It’s hard to believe it has been seven years since VMware acquired Nicira and six years since VMware NSX was launched. Having evolved significantly since those days, features such as micro-segmentation, automaton and Virtual Cloud Networking have impacted the data center as well as disaster recovery.
With the release of NSX-T 2.4 in June 2019, VMware significantly modified the user experience of NSX manager. A new simplified UI was introduced and the previous UI from version 2.3, has become the advanced UI. During conversations with customers, this topic has surfaced frequently and I felt that explaining the key differences between the respective UIs and guidance regarding when to use which each would be helpful to Veeam customers.
Advantages of the simplified UI
The UI is basically a representation of the underlying API and that’s where the actual change was introduced. VMware introduced a second API in NSX-T 2.4 called the policy API (available at https://<nsxmanager>/policy/api), which is “declarative”, not to be confused with the management API (available at https://<nsxmanager>/api), which is “imperative.” By being imperative, all the correct actions or changes to a system must be specific and in exact order to reach the desired state. By being declarative, users can simply define the desired state in one API call and the system will determine which actions need to be taken to reach that desired state. This is a much simpler way of consuming a system because as an administrator or engineer, you don’t need intricate details on the current state and the specific order in which actions must be executed:
| Single API Interface (Imperative) | Single API Command (Declarative) |
| POST/GET Logical Switch | PATCH https://<nsxmanager>/policy/api/v1/infra
{desired outcome human-readable JSON} |
| POST/GET NSGroups | |
| POST/GET EDGE Firewall | |
| POST/GET Tier-1 Router | |
| POST/GET DFW-Section | |
| POST/GET LB Config |
The simplified UI aligns with the declarative policy API and the advanced UI aligns with the imperative management API:
In NSX-T manager, the top menu represents the simplified UI:
The advanced UI can be found by selecting the advanced networking & security option the top menu:
Object name changes in simplified UI
The new declarative policy API and simplified UI also introduced name changes for certain objects in NSX-T, including:
- Logical switch → segment
- T1 logical router → tier-1 gateway
- T1 logical router → tier-1 gateway
- NSGroup → group
- Firewall section → security-policy
- Edge firewall → gateway firewall
The following screenshot shows how a new segment, or logical switch as it is called in the advanced UI, is created:
The new segment is shown in the vSphere client and can be used to connect virtual machines:
How do the simplified UI and advanced UI relate to each other?
If you declare a desired state in the simplified UI, NSX-T will store the desired configuration data in the declarative interface and push it down to the control and data plane. It will also replicate all required objects as read-only objects to the imperative interface. All configurations created in the simplified UI are visible in the advanced UI. The Test-Segment referenced above is also visible as a read-only logical switch in the advanced UI:
(The red highlighted icon means the object is protected/read-only. Since all the logical switches starting with pks- are created and managed by VMware PKS which is running in this specific lab environment, these are also protected from manual changes).
This does not work in reverse. Objects created in the advanced UI are not replicated to or visible in the simplified UI. After upgrading to NSX-T 2.4, all existing objects will be unavailable in the simplified UI (as you can see by looking at the first simplified UI screenshot that shows zero objects available while there are numerous objects available in the advanced UI screenshot). Currently, there is no in-place migration capability available as part of the upgrade process. We can either leave our objects in the advanced UI or migrate them manually (or programmatically) to the simplified UI.
Which version of the UI should you use?
Moving forward, VMware appears to favor the simplified UI and the declarative policy API so it is recommended you become familiar with the simplified UI. It is expected that new features will emerge for the simplified UI and the advanced UI may even be deprecated at some point, although no timeline has been communicated. There are tasks that can only be performed in the advanced UI since support is not yet available for all functions and features in the simplified UI so familiarity with both is encouraged. Unfortunately, you are faced with a dilemma: keeping your existing NSX-T 2.3 topology in the advanced UI or migrating everything to the simplified UI (which can be a disruptive change). There are also integrations with other products that consume NSX-T, such as VMware PKS or third party container platforms for example. These integrations will need to be updated so, for the time being, they will continue to leverage the imperative API and advanced UI as well.
Conclusion
The introduction of the simplified UI and declarative policy API is a welcome addition in a world that is moving swiftly towards automation and desired state configuration. In the end this new consumption model allows administrators and engineers to utilize a software-defined network in a much easier, faster and more predictable way. In short-term, the move from the advanced UI to the simplified UI may cause some challenges for existing NSX-T customers. Today, there is not an alternative to the disruptive in-place migration tools and not all functions and features are fully available in the simplified UI. Though VMware appears to favor the simplified UI moving forward, both interfaces will still be required for your virtual networking needs.