About NSX Licenses

Solution License for VMware Cloud Foundation (VCF)

The consumption of the Solution License for VCF is tracked against the vCenter servers that are registered to your NSX deployment. The minimum version supported for vCenter Server Appliance is 8.0 Update 2b.

You must create the vSphere 8 Enterprise Plus for VCF license in your vSphere Client, and then assign this license to VMware vCenter server. For more information about adding a license key, see Managing vSphere Licenses.
You must add the VMware vCenter server as a compute manager in NSX.
You can then view the assigned Solution License for VCF in the NSX Manager UI on the System > Licenses page.
You cannot add or delete the Solution License for VCF from the NSX Manager UI. License is managed by VCF and cannot be modified from the NSX Manager UI. If vCenter server is deleted or the communication is down, the Solution License for VCF is removed from NSX.
You can now add the security licenses from the System > Licenses page.

Evaluation Period

A new NSX deployment immediately enters a 60-day evaluation period. During the evaluation period, the system supports all the NSX networking features that are equivalent to the features that are entitled by the NSX base license (Solution license for VCF or NSX Networking for VCF license).

By default, security features are not available during the out-of-box evaluation period in a licenseless mode. To evaluate security features, request a trial license for "VMware vDefend Firewall" or "VMware vDefend Firewall with Advanced Threat Prevention" from the Broadcom Support Portal and assign the VMware vDefend trial license in NSX Manager.

When you upgrade from an earlier NSX version to version 4.2 or later, NSX Manager continues to receive its entitlements from the existing NSX Edition licenses that are valid. In other words, all the existing license keys are carried forward to the target release. Evaluation period is not applicable to upgrade installation.

During the evaluation period, an information banner is displayed at the top of each page in the NSX Manager UI to let you know that to continue using the features that are supported in the evaluation period, you must apply a valid license key before the evaluation period expires.

In a new NSX installation, you can exit the evaluation period early by adding any one of these NSX base licenses:

NSX Networking for VMware Cloud Foundation
Solution License for VCF (vSphere 8.0 Enterprise Plus for VCF or vSphere 8.0 Enterprise Plus for VCF Edge)

After the base license is added, you can add security licenses in NSX Manager.

Note: You cannot add the security licenses directly during the evaluation period. You must first add a valid NSX base license, and then add a security license in NSX Manager.

If you do not apply a valid NSX base license within the 60-day evaluation period and the evaluation period expires, then NSX Manager is entitled to only those features that are supported by the default NSX for vShield Endpoint license.

For features that you configured during the evaluation period but are not supported by the default NSX for vShield Endpoint license, only read and delete operations are allowed. All edit and create operations are blocked.

You cannot delete the default NSX for vShield Endpoint license key. When a license has expired or about to expire, a warning banner is displayed in the NSX Manager UI to let you know.

If you assign a legacy license during the evaluation mode, the followng banner is displayed:

"Features activated in Evaluation Mode remain valid only until the mode expires. Please ensure you apply the appropriate License Key beforehand to maintain access to these features."

About Legacy NSX Evaluation License Key

If you install the NSX Data Center Evaluation license, it will be valid for 60 days.

You have the NSX for vShield Endpoint license and the NSX Data Center Evaluation license only.
- If the NSX Data Center Evaluation license is valid, it will be used.
- If the NSX Data Center Evaluation license has expired, the NSX for vShield Endpoint license will be used. (Enforcement will take effect.)
You can add evaluation, and other purchased license together. For example, you have the NSX for vShield Endpoint license, the NSX Data Center Evaluation license, and other licenses.
- If the NSX Data Center Evaluation license is valid, it and the other licenses will be used. (Evaluation license takes priority.)
- If the NSX Data Center Evaluation license has expired, the other licenses will be used.

Grace Period

NSX Manager cannot obtain its entitlements when any of the following situations occur:

Solution License for VCF has expired or has become invalid.
Solution License for VCF is removed from the vCenter server that is registered to NSX Manager.
Solution License for VCF is replaced with Solution License for VVF on the vCenter server.
vCenter server gets disconnected from NSX Manager.
vCenter server registration is deleted from NSX Manager.

