Zsoldier's Tech Blog

Misc: Not a vExpert 2026?

2026-08-13T10:03:30.684-04:00

I've decided to retire from the vExpert community for now. I'm not as active as I used to be and there are new people that are far more deserving than I. I didn't apply for 2026 renewal purposely. Will I in the future? Maybe, but Broadcom's pricing antics really has really left me with a bad taste. I do appreciate the vExpert community though. It's always been a fun group of folks who are truly engaged and willing to share so much good information.

This doesn't mean I won't continue sharing what I can, although alot harder as principal engineer at Microsoft. Feel free to reach out or comment on old posts if you are in need of something. Always an open book. I'm going to try to share more of the cool AI stuff I've been doing in the background both related and unrelated to VMware. If you haven't checked out claude-vsphere-skill, be sure to do so.

AI: Apple Music Auto Pause AI assisted app creation on call start

2026-08-13T09:41:45.540-04:00

Art by Prakash Kurup - still my favorite whiteboard art by a guy that is dead to me...

AI Generated App Link: Mic Music Pause

Summary:

Have been messing w/ AI mostly for triage of stuff in my daily work. Has been fantastic and exciting. A side project I've had in the back of my mind for awhile has been how can I get an app that automatically pauses Apple Music when joining a teams call, then resuming once the call was over. So I asked AI and it delivered fantastically.

Details:

All I really did was prompt starting w/ copilot-cli and have a conversation to build this solution. There are many things that I just don't do on a daily basis that AI helped me fill in gaps in memory and knowledge.

Here are the prompts I provided to copilot-cli get to a solution you can find on github. The model I used was Claude Opus 4.8. Could I have used a different, cheaper model, probably.

My actual inputs (minus some things I did outside chat that it couldn't do for me):

🎬 Core idea

1. "Is there a way to have Apple Music pause when I start a Teams call, then resume after?" — the original ask.

📦 Making it shareable / brew-installable

2. "Let's make a git repo for this so others can use this. Would like to make it brew installable."

3. "Let's move local repo to ~/Documents/GitHub/ ."

4. "Why does there need to be two repos?" (app repo + Homebrew tap)

5. "What is the process to merge or provide a tap for anyone to pull via Homebrew?"

6. "Yes please" · 7. "gh auth login" · 8. "done"

7. "Switch to brew services."

8. "Music did not resume" → 11. "yes" (fix)

🎛️ UX & permissions

12. "Can we make this into a Control Center toggle?" (→ landed as a menu-bar app)

13. "Make the permission requests verbose so the person knows exactly why they're granting permission."

🍎 Apple Developer signing

14. "I just signed up for Apple Developer program"

15. "Check, it shows personal team"

🔊 Other-app audio feature

16. "Add a feature to pause music if a browser begins playing something too — mic by default, optional toggle for non-Apple-Music playback."

17. "Let's test the new version locally."

18–21. Resume-delay tuning: "resume delay seems long" → "still >2s" → "paused" → "reduce poll back to 2s to keep CPU low."

🚀 Signed release automation

22. "OK my dev account is ready"

23. "yeah set that up" (CI signing/notarization pipeline)

✨ Feature additions

24. "Add a feature to pause music on screen lock." (v0.5.0)

25. "Can we package this as an app for the App Store?" (assessed → stayed direct-distribution; also shipped in-app update check v0.6.0)

26. "Add an option to start at system start-up." (v0.7.0 — SMAppService login-item toggle)

📥 This session

27. "Can we have a packaged app on GitHub so users don't need Xcode tools?" (v0.8.0 — notarized DMG)

28. "Update to a newer revision of Node.js?" → 29. "yes" (v0.8.1 — CI checkout@v5 )

29. "Make a troubleshooter to call out things like USB mic is active." (v0.9.0 — Diagnostics window)

Result: a signed + notarized macOS menu-bar app at v0.9.0, installable via Homebrew or direct DMG, with auto-pause on calls/other-audio/screen-lock, start-at-login, in-app updates, and a live diagnostics troubleshooter.

Additional Notes:

It's an exciting time. While AI requires massive amounts of GPU's in crazy datacenters today, so did most early computers. I can very well see it where things go to a distributed model much like how people consume computers today. GPU's are expensive and power hungry today. AI Models are massive. Things are bound to get more efficient to where we will literally have an AI in our everyday devices personal to us.

