Tech Support Access in NSX for vSphere 6.x

Products

• VMware NSX

Issue/Introduction

This article provides information on the procedure to log into Tech Support Mode in NSX for vSphere 6.x.

Environment

VMware NSX Data Center for vSphere 6.x

Resolution

The NSX Manager contains many tools to help customers in conjunction with Global Support Services to resolve operational issues. The NSX for vSphere 6.x product features a customized command line interface that covers most of the basics that the user interface does and a little bit more.

On occasion, it may become necessary to use a regular unix command line interpreter (shell) to be able to deal with unanticipated configuration issues. In these cases it is required that customers use this shell in conjunction with tech support to avoid inadvertently changing the virtual appliance in such a way that we can no longer support it properly.

The following steps are necessary:

1. First Authentication: from a vSphere console, or from a SSH client, log in to the NSX Manager using your administrator user name and password that you supplied at install, or using the latest credentials if they have changed since installation.
    
2. Second Authentication: from NSX Manager CLI, type en<enter>. Type enable password you provided at installation time. Think of enable mode as a version of "root access".
    
3. From your double authenticated enable mode prompt, enter engineering mode by typing st eng<enter>.
   
   Note: As of NSX for vSphere 6.3.2, you now have to acknowledge the following warning:
   
   Engineering Mode: The authorized NSX Manager system administrator is requesting a shell which is able to perform lower level unix commands/diagnostics and make changes to the appliance. VMware asks that you do so only in conjunction with a support call to prevent breaking your virtual infrastructure. Please enter the shell diagnostics string before proceeding. Type Exit to return to the NSX shell. Type y to continue: y
Password:
    
4. Type the shell diagnostics string: "IAmOnThePhoneWithTechSupport". At this point you are at a bash prompt.
   
   Important: Do not make any changes to the underlying system without the help of VMware Technical Support. All such changes are not supported and as a result, your system may no longer be supportable by GSS.
   
   Note: It is possible to change this debug access string. The net effect is that customer will need to type 3 unique customer strings instead of 2 to gain low level access. Customers who do so must carefully track this additional string for future access, as GSS will not be able to help customer get low level access after such a change. As mentioned, this still must be done only in conjunction with a global support engineer.
   To change this debug access string, use the following command from the low level access prompt:
   
   passwd
   
   When prompted, enter the new string twice. Again, be sure to track the new string in the event GSS needs to aid customer again.
   
   Broadcom recommends to take full backup of the system before performing any changes after logging into the Tech Support Mode.