If there is one thing that working with NSX has done is drag me kicking and screaming into the world of APIs. Apart from being on the VCIX-NV Blueprint, in my current role it was becoming increasingly important to understand how our developers consume and manipulate the automation of our products and services…just being able to do a manual step by step with a little PowerCLI wasn’t enough any more.

NSX was born out of APIs…for those that took a look at the first NVP examples before the release of NSX-v it was all API driven…with that, learning how to consume NSX via it’s APIs is paramount for anyone serious about automating NSX-v platform services.

The work I’ve been doing in getting NSX Productized resulted in a situation where I needed to look for efficiencies in response times for API requests. As has been the case since I first used NSX-v (6.05) I had noticed that depending on what account you log in as to the vCenter Web Client seemed to dictate the speed of the Networking and Security Menu. This had been put down to the Web Client making sure the logged in account has access to all the NSX parts…The NSX Service Account was snappier than AD Accounts…with the SSO Admin Account snappier again.

Using the Chrome Advanced Rest Client I wanted to see if I could get consistent results pointing out which account was best to use to squeeze out quicker response times.

  • NSX Enterprise Admin (AD Account)
  • NSX Service Account (AD Account)
  • SSO Admin (Local Account vCenter)

After a bit of testing with different accounts authenticating again the call to get all NSX Edges under the NSX Manager (https://NSX-manger-ip/api/4.0/edges/) I got some strange results…I can’t 100% say with confidence that the SSO Admin account was quicker, but in most circumstances there was a 10 second difference between the SSO Admin and AD Account…

NSX_API_11

To get the above XML response it took between 4 to 14 seconds on average depending on what account was used. The NSX Manager is relatively busy and has about 84 Edges to keep track of.

I also noticed blow outs in response times (20-30 seconds) when multiple calls where made at the same time…which very much makes sense, but I am wondering which mechanisms can be put in place to increase the overall response performance of these calls…also wondering if the Chrome Rest Client is contributing to the times I’m seeing.

I’m doing more testing with different tools (cURL and PowerCLI) to see if I can get a more definite outcome..in the mean time if anyone has any input based on a greater experience than mine playing with APIs, please feel free to comment.

So this post doesn’t so much answer the question or get into the inner workings of API authentication mechanisms…but using the SSO Admin account should result in the quicker API response.

References and Further Reading:

http://www.routetocloud.com/2014/12/working-with-nsxv-api/

http://stretch-cloud.info/2015/01/experimenting-rest-api-tools-can-use-part-iii/

http://pubs.vmware.com/NSX-61/topic/com.vmware.ICbase/PDF/nsx_61_api.pdf

http://wahlnetwork.com/2014/10/28/nsx-api-calls-powershell/

http://vbyron.com/blog/nsx-rest-api-primer-1-connecting-curl/

https://networkinferno.net/creating-nsx-objects-with-rest-api