I'm amazed that we are in a Star Trek Next Generation world where the like the crew we can simply state: "Computer, <ask question or do this thing>" is a current beta reality for every day things.

Estimated cost for this? Approx: $45-$60 not including my time/effort, but just straight cost github AI token costs. Could've probably done it for cheaper if I optimized by using cheaper model or letting copilot auto select a model for me.

VMware | AVS: Content Library or Non vCenter objects on VSAN produces unassociated but valid objects

2024-08-05T15:53:00.001-04:00

Summary:

Creating or Subscribing to a Content Library on vSAN is typical practice, but the annoying side effect? Objects created on vSAN datastore that show up as "unassociated" objects and guess what, they simply inherit the Cluster's default VSAN policy at time of import. Yeah, dumb right? Also, by vSAN Operations Guide Standards section 6721 subsection 4, you shouldn't do this.

So then what?

In Azure VMware Solution(AVS), you have a couple of options. You can do what the operations guide tells you that you shouldn't do or you can do something better. Regardless of these options, the one thing you should do, is create a global content library.

Create Global Content Library: here are instructions to create one on an Azure blob store.

You should do this, makes life easier if you can.
Also a fun little experiment to play w/ Azure Functions
Centralized Storage of your ISO/OVF's etc.

Attach external storage (Not necessary, but I'll explain why you should)

Subscribe to Global Content Library

Subscribe and attach to an external datastore

This is preferable for couple of reasons:

If you need to scale up or down your AVS SDDC, you no longer would be tied to VSAN limitations related to storage policies that might require more than (x) numbers of hosts.

Content library repository contents in VSAN would be tied to the cluster that vsandatastore is attached. Meaning cluster-2 cannot direct attach ISO's.

Whether you create a global Azure blob based library or local library, you have to have a target datastore to pull down the data into. If you choose VSAN, then you are basically running into the same problem of unassociated objects and cluster access limitations.

Another benefit w/ this model, if for whatever reason you want to get space back, you can just delete the content library subscription and re-subscribe to pull on-demand again.

If an external datastore is not an option for you:

The subscription model to each vsan datastore is still beneficial because:

Easy to delete and recreate content library subscriptions
Still a single source for your 'content'
Scale scenarios where, let's say you set RAID-5 at one point as cluster default, that cluster would have issues scaling down to 3-nodes because it would be impossible to meet RAID-5 requirements on 'unknown' objects. In this case, just delete the content library and resubscribe.
Slightly more annoying because now you have a content library for each cluster.
No avoiding "unassociated" objects in vSAN health check

Additional Notes:

Must be a publicly accessible blob

DNS issue here that needs to be addressed
You can limit blob access to Azure sources in the very least

References:

https://core.vmware.com/resource/vsan-operations-guide#sec6721-sub4

https://vskeeball.com/2022/03/31/vsphere-content-library-on-azure-blob/

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-operations/GUID-EC51751C-796A-4FFD-9455-BB178D1A3EBF.html

NSX-T: Release associated invalid node ID from certificate

2024-01-21T23:57:00.000-05:00

Summary:

Basically had an expiring certificate registered in NSX-T that was associated to a node_id that is no longer valid. Long story short, there wasn't anything obvious in API to delete or disassociate a certificate from a node_id for 3.2.2. Not sure how things got in this state, but annotating for future reference. This may change in future revisions, so always check API for latest.

Details:

Effectively had a stale node associated w/ a certificate that was expiring. Could not delete certificate until that node was disassociated from the certificate.

To get certificate details and associated node_id's, you can use the following curl call (UI works too):

curl -k -X GET -H "Content-Type: application/json" -u admin https://<manager ip>/api/v1/trust-management/certificates/<cert UUID>
Above will return something like this:

Below must be run from one of the manager nodes via elevation to root:
ONLY RUN THIS IF YOU ARE ABSOLUTELY SURE OF WHAT YOU ARE DOING!

curl -v -H 'x-nsx-username: admin' -k -H "Content-Type: application/json" -X POST "http://127.0.0.1:7440/nsxapi/api/v1/trust-management/certificates/<cert UUID>?action=release" -d '{"node_id": "node"}'

Above call is not publicly documented from what I was able to find, so use at your own risk.

iOS: Sleep Focus activating on wrong time zone

2024-01-21T23:20:00.003-05:00

Time is Relative

Summary:

For some strange reason, my sleep focus, was activating based upon my home timezone of EST while traveling to Japan and Australia. My phone's timezone was correct as was my apple watch that is set to mirror my iPhone.

