any other spelling or format will cause undesired results. 

Resolution

Having a naming scheme for objects in the environment to be used in criteria based groups will help with proper tag alignment and logic structure to apply tags. 

• Case sensitivity for the tag name: When searching for the tag based groups or locating VM's effective members in a group will depend on case sensitivity. Using capitals or lower case will help make a group unique but, will need an exact match when confirm group population. 
• Scope criteria:  This option helps with zoning specific grouped VM's and makes the definition criteria more unique. Appling incorrect scope can cause VM's not to be in the effective members group by not applying definition criteria to the proper range of VM's. Both
• The use of AND/OR statements: Using multiple definition statements for 1 criteria can help make unique group with large environments. 

Additional Information

Administration guide for invenotory tags.
https://techdocs.broadcom.com/us/en/vmware-cis/nsx/vmware-nsx/9-0/administration-guide/inventory/nsx-tags.html