VCF Extension Network Insight: Deployment

Version: 2026.1.1.1

This page covers installing the Management Pack, the monitoring half of the solution. The VCF Extension Network Insight GUI that builds the NSX policy is deployed separately and is described in Deploying the GUI and Using the GUI.

User Permissions and Connection Requirements

Category	Description
NSX Manager	Reachable over HTTPS/443. A local NSX account with read access to the NSX Policy API (domains, policies, rules, groups, statistics).
Aria Operations for Logs	Reachable over HTTPS on port 9543 (the only port the query API answers on). A local account with permission to browse logs. Required for dropped-traffic detection.
Container registry	HTTPS/443 to https://registry.indevops.com (always) to pre-pull the adapter image.

Installing the addon

1. Pre-pull the adapter image on the cloud proxies belonging to the collector group, using the image name shown on the release page for the matching version.
2. Install the PAK: in VMware Aria Operations go to Data Sources > Integrations > Repository > Add, upload the PAK and tick both Install the PAK file even if it is already installed and Ignore the PAK file signature checking.
3. Configure the adapter account: add an adapter instance and supply the credentials and instance parameters below.

Adapter fields

Credentials: one credential type (NSX + Aria Operations for Logs) with four fields:

Field Name	Definition
NSX user	NSX Manager account.
NSX password	NSX Manager password.
Aria Operations for Logs user	Logs account.
Aria Operations for Logs password	Logs password.

Instance parameters:

Field Name	Default	Definition
NSX Manager address	required	Address or FQDN of the NSX Manager, reachable from the Cloud Proxy on port 443.
Aria Operations for Logs address	none	Address or FQDN of Aria Operations for Logs. Without it the adapter still collects inventory and counters, but cannot detect dropped traffic.
Aria Operations for Logs port	9543	The only port the query API answers on.
NSX domains	empty	Comma separated list of policy domains to collect; empty means every domain.
Accept self-signed certificates	0	1 accepts any certificate presented by NSX and by Aria Operations for Logs.
Log window (minutes)	5	How far back log lines are queried; must cover the collection interval, or drops fall between two cycles.
Log query limit	20000	Maximum lines per query. Hitting it exactly means the answer was truncated.
Learning period (minutes)	0	After installation, tuples are recorded and counted but no new-tuple alert is raised for this many minutes. The default 0 means learning is off and alerts fire from the first collection.
Maximum tuples remembered per rule	500	Cap on the durable tuple set of one rule; the least recently seen are discarded first.
Tuple retention (days)	90	How long an unseen tuple is remembered; must outlive a monthly batch.
Maximum endpoint objects	5000	Cap on DFW Endpoint objects per cycle; above it the quietest addresses fold into their aggregate bucket.
Endpoint retention (days)	30	How long an unseen address is remembered before it stops being reported.
Endpoint visibility (minutes)	30	How long a DFW Endpoint object and its rule relationship stay visible after the address goes quiet; the default removes quiet endpoints within ~30 minutes of the address leaving the log window.
Rule id map refresh (minutes)	360	How often the internal rule id map is rebuilt in full.
Rule id map calls per cycle	500	Budget of per-rule statistics calls used to build the id map incrementally.
VM cache refresh (minutes)	60	How often the vSphere join map is refreshed from the Aria Operations Suite API.
Witness rule pattern	default	Regular expression marking the catch-all (witness) rules at the end of an application policy, combined with a sequence number of at least 900. Leave the default unless your rules are named differently.
Reverse DNS resolution	0	1 enables PTR lookups as the last step of address resolution.