[Update: While resolution below may help in some situations, I found my issue to be that I left a device (macbook pro) logged in and running in my home timezone while in Australia.

It seems that there is no 'primary' controller for initializing focus modes. It's basically whatever device sends the "It's focus time" message. Which now explains why I has having such issues.

So Apple needs to fix this by defining a primary device (should be my iPhone/Apple Watch IMYHO) so weird people like me who have multiple devices can get proper sleep outside my home timezone.]

Workaround/Resolution:

Check if you have another other Apple device logged in with your Apple ID in your home location. Chances are, if you do, that is the culprit. If not, then below steps are a valid next step.

Settings --> Privacy & Security --> Location Services
Turn off Location Services
Turn on Location Services

For a quick test, you can edit your sleep schedule in Apple Health to a time window the same as your original timezone to see it reactivates again immediately.

For example:

9:30 pm EST = 12:30pm Brisbane

So if you set your sleep schedule to 9:30pm while it is currently 12:30pm in Brisbane, sleep focus should activate immediately if above location services reset was not done.

For some strange reason, I was not able to fix this by restarting iPhone. Anyway, just thought I'd post since I'm likely to forget trying this.

Azure VMware Solution: NSX-T Active/Active T0 Edges...but

2023-11-13T15:57:00.004-05:00

Summary:

Azure VMware Solution (AVS) delivers by default w/ a pair of redundant Large NSX-T Edge VM's each running a T0 in active/active mode. So why is my traffic only going out one Edge VM?

Short answer:

The default T1 that is delivered w/ AVS is an active/passive T1 where you connect your workloads to. So while it could technically take either T0, it's always going to go out the closest T0 to the active "SR" T1. Where do the SR's live? You guessed it, on the Edge VM's. As you can imagine, this can lead to a bottleneck if you try to shove all your traffic through a single Edge VM.

Simple Diagram:

Longer answer with Options:

vCenter: Cluster Skip Quickstart Workflow via API

2022-10-11T13:53:00.005-04:00

Summary:

Basically, whenever you reset vCenter, you might end up w/ a warning on a cluster running vSAN that's just annoying. To circumvent, this from alerting, you need to disable quickstart. Easy enough via UI, but API is a little weird here.

Details:

For one, code capture doesn't seem to understand this. So no help there unfortunately. Secondly, nothing named "quickstart" is in the API, so made this somewhat annoying to try and find. Seems like someone had this question on the VMware communities forum 2 years ago w/ no answer. Someone asked me internally, so I had to dig into it.

Basically, two things:

You can create a cluster w/ quick start disabled from the get go by passing a false boolean to a parameter named: "InHciWorkflow" via API/PowerCLI call
Secondly, to "skip QuickStart" on an already created cluster, you can call a method called:

"AbandonHciWorkflow"

So yeah, you can see how "quickstart" and "HCIWorkflow" SCREAM the same thing...

Code Sample:

NSX-T: Find and Delete Orphaned Ports

2022-10-06T21:21:00.003-04:00

Summary:

Basically had a bunch of orphaned ports (65000+), don't know why or how it happened (hypothetically NTP related), but needed to clean them up. Doing it via UI was obviously not an option as it would only return 50 ports per page at a time. Oh and it wouldn't refresh after every delete.

Details:

I'm saying 'orphaned', but in reality I'm only keying off the idea that the port is reporting "Operationally Down". This could simply be a powered off VM, but there is little harm in deleting these type of ports as they will simply be recreated if that VM were to be powered up.

This may not apply in all situations, so use this with caution.

Powershell Example(s):

References:

https://www.virten.net/2021/03/error-when-connecting-virtual-machine-to-nsx-t-segments/

vSAN: The cascade scenario that vSAN stretch cluster has issues with...

2022-01-20T14:11:00.000-05:00

Summary:

Basically while testing stretch cluster, we ran into strange failover behavior. The fact that it was not simply occuring. During this testing, we found a dirty little secret about stretch cluster failovers. One that makes me rethink if stretch clusters really is worth doing.

