VCF Extension Network Insight: Overview

Version: 2026.1.1.1

This Management Pack monitors the NSX policy that the VCF Extension Network Insight GUI builds for an application. Everything below appears in Aria Operations once a policy has been applied.

Dashboards

NSX DFW Monitoring

The NSX DFW Monitoring dashboard provides the operational view of distributed firewall behaviour:

• NSX Policies List: heatmap of DFW Security Policies colored and sized by the health badge.
• Dropped Objects: resource list of DFW Endpoint objects that have seen dropped traffic.
• Object Relationship: a relationship widget showing the policy, rule and endpoint topology.
• Alert List: active alerts scoped to the NSX Application custom group.

Widgets are linked: selecting a policy drives the Dropped Objects and Object Relationship widgets.

Custom Groups

Custom Group Name	Description
NSX Application	A group that auto-aggregates Security Policies, Firewall Rules and DFW Endpoints into one business application view.

Collected objects

Relationships

A rule parents the endpoints it actually dropped traffic for, not the groups referenced in its definition. Group membership answers "who is this rule written against"; the product answers "who is this rule blocking", a fact observed from log lines rather than configuration.

NSX Manager

Adapter instance root. Carries collection telemetry and the durable state checkpoint.

Data Name	Type	Description
collection|policies	metric	Number of policies collected this cycle.
collection|rules	metric	Number of rules collected this cycle.
collection|groups	metric	Number of groups collected this cycle.
collection|endpoints	metric	Number of endpoints emitted this cycle.
collection|duration	metric	Collection duration in seconds.
collection|nsx_api_calls	metric	Number of NSX API calls made this cycle.
logs|lines	metric	Log lines returned this cycle.
logs|lines_parsed	metric	Log lines successfully parsed.
nsx_version	property	NSX version.
logs_available	property	Whether the Aria Operations for Logs source is available.
logs_host	property	Configured / active log source host.

Security Policy

One NSX security policy (DFW Policy). Parents its rules.

Data Name	Type	Description
drops|tuples	metric	Total traffic tuples this policy has dropped.
drops|tuples_new	metric	Newly seen dropped tuples.
quality|rules_total	metric	Total number of rules in the policy.
quality|rules_drop	metric	Number of rules in the policy in DROP mode.
category	property	Policy category.
application	property	Application the policy belongs to.
managed_by	property	Automation/adapter that manages the policy.

Firewall Rule

One NSX firewall rule (DFW Rule). The primary carrier of traffic and drop metrics.

Data Name	Type	Description
traffic|packets	metric	Cumulative traffic packet count.
traffic|sessions	metric	Cumulative traffic session count.
traffic|hits	metric	Cumulative rule hit count.
traffic|packets_delta	metric	Packets in this cycle.
traffic|bytes_delta	metric	Bytes in this cycle.
traffic|sessions_delta	metric	Sessions in this cycle.
drops|tuples	metric	Dropped flow tuples.
drops|tuples_new	metric	New dropped flow tuples (drives the new-dropped-traffic-on-rule alert).
drops|lines	metric	DFW log lines matched for this rule.
age|minutes_since_last_hit	metric	Minutes since the rule last hit.
action	property	Rule action (ALLOW/DROP).
logged	property	Whether the rule is configured to log.
direction	property	Rule direction (IN/OUT/IN_OUT).
internal_rule_id	property	Number a log line carries to attribute a tuple to this rule.
is_witness	property	Whether the rule is one of the catch-all rules at the end of the policy.
disabled	property	Whether the rule is disabled in NSX.
sequence_number	property	Rule sequence number.
application / managed_by	property	Owning application and managing automation.
last_dropped	property	Last dropped-flow indication.

Security Group

One NSX security group with its effective membership.

Data Name	Type	Description
application	property	Application the group belongs to.
managed_by	property	Managing automation.
membership_criteria	property	Effective membership criteria.

Application

A business rollup built from the application tag on the machines. Does not exist in NSX; it is created by the solution to give one view per application.

Data Name	Type	Description
drops|tuples_total	metric	Total tuples dropped across the application.
drops|tuples_new_24h	metric	New dropped tuples within the last 24 hours ("What Just Broke").
drops|endpoints_affected	metric	Number of endpoints affected by dropped traffic.
quality|rules_total	metric	Total number of rules in the application.
enforcement_state	property	observation, partial or enforced.

DFW Endpoint

One address (or aggregate bucket) seen in dropped or observed traffic.

Data Name	Type	Description
drops|tuples_new	metric	New dropped flow tuples.
ip_address	property	The address observed in traffic.
vm_name / fqdn	property	Resolved machine name / FQDN, where the vSphere join map or reverse DNS allows.
application	property	Application the endpoint is attributed to.
classification	property	Sortable classification of the endpoint.
first_seen / last_seen	property	First / last observed timestamp.
services	property	Protocol/port pairs seen, e.g. tcp/9090, tcp/443.
peers	property	Peer addresses it communicated with.
rule relationship	relation	The rule that dropped traffic to/from this endpoint.

Alerts

Alert	Severity	Threshold
New dropped traffic on policy	Critical	New dropped traffic seen on a Security Policy.
New dropped traffic on rule	Critical	New dropped traffic seen on a Firewall Rule.
License is expiring soon	Warning	expiration_date ≤ 15 and > 0.
License has expired	Critical	expiration_date ≤ 0.

New dropped traffic

The two "New dropped traffic" alerts above are driven by the drops|tuples_new metric on the Firewall Rule and the Security Policy; the adapter does not raise a separate per-tuple event. The optional learning period (Learning period (minutes), default 0 = off) suppresses new-tuple alerts for a configured number of minutes after installation, so an initial baseline does not flood the operator. With the default of 0, alerts fire from the first collection.

Metric groups

The collected metrics are organised into the following groups:

Group	Description
collection	Manager-level collection telemetry group.
logs	Manager-level log processing telemetry group.
drops	Drop metrics group (tuples, new tuples, endpoints affected).
traffic	Traffic counter group (packets, sessions, hits, deltas).
quality	Rule-quality (enforcement readiness) metric group.
age	Age metric group (e.g. minutes_since_last_hit).