Virtual Machines configured with vCenter Tags are not populating in NSX Groups

Products

• VMware NSX
• VMware vCenter Server

Issue/Introduction

• Multiple NSX Groups do not reflect all the Virtual Machines (VMs) that are supposed to be members of those groups.
• When checking a specific affected VM, it is not reflected as part of its intended NSX group.
• The affected VMs have vCenter tags assigned to them, but no NSX tags are configured on the VM.
• For example, below test VM is configured with vCenter tag: "TestTag", however, it is not reflected in the NSX group, "example" configured with the criteria to report VMs with Tag: "TestTag"

VM Configured with vCenter Tag:

NSX Group Configuration:

Under "View Members", 0 VMs are listed for the above group:

• Some VMs in the environment appear to be working correctly and are reflected as part of the groups.
• And upon checking further on working VMs, these are configured with both vCenter and identically configured NSX tags.

Reconfigured the above test VM with NSX Tag:

The Same VM is now reflected as part of the NSX group:

• vCenter Server to NSX compute manager connectivity is up and running as expected.
• The NSX Manager cluster is stable and healthy.

Environment

VMware NSX
VMware vCenter Server

Cause

• This issue occurs because there is no direct, automated synchronization between vCenter tags and NSX tags.
• The VMs successfully populating in the NSX groups were configured with both vCenter tags and identically scoped/named NSX tags.
• Because NSX tags and vCenter tags operate independently, VMs that are only tagged in vCenter will not be dynamically added to NSX security groups.

vCenter Tags: These are applied and managed exclusively within the vCenter Server database. They are primarily used for vSphere inventory management, sorting, categorization, and reporting. 
NSX Tags:These are applied and managed within the NSX Manager database. NSX tags are explicitly designed for grouping network objects (such as VMs, logical ports, and segments) to dynamically apply security policies, DFW rules, and network services. For an NSX Group to dynamically include a VM based on tagging criteria, the VM must possess an NSX tag.

Resolution

To ensure all affected VMs populate in the required NSX Groups and receive the correct security rules, reconfigure the VMs with the appropriate NSX tags.

• Log in to the NSX Manager UI.
• Navigate to Inventory > Virtual Machines.
• Locate the affected VMs.
• Apply the required NSX tags so they match the criteria defined in your NSX Groups (e.g., configuring the NSX equivalent of the concerned vCenter tags).
• Verify that the VMs now appear in the correct NSX Group members list.

Additional Information

For more information regarding NSX Tags, refer article: NSX Tags

For details on vCenter tags, refer the article: What Are vSphere Tags and How to Use Them