Documented Failure Scenarios

Details:

All documented scenarios effectively deal w/ a 'single' type of failure. The problem is disasters/failures can be multi-faceted and cascading in some instances. Taking the Secondary Site Failure or Partitioned scenario and adding the 'cascading failure' to it and you end up in a whole world of trouble depending on the next 'failure'.

Below effectively depicts the failure of the interconnect between the two sites. The problem this fails to take into account is that there are typically 3 things involved to this.

The networking between the two sites
The preferred site routers
The secondary site routers

So here is a slightly more involved diagram to highlight a case where the primary site routers link to the secondary site fails FIRST in a cascading failure scenario.

VMs in Secondary Site are HA powered off
VMs in Secondary Site are powered on in Preferred Site.

This is fine, but 'what if' the primary site routers link to secondary was simply a signal to a greater disaster of preferred site going completely offline? What happens to your VMs? Do they failover to secondary site? Short answer is no. The reason?

The problem w/ this cascading failure scenario is that witness detected secondary site cannot communicate w/ primary and has already declared HA to failover to preferred site. EVEN though, the witness can still communicate w/ secondary site systems.

Witness cannot send preferred site a signal to HA event because it does not know its actual status to start systems on secondary site. The data on secondary site has also been declared stale at this point because the link between preferred and secondary was broken first. This is not an issue if secondary site were the one to fail.

So what can you do in this case?

Restore from backup
Contact VMware for the black magic voodoo to force a failover to secondary site.

What can VMware do to improve this? ¯\_(ツ)_/¯

All roads point to using storage policies and defining data locality (preferred only or secondary only), but at that point, you're working to make your applications above redundant. I would like to be able to define a dual mirroring policy w/ a way to state who my actual 'preferred' site is, but unsure if that really gains me anything.

Release the black magic voodoo so that you can force failover to your secondary site?

This is not without risk though, because remember, the data on the secondary site is stale and there may have been new data written while systems were up in preferred site that secondary site never received data for.

It's somewhat of an edge case, but in a DR scenario, anything is possible.

Is vSAN stretch cluster worth it?
I'd argue probably not, knowing the behavior above. I'd be more likely to lean toward DR tools like SRM (even though it wouldn't be real time replication). Or rely on application level replication tech. However, I'm sure there are use cases where vSAN stretch cluster would make sense, but the very real failure scenario above definitely gives me pause.

NSX-T: Deleting route advertisement filters via API

2022-01-14T16:15:00.003-05:00

Summary:

When creating a DHCP server in NSX-T, a route advertisement filter is automatically created for you. This is so that the DHCP server is prevented from advertising DHCP addresses outside of your fabric. This is fine for the most part, but there are occasions where the DHCP subnet you allocated may overlap a DNS forwarder IP that you may have setup before.

Honestly, this feels like a logic bug to where it shouldn't allow this, but oh well.

Detailed Steps

Anyway, all you have to do is delete the DHCP server in question, but in some cases, the route filter may not be deleted along with it.

In that case, you can delete the route filter itself via the Manager UI:

Select Manager > Networking > Tier-1 Logical Routers > T1 in question > Routing > Route Advertisement > Select DHCPServerRouteFilter > Delete.

In the case where the delete option is greyed out, you can use the below curl code to clear it out. This is the last ditch effort, so only do it if you absolutely know what you are doing:

NSX-T: Create CSR's with SAN entries, self sign, and apply them

2022-01-14T15:56:00.000-05:00

Summary:

This utilizes an experimental API endpoint in NSX-T, but I've found it to work without issues. Be warned though, the endpoint may not function the same in newer releases. This has worked in 3.1.2.

Details:

The variables at the beginning of this shell script must be defined for your environment.
Your DNS names should resolve to your appliances.
This does work w/ 3.1.2, but may not in future revisions.

Example Code:

MacOS: Remove password requirement policies originally applied by MDM's

2021-12-02T10:01:00.003-05:00

Summary:

Occasionally, a system no longer managed by an MDM will leave garbage behind. One of those 'things' is password policies. You can use a tool in terminal to get rid of the password policy.

Solution:

sudo pwpolicy -clearaccountpolicies

Note:

* If you use above on a still managed system, the above solution will only be temporary. I recommend following your MDM providers policies as they are in place to protect you and your company. Regardless of how annoying they might be be.

