You can get most information about distributed firewalls on the NSX Manager central CLI.

Using the Show dfw Central CLI Commands

The path to drill down to the desired information is as follows:

  1. Log in to the NSX Manager central CLI using the admin credentials.

  2. Run the following commands:

    1. Run the show cluster allcommand to show all clusters. 
      nsxmgr>show cluster all
No.  Cluster Name                Cluster Id     Datacenter Name     Firewall Status
1    Compute Cluster A           domain-c33     Datacenter Site A   Enabled
2    Management & Edge Cluster   domain-c41     Datacenter Site A   Enabled
    2. Run the show cluster <clusterID> command to show hosts in a specific cluster. 
      nsxmgr> show cluster domain-c33
Datacenter: Datacenter Site A
Cluster: Compute Cluster A
No.  Host Name            Host Id         Installation Status
1    esx-02a.corp.local   host-32          Enabled
2    esx-01a.corp.local   host-28          Enabled
    3. Run the show host <hostID> to show all VMs on a host. 
      nsxmgr> show host host-28
Datacenter: Datacenter Site A
Cluster: Compute Cluster A
Host: esx-01a.corp.local
No.  VM Name    VM Id     Power Status
1    web-02a    vm-219    on
2    web-01a    vm-216    on
3    win8-01a   vm-206    off
4    app-02a    vm-264    on
    4. Run the show vm <vmID> command to show information for a VM, which includes filter names and vNIC IDs: 
      nsxmgr> show vm vm-264
Datacenter: Datacenter Site A
Cluster: Compute Cluster A
Host: esx-01a.corp.local
Host-ID: host-28
VM: app-02a
Virtual Nics List:
1.
Vnic Name      app-02a - Network adapter 1
Vnic Id        502ef2fa-62cf-d178-cb1b-c825fb300c84.000
Filters        nic-79396-eth0-vmware-sfw.2
    5. Note the vNIC ID and run further commands like show dfw vnic <vnicID> and show dfw host <hostID> filter <filter ID> rules: 
      nsxmgr> show dfw vnic 502ef2fa-62cf-d178-cb1b-c825fb300c84.000
Vnic Name      app-02a - Network adapter 1
Vnic Id        502ef2fa-62cf-d178-cb1b-c825fb300c84.000
Mac Address    00:50:56:ae:6c:6b
Port Group Id  dvportgroup-385
Filters        nic-79396-eth0-vmware-sfw.2

nsxmgr> show dfw host host-28 filter nic-79396-eth0-vmware-sfw.2 rules
ruleset domain-c33 {
  # Filter rules
  rule 1012 at 1 inout protocol any from addrset ip-securitygroup-10 to addrset ip-securitygroup-10 drop with log;
  rule 1013 at 2 inout protocol any from addrset src1013 to addrset src1013 drop;
  rule 1011 at 3 inout protocol tcp from any to addrset dst1011 port 443 accept;
  rule 1011 at 4 inout protocol icmp icmptype 8 from any to addrset dst1011 accept;
  rule 1010 at 5 inout protocol tcp from addrset ip-securitygroup-10 to addrset ip-securitygroup-11 port 8443 accept;
  rule 1010 at 6 inout protocol icmp icmptype 8 from addrset ip-securitygroup-10 to addrset ip-securitygroup-11 accept;
  rule 1009 at 7 inout protocol tcp from addrset ip-securitygroup-11 to addrset ip-securitygroup-12 port 3306 accept;
  rule 1009 at 8 inout protocol icmp icmptype 8 from addrset ip-securitygroup-11 to addrset ip-securitygroup-12 accept;
  rule 1003 at 9 inout protocol ipv6-icmp icmptype 136 from any to any accept;
  rule 1003 at 10 inout protocol ipv6-icmp icmptype 135 from any to any accept;
  rule 1002 at 11 inout protocol udp from any to any port 67 accept;
  rule 1002 at 12 inout protocol udp from any to any port 68 accept;
  rule 1001 at 13 inout protocol any from any to any accept;
}

ruleset domain-c33_L2 {
  # Filter rules
  rule 1004 at 1 inout ethertype any from any to any accept;
}

Using the export host-tech-support Central CLI command

The export host-tech-support command allows you to export an ESXi host support bundle to a specified server. In addition, this command collects NSX related outputs and files (not limited to the following) on specified hosts such as:

  • VMKernel and vsfwd log files
  • List of filters
  • List of DFW rules
  • List of containers
  • SpoofGuard details
  • Host related information
  • IP discovery related information
  • RMQ command outputs
  • Security group, services profile, and instance details
  • ESX CLI related outputs

This command also removes any temporary files on the NSX Manager.

To collect NSX related outputs and files:

  1. Log in to the NSX Manager central CLI using the admin credentials.

  2. Run the following commands:

    1. show cluster all- To find the required host ID.
    2. export host-tech-support host-id scp uid@ip:/path - To generate the NSX technical support bundle and to copy it to a specified server.

For more information, refer to: