VCF Extension Network Insight: Deployment
Version: 2026.1.1.0
This page covers installing the Management Pack, the monitoring half of the solution. The VCF Extension Network Insight GUI that builds the NSX policy is deployed separately and is described in Deploying the GUI and Using the GUI.
User Permissions and Connection Requirements
| Category | Description |
|---|---|
| NSX Manager | Reachable over HTTPS/443. An account with read access to the NSX Policy API (domains, policies, rules, groups, statistics). |
| Aria Operations for Logs | Reachable over HTTPS on port 9543 (the only port the query API answers on). Required for dropped-traffic detection. |
| Container registry | HTTPS/443 to https://registry.indevops.com (always) to pre-pull the adapter image. |
Installing the addon
- Pre-pull the adapter image on the cloud proxies belonging to the collector group, using the image name shown on the release page for the matching version.
- Install the PAK: in VMware Aria Operations go to
Data Sources > Integrations > Repository > Add, upload the PAK and tick both Install the PAK file even if it is already installed and Ignore the PAK file signature checking. - Configure the adapter account: add an adapter instance and supply the credentials and instance parameters below.
Adapter fields
Credentials: one credential type (NSX + Aria Operations for Logs) with four fields:
| Field Name | Definition |
|---|---|
| NSX user | NSX Manager account. |
| NSX password | NSX Manager password. |
| Aria Operations for Logs user | Logs account. |
| Aria Operations for Logs password | Logs password. |
Instance parameters:
| Field Name | Default | Definition |
|---|---|---|
| NSX Manager address | required | Address or FQDN of the NSX Manager, reachable from the Cloud Proxy on port 443. |
| Aria Operations for Logs address | none | Address or FQDN of Aria Operations for Logs. Without it the adapter still collects inventory and counters, but cannot detect dropped traffic. |
| Aria Operations for Logs port | 9543 | The only port the query API answers on. |
| NSX domains | empty | Comma separated list of policy domains to collect; empty means every domain. |
| Accept self-signed certificates | 0 | 1 accepts any certificate presented by NSX and by Aria Operations for Logs. |
| Log window (minutes) | 5 | How far back log lines are queried; must cover the collection interval, or drops fall between two cycles. |
| Log query limit | 20000 | Maximum lines per query. Hitting it exactly means the answer was truncated. |
| Learning period (hours) | 24 | After installation, tuples are recorded and counted but no new-tuple event is raised. |
| Maximum tuples remembered per rule | 500 | Cap on the durable tuple set of one rule; the least recently seen are discarded first. |
| Tuple retention (days) | 90 | How long an unseen tuple is remembered; must outlive a monthly batch. |
| Maximum endpoint objects | 5000 | Cap on DFW Endpoint objects per cycle; above it the quietest addresses fold into their aggregate bucket. |
| Endpoint retention (days) | 30 | How long an unseen address is remembered before it stops being reported. |
| Endpoint visibility (days) | 5 | How long a DFW Endpoint object and its rule relationship stay visible after the address goes quiet. |
| Rule id map refresh (minutes) | 360 | How often the internal rule id map is rebuilt in full. |
| Rule id map calls per cycle | 500 | Budget of per-rule statistics calls used to build the id map incrementally. |
| VM cache refresh (minutes) | 60 | How often the vSphere join map is refreshed from the Aria Operations Suite API. |
| Catch-all rule pattern | default | Marks the catch-all rules placed at the end of an application policy. Leave the default unless your rules are named differently. |
| Reverse DNS resolution | 0 | 1 enables PTR lookups as the last step of address resolution. |