Reference:

If you want to keep just some things related to the policy, you create your own using the referenced script below:

Powershell: Unable to install modules due to missing nuget package provider, cannot install nuget

2021-08-26T11:28:00.005-04:00

Summary:

Had this issue in Windows 2016 on a system that I know has internet. Basically came down to enabling tls12 in order to enable powershell to download and install nuget package provider and modules from powershell gallery.

Example Errors:

WARNING: Unable to download from URI 'https://go.microsoft.com/fwlink/?LinkID=627338&clcid=0x409

WARNING: Unable to download the list of available providers. Check your internet connection.

PackageManagement\Install-PackageProvider : No match was found for the specified search criteria for the provider

'NuGet'. The package provider requires 'PackageManagement' and 'Provider' tags. Please check if the specified package

has the tags.

At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:7405 char:21

+ ... $null = PackageManagement\Install-PackageProvider -Name $script:N ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidArgument: (Microsoft.Power...PackageProvider:InstallPackageProvider) [Install-Pac

kageProvider], Exception

+ FullyQualifiedErrorId : NoMatchFoundForProvider,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackagePro

vider

PackageManagement\Import-PackageProvider : No match was found for the specified search criteria and provider name

'NuGet'. Try 'Get-PackageProvider -ListAvailable' to see if the provider exists on the system.

At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1:7411 char:21

+ ... $null = PackageManagement\Import-PackageProvider -Name $script:Nu ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : InvalidData: (NuGet:String) [Import-PackageProvider], Exception

+ FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.ImportPackageProv

ider

Install-PackageProvider : No match was found for the specified search criteria for the provider 'NuGet'. The package
provider requires 'PackageManagement' and 'Provider' tags. Please check if the specified package has the tags.
At line:1 char:1
+ Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (Microsoft.Power...PackageProvider:InstallPackageProvider) [Install-Pac
kageProvider], Exception
+ FullyQualifiedErrorId : NoMatchFoundForProvider,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackagePro
vider

Workaround:

Run the following in Powershell to workaround it. This won't solve issue if internet is blocked elsewhere.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-PackageProvider -Name NuGet
Install-Module SomethingfromPowershellGalleryshouldnowwork

References:

Unable to install NuGet package provider in PowerShell Core on Linux - Stack Overflow

Misc: Installed some new tail lights from Hansshow on my Tesla Model 3

2021-08-18T20:44:00.003-04:00

Summary:

As a little treat for myself, I bought some real cool aftermarket tail lights from Hansshow as you can see from the video above. Use coupon code "SARHANSSHOW" for 15% off. I don't get a cut of any kind, but I like sharing. Anyway, here is a wiring diagram I drew up to show how everything logically needs to be wired.

If you want to support me and posts like this, you can order Tesla products via my referral link. Honestly, their referral program these days is kinda lame in my opinion, but hey, you get something and I get something out of it.

Notes:

For euro spec may be slightly different and 2021 models would use a 4-pin Adapter instead of a 3-pin adapter which is US specific and applies for 2020 models and older. Basically, if you have a red turn signal, chances are that you have a 3-pin setup.

The only downside to these lights in older models is that the turn signal indicators light up in addition to a separate red brake light on these (Amber and Red). Not a deal breaker for me, but something to keep in mind. Otherwise, they work perfectly.

New Tail lights installed. Loving how these look. : TeslaModel3 (reddit.com) < Reddit Post where lots of good questions are answered.

Diagram:

NSX-T: Finding Tagless NSX-T VMs with Powershell Core

2021-07-12T11:51:00.006-04:00

Summary:

Someone asked how you can find NSX-T 'tagless' VM's. Seemed pretty straight forward and something I could answer w/o the shadow of LucD bot picking and answering while I'm still noodling on it.

Anyway here is how it can be done and via Powershell Core (does not work as written in Powershell classic). No PowerCLI module needed:

Misc: Workaround to silence Outlook for MacOS notification sounds while Do Not Disturb enabled.

2021-03-31T15:19:00.001-04:00

Summary:

Work from home doesn't mean you should be on 24/7, which is why MacOS's "Do Not Disturb" function is great. What's not great is that not all apps on MacOS respect it. Microsoft Outlook for MacOS is one of them. I've put in a bug/feature request for it to natively respect MacOS do not disturb. In the meantime, you can make use of MacOS Automator silence your system based on a calendar trigger.

