Manually Cleaning up License Hub 5.1.2 Details from Endpoints (NSX, SSP, & AVI) Prior to Re-Onboarding

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention
• VMware Avi Load Balancer

Issue/Introduction

When an endpoint retains references to a License Hub instance to which it is no longer connected, it is necessary to clean up the License Hub data from Endpoint.

This situation typically occurs if:

1. The original License Hub is no longer functioning properly or is decommissioned.
2. The endpoint was forcefully offboarded while it was unresponsive.

Failure to perform this cleanup may cause complications when onboarding the endpoint to a new License Hub instance. Additionally, the endpoint may continue attempting to send data to the old / unresponsive License Hub instance.

Environment

License Hub 5.1.2

Cause

The endpoints are configured to send data to the License Hub instance to which they are onboarded. An endpoint cannot be onboarded to a new instance until it is disconnected from its current configuration.

If the previous License Hub is not removed, the endpoints will continue attempting to send data to the decommissioned instance and will be unable to connect to a new License Hub.

Resolution

For NSX Endpoints:

site-offboarding-cleanup-512.sh

(1) Copy the attached bash script "site-offboarding-cleanup-512.sh" to a SSP-I that has access to NSX Manager directly.

(2) After copying site-offboarding-cleanup-512.sh, provide permission:

chmod +x site-offboarding-cleanup-512.sh

(3) Provide NSX manager details and run site-offboarding-cleanup-512.sh 

Example usage:
./site-offboarding-cleanup-512.sh [-h|--host <mgr_host_ip>] [-u|--username <username>] [-p|--password <password>] [-t|--type <atp|license>]
./site-offboarding-cleanup-512.sh -h <nsx-manager-ip> -u admin -p <nsx-manager-password> -t license

 

Response of script:

./site-offboarding-cleanup-512.sh -h x.x.x.x -u admin -p ******* -t license
Verifying connection...
Cleaning up Appliance Info Object...
cluster_id of appliance info object: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
appliance info object deleted successfully
Cleaning up Site Name...
Site name unbound successfully
Cleaning up principal identities...
deleted principal identity successfully: ssp_platform_egress_mutable_LICENSE_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
removing certificate for pi ssp_platform_egress_mutable_LICENSE_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
deleted certificate successfully: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
deleted principal identity successfully: ssp_platform_kafka_LICENSE_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
removing certificate for pi ssp_platform_kafka_LICENSE_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
deleted certificate successfully: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
deleted principal identity successfully: ssp_platform_egress_LICENSE_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
removing certificate for pi ssp_platform_egress_LICENSE_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
deleted certificate successfully: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
deleted principal identity successfully: ssp_platform_ingress_LICENSE_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
removing certificate for pi ssp_platform_ingress_LICENSE_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
deleted certificate successfully: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
NSX Site cleanup complete.

(5) To confirm successful cleanup, the user can validate the GET API response before and after executing the cleanup script. 

GET https://{{nsx-endpoint}}/api/v1/infra/ssp/registration/ -- Should show empty.

 

For Avi Endpoints:

avi_cleanup.sh

1. Login to SSPI CLI with sysadmin user

2. Copy/Download the attached script - avi_cleanup.py

3. Perform dry-run and then execute using following command

python3 avi_side_cleanup.py --ip <AVI_CONTROLLER_IP>
                              --username <AVI_USERNAME>
                              --password <AVI_PASSWORD>
                              --feature <SSP_FEATURE_TYPE>
                              --dry-run (optional) 

 

For SSP Endpoints:

ssp_cleanup.sh

1. Login to SSPI CLI with sysadmin user

2. Copy/Download the attached script - ssp_cleanup.py

3. Perform dry-run and then execute using following command

python3 ssp_cleanup.py --fqdn atpssp.example.com --username admin --password password --form-factor Licensing --dry-run (Optional)