To help ensure a successful upgrade to NSX, be sure to check the release notes for upgrade issues, make sure that you are using the correct upgrade sequence, and make sure that the infrastructure is properly prepared for the upgrade. The following guidelines can be used as a pre-upgrade checklist.


Downgrades are not supported:

  • Always capture a backup of NSX Manager before proceeding with an upgrade.

  • Once NSX Manager has been upgraded successfully, NSX cannot be downgraded.

VMware recommends doing upgrade work in a maintenance window as defined by your company.

The following guidelines can be used as a pre-upgrade checklist.

  1. Verify that vCloud Networking and Security is version 5.5. If not, see the vShield Installation and Upgrade Guide version 5.5 for upgrade instructions.

  2. Verify that all required ports are open. See Ports and Protocols Required by NSX.

  3. Verify that you can retrieve uplink port name information for vSphere Distributed Switches. See

  4. If any vShield Endpoint partner services are deployed, verify compatibility before upgrading:

    • In most circumstances, vCloud Networking and Security can be upgraded to NSX without impacting partner solutions. However, if your partner solution is not compatible with the version of NSX to which you are upgrading, you will need to upgrade the partner solution to a compatible version before upgrading to NSX.

    • consult the VMware Compatibility Guide for Networking and Security. See

    • consult the partner documentation for compatibility and upgrade details.

  5. If you have Data Security in your environment, uninstall it before upgrading vShield Manager. See Uninstall vShield Data Security.

  6. If you are using Cisco Nexus 1000V as an external switch provider, you must migrate those networks to vSphere Distributed Switch before upgrading to NSX. Once NSX is installed, you can migrate the vSphere Distributed Switches to logical switches.

  7. Verify that you have a current backup of the vShield Manager, vCenter and other vCloud Networking and Security components. See vCloud Networking and Security Backup and Restore.

  8. Create a Tech Support Bundle.

  9. Ensure that forward and reverse domain name resolution is working, using the nslookup command.

  10. If VUM is in use in the environment, ensure that the bypassVumEnabled flag is set to true in vCenter. This setting configures the EAM to install the VIBs directly to the ESXi hosts even when the VUM is installed and/or not available. See

  11. Download and stage the upgrade bundle, validate with md5sum. See Download the vShield Manager to NSX Upgrade Bundle and Check the MD5.

  12. As a best practice, quiesce all operations in the environment until all sections of the upgrade are complete.

  13. Do not power down or delete any vCloud Networking and Security components or appliances before instructed to do so.