It's no fun having anything that isn't muted going off in the middle of the night. Below can be used to basically mute your system. You can also have Automator close Outlook, but I've found that muting the system instead will catch any other application offenders that do not respect MacOS's do not disturb function. Not to mention the dreaded, "Would you like to save this?" message that prevents the app from closing.

Workaround:

Launch MacOS Automator, you can find it in your Applications Folder.
Create your Automator task type by selecting Calendar Alarm
Create your workflow by searching for 'sound', then drag and drop the "Set Computer Sound" action into the right pane. Save it, and click run to test. This will also create an iCal Event.
An iCal Event will be created at the time you click run. You can then modify this iCal Event just like any other calendar event. I've set mine to repeat everyday at the same time.
That's it, now my system mutes itself at 8pm every night. You can repeat the above steps to create another task to unmute your system for the morning (on weekdays only).

Side Notes:

If you want this workflow to follow you around on several mac systems, you can sync your automator workflows into iCloud or your file sync service of choice.

Automator saves, by default, your workflows to ~/Library/Workflows/Applications/Calendar/

You would copy these workflows to an iCloud sync'd directory, like Documents, and move or create new calendar items in your iCloud calendar to open the file located in your sync'd directory.

By default, automator creates a calendar local to your mac, so it is important that you create new event or move the event to an iCloud based calendar. It will only work if you've placed the automator workflow apps in a directory that all Macs will be able to access.

NSX-T: Get BGP Route Table from T0 via Powershell/Curl

2021-03-09T22:01:00.009-05:00

Summary:

Azure VMware Solution doesn't currently allow CLI/SSH access to your Edge VMs. So typical CLI way to find information is not possible. If you need to get things like a route table from your T0, you need to do it through API methods since ~~the UI still doesn't provide this.~~ [Update: I lied, you can download route table via UI. But imagine how much cooler you would be using powershell. ;)]

UI Method:

Powershell Method:

Curl Method:

NSX-T: Clear NSX-T DNS Forwarder Cache

2021-02-19T17:33:00.008-05:00

[Update: NSX-T ingests negative SOA TTL from myDNS server in this example. Microsoft DNS defaults this to 1 hour. So NSX-T will cache the negative result for an hour.

To combat this behavior, you can set your source DNS server to a lower TTL so that cache in NSX-T clear quicker. Valid records in this setup will still cache for 1 hour or whatever you have your DNS server set to.]

To determine TTL value for the negative record:

nslookup -type=a -nosearch -d2 brokenaka.ninja.corp

Summary:

Ran into an interesting behavior w/ NSX-T's DNS forwarder service. Basically, if I queried for an invalid DNS name, NSX-T's DNS caching appears to capture that invalid query for an undetermined amount of time.

So what does this do? Basically, if I queried for ninja.naka.corp w/o creating the entry on my DNS server, NSX-T caches that invalid record. If I then registered ninja.naka.corp on my DNS server, NSX-T will continue to tell me that the record is invalid even though does now exist in my DNS server.

Verified this behavior occurs w/ NSX-T 2.5.2. It 'might' occur in 3.x, but unsure. What I am aware of is that there still does not appear to be a UI method to flush this service's cache.

Workaround:

The only way around this problem appears to either wait for the cache to time out or force flushing of cache via API. Below are curl and powershell examples of how to do this:

Curl Method:

Powershell Method:

Powershell: Azure submitting JIT Request via Powershell

2021-01-14T13:27:00.002-05:00

Summary:

If you make use of Azure Security Center w/ your VM's, you can enable Just in Time VM Access (JIT). This allows you to open up ports for a finite period of time to access your VM via its public IP. I make use of this a lot working in my environments to sshuttle in. Connection will stay active as long as I maintain it, otherwise I get disconnected and have to go through JIT process again.

Anyway, going through the portal can get very cumbersome requesting this access, so you can use the below powershell example to automate opening ports, setting time frame, and setting an allowed public IP address source.

PowerCLI: Getting HCL DID, VID, and SVID information.

2021-01-14T12:45:00.003-05:00

Summary:

Searching for IO devices on VMware's HCL list is easier, if you have data like DID, VID, and SVID. Thought I posted on this awhile back, but apparently forgot to do so. Below is a script that you can run on an ESXi host to get those values needed for the PCI devices you are trying to look up.

