Manually Cleaning up License Hub 2.0 Details from Endpoints (NSX, SSP & AVI) for Permanent Offboarding

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention
• VMware Avi Load Balancer

Issue/Introduction

When an endpoint retains references to a License Hub instance to which it is no longer connected, it is necessary to clean up the License Hub data from Endpoint.

This situation typically occurs if:

1. The original License Hub is no longer functioning properly or is decommissioned.
2. The endpoint was forcefully offboarded while it was unresponsive.

Failure to perform this cleanup may cause the endpoint may continue attempting to send data to the old / unresponsive License Hub instance.

If you are onboarding the endpoint to License Hub again, the Force Onboarding option is available to use to perform these steps.

Environment

License Hub 2.0

Cause

The endpoints are configured to send data to the License Hub instance to which they are onboarded.

If the previous License Hub is not removed, the endpoints will continue attempting to send data to the decommissioned instance.

Resolution

For NSX Endpoints:

site-offboarding-cleanup.sh

(1) Execute the attached script from the SSP-I or License Hub Appliance or any linux system that has access to NSX Manager.

(2) Copy the attached bash script "site-offboarding-cleanup.sh". Note - The NSX Manager must be reachable from SSPI or the License Hub Appliance.

(3) After copying site-offboarding-cleanup.sh, provide permission:

chmod +x site-offboarding-cleanup.sh

(4) Execute the script, provide NSX manager details:

Example usage:

./site-offboarding-cleanup.sh [-h|--host <mgr_host_ip>] [-t|–type <atp | license>] [-u|--username <username>] [-p|--password <password>] -t license

./site-offboarding-cleanup.sh -h nsx_manager_ip -t license -u admin -p nsx_manager_admin_password

(5) After successful cleanup, we should see something like this:

./site-offboarding-cleanup.sh -h x.x.x.x -t license -u admin -p *******

Expected Response:

Verifying connection...

Cleaning up Appliance Info Object...

cluster_id of appliance info object: d449f8f1-ff47-4cd1-9437-64892a25d2d0

appliance info object deleted successfully

Cleaning up Site Name...

Site name unbound successfully

Cleaning up principal identities...

deleted principal identity successfully: ssp_platform_egress_LICENSE_d449f8f1-ff47-4cd1-9437-64892a25d2d0

removing certificate for pi ssp_platform_egress_LICENSE_d449f8f1-ff47-4cd1-9437-64892a25d2d0

deleted certificate successfully: 1c3cb982-0599-4e5f-9ce7-30c081d7c40d

deleted principal identity successfully: ssp_platform_egress_mutable_LICENSE_d449f8f1-ff47-4cd1-9437-64892a25d2d0

removing certificate for pi ssp_platform_egress_mutable_LICENSE_d449f8f1-ff47-4cd1-9437-64892a25d2d0

deleted certificate successfully: b0028d36-4e9e-436d-b9ed-b23dec858251

deleted principal identity successfully: ssp_platform_kafka_LICENSE_d449f8f1-ff47-4cd1-9437-64892a25d2d0

removing certificate for pi ssp_platform_kafka_LICENSE_d449f8f1-ff47-4cd1-9437-64892a25d2d0

deleted certificate successfully: 9bf05328-603e-4ebd-933c-972510a08b4f

deleted principal identity successfully: ssp_platform_ingress_LICENSE_d449f8f1-ff47-4cd1-9437-64892a25d2d0

removing certificate for pi ssp_platform_ingress_LICENSE_d449f8f1-ff47-4cd1-9437-64892a25d2d0

deleted certificate successfully: e7d8641b-5890-4568-91a5-21bfde46459b

NSX Site cleanup complete.

To confirm successful cleanup, the user can validate the GET API response before and after executing the cleanup script. 

GET https://{{nsx-endpoint}}/api/v1/infra/ssp/registration/

For Avi Endpoints:

avi_cleanup.py

1. Login to SSPI CLI with sysadmin user

2. Copy/Download the attached script - avi_cleanup.py

3. Perform dry-run and then execute using following command:

python3 avi_side_cleanup.py --ip <AVI_CONTROLLER_IP>
                              --username <AVI_USERNAME>
                              --password <AVI_PASSWORD>
                              --feature <SSP_FEATURE_TYPE>
                              --dry-run (optional) 

For SSP Endpoints:

ssp_cleanup.sh

1. Login to SSPI CLI with sysadmin user

2. Copy/Download the attached script - ssp_cleanup.sh

3. Perform dry-run and then execute using following example command:(replace the atpssp.example.com with the SSP Ingress FQDN>

./ssp_cleanup.sh --fqdn atpssp.example.com --username admin --password 'password' --form-factor Licensing --dry-run (Optional)