You must prepare your environment for network virtualization by installing network infrastructure components on a per-cluster level for each vCenter server. This deploys the required software on all hosts in the cluster and renames virtual wires to NSX logical switches. During this process, each host in the cluster receives a software update and is then rebooted.

If you have virtual wires in your environment, once you have upgraded to NSX Manager you must update your host clusters.

It is recommended that you update host clusters in a datacenter maintenance window.

If DRS is enabled, monitor the progress of host evacuation, hosts entering maintenance mode, and host reboot. If DRS is disabled or in manual mode, host evacuations and reboots must be done manually. During host preparation, warnings may occur and can be seen by clicking the warning icon, click Resolve where required.

While the upgrade is in progress, do not deploy, upgrade, or uninstall any service or component.


VTEPs that were created in vCloud Networking and Security use DHCP or manually assigned IP addresses, not IP pools.


  • Verify that vShield Manager has been upgraded to NSX Manager.

  • Verify that the VXLAN Column in Host Preparation tab displays Enabled.

  • Verify that the fully qualified domain names (FQDNs) of all of your hosts can be resolved.

  • If DRS is disabled, power off or vMotion the VMs manually before beginning the upgrade.

  • If DRS is enabled, the running VMs are moved automatically during the host cluster upgrade. Before beginning the upgrade, make sure that DRS can work in your environment.

    • Verify that DRS is enabled on the host clusters.

    • Verify that vMotion functions correctly.

    • Verify the host connection state with vCenter.

    • Verify that you have a minimum three ESXi hosts in each host cluster. During an NSX upgrade, a host cluster with only one or two hosts is more likely to have issues with DRS admission control. For a successful NSX upgrade, VMware recommends that each host cluster have at least three hosts. If a cluster contains fewer than three hosts, the recommendation is to manually evacuate the hosts.


  1. Log in to the vSphere Web Client.
  2. Click Networking & Security and then click Installation.
  3. Click the Host Preparation tab.

    All clusters in your infrastructure are displayed.

    If you had Virtual Wires in your 5.5 environment, the Installation Status column displays legacy, Update, and Uninstall.

    Figure 1. Installation Status displays Update when you have Virtual Wires in your 5.5 environment

    If you did not have Virtual Wires in your 5.5 environment, the Installation Status column displays Install.

    Figure 2. Installation Status displays Install when you do not have Virtual Wires in your 5.5 environment

  4. For each cluster, click Update or Install in the Installation Status column.

    Each host in the cluster receives the new logical switch software.

    The host upgrade initiates a host scan. The old VIBs are removed (though they are not completely deleted until after the reboot). New VIBs are installed on the altboot partition. To view the new VIBs on a host that has not yet rebooted, you can run the esxcli software vib list --rebooting-image | grep esx command.

  5. Monitor the installation until the Installation Status column displays a green check mark.

    If the cluster has DRS enabled, DRS attempts to reboot the hosts in a controlled fashion that allows the VMs to continue running. vMotion moves the running VMs to other hosts in the cluster and places the host into maintenance mode.

    If hosts require manual intervention to enter maintenance mode (for example, due to HA requirements or DRS rules), the upgrade process stops and the cluster Installation Status displays Not Ready. Click errors to display the errors.

    After manually evacuating the hosts, select the cluster and click the Resolve action. The Resolve action attempts to complete the upgrade and reboot all hosts in the cluster. If the host reboot fails for any reason, the Resolve action halts. Check the hosts in the Hosts and Clusters view, make sure the hosts are powered on, connected, and contain no running VMs. Then retry the Resolve action.


All virtual wires from your 5.5 infrastructure are renamed to NSX logical switches, and the VXLAN column for the cluster says Enabled.

Ensure that the VXLAN Column in the Host Preparation tab displays Enabled.

When the cluster is updated, the Installation Status column displays the software version that you have updated to.

To confirm the host update, log into one of the hosts in the cluster and run the esxcli software vib list | grep esx command. Make sure that the following VIBs have been updated to the expected version.

  • esx-vsip

  • esx-vxlan


In NSX 6.2, the esx-dvfilter-switch-security VIB is included within the esx-vxlan VIB.

If a host fails to upgrade, perform the following troubleshooting steps:

  • Check the ESX Agent Manager on vCenter, and look for alerts and errors.

  • Log in to the host, check the /var/log/esxupdate.log log file, and look for recent alerts and errors.

  • Ensure that DNS and NTP are configured on the host.

What to do next

Change VXLAN Port