Misc: Technology industry new terminology initiative

2020-07-22T14:32:00.002-04:00

Summary:

I've been working in technology for about 20+ years now, so it'll be difficult for me to break old habits w/ terminology, but I'm posting this here in the hopes that I can continue to adjust to new dynamics.

Nothing really technical here, but if you happen to commit/modify code anywhere, here is a good starting point to adjust the terms you use in your code. Also, a reference point to adjust your spoken vernacular to be inclusive to all those around you.

Information shared from the VMware vExpert program.

Words	Recommended Alternate	Other Situational Alternates if Recommended Alternate does not work
abort	stop	· cancel · halt prematurely · end prematurely · stop prematurely
blacklist	· denylist (n) · block (v)	deny (v)
blackout	· restrict (v) · restriction (n)	outage (n)
kill	stop	halt
master	primary	· main · original · control plane / control plane node in Kubernetes context
rule of thumb	rule	guideline
segregate/segregation	· separate · separation
slave	secondary	replica
whitelist	· allowlist (n) · allow (v)	· safelist (n) · acceptlist (n)

Other Terminology Recommendations

Terminology changes/guidelines going forward (no legacy changes)		No change needed
Words	Alternates	Words
black hat	unethical	· bind/binding · black box · black hole · black screen · invalid (adj) · masterful · mastermind (n, v) · masterpiece · master plan · masterstroke · simple · white board
female	· jack (n) · socket (n)
he ***	they
eviction	alternate usage depends on the situation
execute	run
ghetto	TBD
kill switch	TBD
male	plug
she ***	they
suffer **	alternate usage depends on what's being described; alternates can include: · decrease, lessen, shrink · increase, grow
taint	TBD
white hat *	ethical

Powershell: Changing NSX-T Segment Profiles enmasse.

2020-05-29T00:01:00.001-04:00

Summary:
Note to self, cut back on the reddit. It's a time suck and VMware questions are popping up that I have time to answer w/o the shadow of a retired LucD bot lurking. Anyway, someone asked if you could update segment profiles, so I got curious and followed the rabbit.

Here is the example I came up with. It's straight powershell core, so no special modules needed, not even vmware.powercli. GASP!

Powershell: Clearing a bad route advertisement rule from NSX-T logical router/gateway created via policy API.

2020-05-22T18:27:00.005-04:00

Summary:
Basically ran into a weird issue where a T1 was not advertising a very specific subnet when configured on segment. Come to find out when looking at the advanced networking section of that T1, there was a route advertisement rule that denied that subnet from being advertised up. Since the T1 was created via the policy API, you cannot simply delete it via UI.

Have no idea how that route advertisement rule even got there, but something tells me a bug exists. Unfortunately have no idea how to reproduce it.

[Update: I have a hypothesis on how it got there now. When you instantiate a DHCP server via the policy engine, whatever network you place on and attach to a T1 shows up here. This is likely why the network was here. What seems to have happened is that deletion of the DHCP server did not happen cleanly and left that artifact there.]

Workaround:
Long story short, you have to call the API to do so. Here is a powershell snippet to be able to do so.

PowerCLI: New-HCXMobilityGroup - A parameter cannot be found that matches parameter name 'source'

2020-05-06T18:01:00.000-04:00

Summary:
Running the above cmdlet and passing what is apparently the only required parameter of name, results in the above obscure error. It refers to a parameter that doesn't appear to exist for the cmdlet. There is also the -migration parameter that looks for a <HCXMobilityGroupMigration[]> object array that no other HCX cmdlet provides.

Long story short, informed VMware, they are going to fix the cmdlets and their documentation. In the meantime, here are some examples that VMware's GSS shared to be able to use the New-HCXMobilityGroup cmdlet.

Here is the code:

Powershell: NSX-V Edge Service Gateway (ESG) Firewall Rules Output

2020-04-24T23:46:00.001-04:00

Summary:
Basically had a script to output Distributed Firewall, but not individual ESG based firewall rules. Turns out, I could re-use some of what I had made for DFW, but had to rewrite ALOT surprisingly. So here is an ESG based version. The script was written and run using Powershell 7 Core, latest PowerCLI and PowerNSX.

It might work on other revisions, but I'm too lazy to back test. You can export to CSV as well.