If you prefer an interactive NSX Controller installation, you can use a UI-based VM management tool, such as the vSphere Client connected to vCenter Server.

To support backup and restore, the NSX Controller appliances must have static management IP addresses. Using DHCP to assign management IP addresses is not supported. Changing management IP addresses is not supported. See the NSX-T Administration Guide for backup and restore information.

Your passwords must comply with the password strength restrictions. NSX-T appliances enforce the following complexity rules:

  • At least eight characters

  • At least one lower-case letter

  • At least one upper-case letter

  • At least one digit

  • At least one special character

  • At least five different characters

  • No dictionary words

  • No palindromes

The installation succeeds if the password does not meet the requirements. However, when you log in for the first time, you are prompted to change the password.


The core services on the appliance do not start until a password with sufficient complexity has been set.


The NSX-T component virtual machine installations include VMware Tools. Removal or upgrade of VMware Tools is not supported for NSX-T appliances.


  • Verify that the system requirements are met. See System Requirements.

  • Verify that the required ports are open. See Ports and Protocols.

  • If you do not already have one, create the target VM port group network. It is recommended to place NSX-T appliances on a management VM network.

    If you have multiple management networks, you can add static routes to the other networks from the NSX-T appliance.

  • Plan your IPv4 IP address scheme. In this release of NSX-T, IPv6 is not supported.

  • Verify that you have adequate privileges to deploy an OVF template on the ESXi host.

  • Verify that hostnames do not include underscores. Otherwise, the hostname is set to nsx-controller.

  • A management tool that can deploy OVF templates, such as vCenter Server or the vSphere Client.

    The OVF deployment tool must support configuration options to allow for manual configuration.

  • The Client Integration Plug-in must be installed.


  1. Locate the NSX Controller OVA or OVF file.

    Either copy the download URL or download the OVA file onto your computer.

  2. In the management tool, launch the Deploy OVF template wizard and navigate or link to the .ova file.
  3. Enter a name for the NSX Controller, and select a folder or datacenter.

    The name you type will appear in the inventory.

    The folder you select will be used to apply permissions to the NSX Controller.

  4. Select a datastore to store the NSX Controller virtual appliance files.
  5. If you are using vCenter, select a host or cluster on which to deploy the NSX Controller appliance.

    Normally, you would place the NSX Controller in a cluster that provides network management utilities.

  6. Select the port group or destination network for the NSX Controller.
  7. Specify the NSX Controller passwords and IP settings.
  8. (Optional) For optimal performance, reserve memory for the NSX-T component.

    A memory reservation is a guaranteed lower bound on the amount of physical memory that the host reserves for a virtual machine, even when memory is overcommitted. Set the reservation to a level that ensures the NSX-T component has sufficient memory to run efficiently. See System Requirements.

  9. Open the console of the NSX-T component to track the boot process.
  10. After the NSX-T component boots, log in to the CLI as admin and run the get interface eth0 command to verify that the IP address was applied as expected.
    nsx-component> get interface eth0
    Interface: eth0
      MAC address: 00:50:56:86:7b:1b
      MTU: 1500
      Default gateway:
      Broadcast address:
  11. Verify that your NSX-T component has the required connectivity.

    Make sure that you can perform the following tasks.

    • Ping your NSX-T component from another machine.

    • The NSX-T component can ping its default gateway.

    • The NSX-T component can ping the hypervisor hosts that are in the same network as the NSX-T component using the management interface.

    • The NSX-T component can ping its DNS server and its NTP server.

    • If you enabled SSH, make sure that you can SSH to your NSX-T component.

    If connectivity is not established, make sure the network adapter of the virtual appliance is in the proper network or VLAN.

What to do next

Join the NSX Controller with the management plane. See Join NSX Controllers with the NSX Manager.