When NSX Manager is unable to obtain its entitlements from the vCenter server for a period of three consecutive days, then a warning banner appears in the NSX Manager UI. You must verify that a valid license key is applied in NSX Manager, or check the connectivity of NSX Manager to the vCenter server.

During this three-day period, all create, update, read & delete operations are allowed.

If the issue is not rectified within three days, the NSX Manager appliances that are connected to the vCenter server will enter a grace period for a further 90 days. During this grace period, the warning banner continues to be displayed in the NSX Manager UI.

If the license issue is not rectified within the grace period and the grace period expires, then NSX Manager is entitled to only those features that are supported by the default NSX for vShield Endpoint license.

For features that are not supported by the default license, only read and deleted operations are allowed. All edit and create operations are blocked.

Note:

If NSX Manager is unable to obtain its entitlement during the consecutive three-day period and the 90-day grace period, you cannot apply security licenses in NSX Manager.
If the base license is invalid or expired, you cannot apply security licenses in NSX Manager.

Upgrade Scenario:

Assume that your NSX Manager has a valid legacy NSX Edition license key and you have upgraded from an earlier NSX version to v4.2 or later. When the legacy NSX Edition license key expires or becomes invalid, then NSX Manager will display a warning banner for the first three days and during the grace period of a further 90-days.

If the license issue is not rectified within the grace period and the grace period expires, then NSX Manager is entitled to only those features that are supported by the default NSX for vShield Endpoint license.

Now, let us assume that after upgrading to v4.2 or later, NSX Manager is obtaining its entitlements from one legacy NSX Edition license key and a Solution License for VCF. After a few days, let us say that the legacy NSX Edition license key expires. In this case, NSX Manager will continue to obtain its entitlement from the vCenter server that is assigned with the Solution License for VCF.

Support for Mixed Licenses

For the same NSX Edition, you can add multiple license keys. You can retrieve the details of all licenses in the NSX system by using the following API:

GET https://<nsx-mgr>/api/v1/licenses

Example 1

Let us assume that you are an existing NSX customer and your system currently has the NSX Networking for VCF license (100 cores).

Later, you decide to apply a Solution License for VCF on the vCenter server that is registered to NSX. Let us say that this Solution License for VCF entitles NSX to 50 more cores.

After adding the Solution License for VCF, NSX is now entitled to use 150 cores of NSX Networking for VCF.

Example 2

Let us assume that you are an existing NSX customer and have upgraded to version 4.2 or later. NSX Manager has an existing legacy NSX Edition license which is valid. After upgrading to 4.2 or later, your existing license is carried forward to the target NSX release.

Later, you applied the Solution License for VCF to the vCenter server that is registered to NSX Manager. The following combinations are supported.

Legacy NSX Edition License	Solution License for VCF	Supported Level
Yes	None	Existing features are supported
Yes	Yes	Union of features are supported
None	Yes	NSX Networking features are supported
Yes	Yes and Firewall add-on	Union of features are supported
None	Yes and Firewall add-on	NSX Networking and Security features are supported

License Entitlements in Multi-vCenter and Multi-NSX Deployments

Multi-vCenter Deployment

Assume that you are a new NSX customer and have registered two vCenter servers (VC1 and VC2) with your NSX Manager. You have applied the Solution License for VCF on VC1. In this case, NSX will receive its entitlement from VC1.

If you have applied the Solution License for VCF on both VC 1 and VC2, then NSX will receive its entitlements from both VC1 and VC2. If the Solution License for VCF on say VC1 expires, but the Solution License for VCF on VC2 is within its validity period, then NSX will continue to get its entitlement from VC2.

Multi- NSX Deployment

Assume that you are a new NSX customer and have registered multiple NSX Manager clusters to a single vCenter server. You have applied the Solution License for VCF on the vCenter server. In this case, all NSX Managers will receive the same entitlement from the vCenter server.