NSX Segment Profiles: Editing or modifying system default profiles
search cancel

NSX Segment Profiles: Editing or modifying system default profiles

book

Article ID: 441325

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

In VMware NSX, administrators may observe that default segment profiles are applied to multiple segments. When configuration modifications are required, the system prevents any direct editing or modification of the default segment profiles.

Environment

VMware NSX

Cause

By Design: System-defined profiles are read-only to ensure configuration consistency.

Resolution

To apply modifications, a new Custom Segment Profile must be created and bound to the required segment.
 
Create the new Custom Segment Profile (e.g., IP Discovery Profile) in the NSX Manager UI or via API.
 
Creating a new Segment Profile in the NSX UI
 
  1. Authenticate to the NSX Manager user interface using credentials with Network Administrator or Enterprise Administrator privileges.
  2. Navigate to Networking > Segments > Segment Profiles.
  3. Select the appropriate configuration tab corresponding to the required profile class (e.g., QoS, MAC Discovery, IP Discovery, SpoofGuard, Segment Security, Multicast).
  4. Click Add Profile (or the specific Add  button).
  5. Specify a distinct Name and an optional Description for the profile to identify its operational scope.
  6. Configure the profile-specific operational parameters (e.g., ingress/egress rate limits for QoS, MAC limit thresholds for MAC Discovery, or ARP/ND bindings for SpoofGuard).
  7. Click Save to commit the configuration to the NSX management plane database (CorfuDB).

 

To apply the new Custom Segment Profile in NSX UI
 
  1. Authenticate to the NSX Manager user interface using credentials with Network Administrator or Enterprise Administrator privileges.
  2. Navigate to Networking > Segments.
  3. Locate the target segment requiring the profile update.
  4. Click the vertical ellipsis (three dots) next to the segment name and select Edit.
  5. Scroll to and expand the Segment Profiles section in the configuration pane.
  6. Locate the specific profile category to be updated (e.g., QoS, MAC Discovery, IP Discovery, SpoofGuard, Segment Security).
  7. Select the newly created segment profile from the corresponding drop-down menu.
  8. Click Save to commit the configuration to the management plane database.
  9. Click Close Editing to exit the segment configuration interface.
 
 
For bulk changes, API calls may be more suitable
 
Obtain the target segment identifier (<segment-name-or-UUID>) and the new profile identifier (<new-ip-discovery-profile-id>).
 
To retrieve the list of the segments, the following API call can be run
curl -k -u <username>:'<password>' -H 'Content-Type: application/json' -X GET https://<nsx-manager-ip>/policy/api/v1/infra/segments
 
Execute the following API call against the NSX Manager to update the IP Discovery segment profile binding:
curl -k -u <username>:'<password>' -H 'Content-Type: application/json' -X PATCH 'https://<nsx-manager-ip>/policy/api/v1/infra/segments/<segment-name-or-UUID>/segment-discovery-profile-binding-maps/default' -d '{"ip_discovery_profile_path":"/infra/ip-discovery-profiles/<new-ip-discovery-profile-id>"}'
 
 
 
The following API payloads provide examples for modifying MAC Discovery, Security, SpoofGuard, and QoS profile bindings on a given segment.
 
1. MAC Discovery Profile Binding
MAC Discovery uses the same binding map as IP Discovery. To modify the MAC Discovery profile independently, patch the segment-discovery-profile-binding-maps endpoint.
 
curl -k -u <username>:'<password>' -H 'Content-Type: application/json' -X PATCH 'https://<nsx-manager-ip>/policy/api/v1/infra/segments/<segment-name-or-UUID>/segment-discovery-profile-binding-maps/default' -d '{
  "mac_discovery_profile_path": "/infra/mac-discovery-profiles/<new-mac-discovery-profile-id>"
}'
 
2. Segment Security & SpoofGuard Profile Bindings
Both Segment Security and SpoofGuard profiles are updated via the segment-security-profile-binding-maps endpoint Broadcom Developer Portal. They can be patched simultaneously or individually.
 
curl -k -u <username>:'<password>' -H 'Content-Type: application/json' -X PATCH 'https://<nsx-manager-ip>/policy/api/v1/infra/segments/<segment-name-or-UUID>/segment-security-profile-binding-maps/default' -d '{
  "segment_security_profile_path": "/infra/segment-security-profiles/<new-security-profile-id>",
  "spoofguard_profile_path": "/infra/spoofguard-profiles/<new-spoofguard-profile-id>"
}'
 
3. QoS Profile Binding
Quality of Service (QoS) profiles are updated via the segment-qos-profile-binding-maps endpoint Broadcom Developer Portal.
 
curl -k -u <username>:'<password>' -H 'Content-Type: application/json' -X PATCH 'https://<nsx-manager-ip>/policy/api/v1/infra/segments/<segment-name-or-UUID>/segment-qos-profile-binding-maps/default' -d '{
  "qos_profile_path": "/infra/qos-profiles/<new-qos-profile-id>"
 
}'

Additional Information

For further details on NSX Policy API and segment profile bindings, refer to the VMware NSX API Reference.

Powered by Wolken Software