Upload the upgrade bundle to proceed with upgrading NSX agent and PCG.


  • Outbound port 8080 must be open on workload VMs that need to be upgraded.

  • The PCGs must be powered on when the upgrade of NSX agents installed on workload VMs or of PCGs is in progress.


  1. Log in to CSM with the Enterprise Administrator role.
  2. Click Utilities > Upgrade
  3. Click Upload Upgrade Bundle. Pick a location for the upgrade bundle. You can provide a remote location using a URL.
  4. After the upgrade bundle finishes uploading in CSM, click Prepare for Upgrade to start the process of upgrading the Upgrade Coordinator.

    Note: The upgrade bundle must be a valid file in the .mub format. Do not use .nub or other files. See Upgrade the Upgrade Coordinator for details.

    When the Upgrade Coordinator upgrade process finishes, the Begin Upgrade button becomes active.

  5. Click Begin Upgrade. The Upgrade CSM wizard starts.

    Note: Although the name of the wizard is Upgrade CSM, you can only upgrade NSX Agents and PCG from this wizard.

  6. In the Upgrade CSM > Overview screen, you can see an overview of the default upgrade plan. Based on the upgrade bundle you have uploaded, you can see which versions of NSX agent and PCG are compatible for an upgrade via the upgrade bundle uploaded.
  7. Click Next. The CSM > Select NSX Agents screen appears. A list of all compatible NSX agents that can be upgraded to the target version in all your VNets, are displayed. You can filter the agents based on which private cloud network they are in or which OS they are deployed on.
  8. Select the NSX Agents you want to upgrade and move them to the Selected window. Click Next. CSM downloads the upgrade bits to the PCG on which the NSX agents reside. If you have an HA pair of PCG, CSM downloads the upgrade bits to each PCG and starts upgrading the selected NSX agents.

    Note: 10 agents are upgraded simultaneously. If you have more than 10 agents, they are queued for upgrading. PCG maintains a flag on VMs that are unreachable and attempts to upgrade them when they can be reached. For example, a powered off workload VM is upgraded when powered on again and able to communicate with PCG. Similarly for a workload VM on which port 8080 is blocked at first but when port 8080 is opened and PCG can access it, the upgrade for that workload VM proceeds.

    Until all the agents are upgraded, you cannot upgrade PCG. If some agents are not able to be upgraded, you can skip upgrading them in order to proceed with upgrading PCG. See (Not recommended) Skip Upgrading NSX Agent(s) for details on this option.

  9. Click Next to proceed with upgrading the PCG. With an HA pair of PCGs, there are two failovers during the upgrade process and when the upgrade finishes, the preferred PCG is reinstated as the active gateway.
  10. Click Finish.

How long does the upgrade process take?


CSM and NSX-T Data Center components are upgraded separately, and that time is not included here. This is an estimation to help you plan your upgrade cycles.

  • NSX Agent installed on a workload VM: It takes from 3 to 5 minutes for 1 NSX agent to upgrade, not accounting for the time it takes to upload the upgrade bundle from CSM to the public cloud. 10 agents are upgraded simultaneously. The time to upgrade agents also varies for different operating systems and the VM size.

  • One or an HA pair of PCGs: PCGs in different VPCs or VNets are upgraded in parallel, but PCGs in HA pair upgrade serially. It takes about 20 minutes for one PCG to upgrade.

  • One VPC or VNet: For a VPC or VNet with up to 10 VMs and an HA pair of PCGs, it can take up to 45 minutes to upgrade. This time may vary depending on the OS on the VMs and their size.