You can configure an NSGroup to contain a combination of IP sets, MAC sets, logical ports, logical switches, and other NSGroups, . You can specify NSGroups as sources and destinations, as well as in the Applied To field, in firewall rules.

About this task

An NSGroup has the following characteristics:

  • You can specify direct members, which can be IP sets, MAC sets, logical switches, logical ports, and NSGroups.

  • You can specify up to five membership criteria for logical switches and logical ports. For each criterion you specify a tag and optionally a scope.

  • An NSGroup has direct members and effective members. Effective members include members that you specify using membership criteria, as well as all the direct and effective members that belong to this NSGroup's members. For example, assuming NSGroup-1 has direct member LogicalSwitch-1. You add NSGroup-2 and specify NSGroup-1 and LogicalSwitch-2 as members. Now NSGroup-2 has direct members NSGroup-1 and LogicalSwitch-2, as well as an effective member, LogicalSwitch-1. Next you add NSGroup-3 and specify NSGroup-2 as a member. NSGroup-3 now has direct member NSGroup-2 and effective members LogicalSwitch-1 and LogicalSwitch-2.

  • An NSGroup can have a maximum of 500 direct members.

  • The recommended limit for the number of effective members in an NSGroup is 5000. Exceeding this limit does not affect any functionality but might have a negative impact on performance. On the NSX Manager, when the number of effective members for an NSGroup exceeds 80% of 5000, the warning message NSGroup xyz is about to exceed the maximum member limit. Total number in NSGroup is ... appears in the log file, and when the number exceeds 5000, the warning message NSGroup xyz has reached the maximum numbers limit. Total number in NSGroup = ... appears. On the NSX Controller, when the number of translated VIFs/IPs/MACs in an NSGroup exceeds 5000, the warning message Container xyz has reached the maximum IP/MAC/VIF translations limit. Current translations count in Container - IPs:..., MACs:..., VIFs:... appears in the log file. The NSX Manager and NSX Controller check the NSGroups regarding the limit twice a day, at 7 AM and 7 PM.

For all the objects that you can add to an NSGroup as members, that is, logical switches, logical ports, IP sets, MAC sets, and NSGroups, you can navigate to the screen for any of the objects and select Related > NSGroups to see all the NSGroups that directly or indirectly has this object as a member. For example, in the example above, after you navigate to the screen for LogicalSwitch-1, selecting Related > NSGroups shows NSGroup-1, NSGroup-2, and NSGroup-3 because all three have LogicalSwitch-1 as a member, either directly or indirectly.


  1. From your browser, log in to an NSX Manager at https://nsx-manager-ip-address.
  2. Select Inventory > Groups from the navigation panel.
  3. Select NSGroups at the top of the main panel.
  4. Click Add.
  5. Enter a name for the NSGroup.
  6. (Optional) Enter a description.
  7. (Optional) Click Membership Criteria to specify up to five criteria.

    A criterion can apply to logical switches or logical ports.

    A criterion can specify a tag value, a scope value, or both.

  8. (Optional) Click Members to select members.

    The available types are IP Set, MAC Set, Logical Switch, Logical Port, and NSGroup.

  9. Click Save.