[WRITE] Create a Tier-1 gateway to route segments, optionally uplinked to a Tier-0.

Use this before create_segment when the segment needs routing; get tier0_path from list_tier0_gateways and edge_cluster_path from list_edge_clusters first. Without route_advertisement, connected subnets stay unreachable from outside until it is set here or via update_tier1_gateway. The same tier1_id overwrites (PUT). Returns the created gateway dict, else {"error", "hint"}; verify with get_tier1_gateway.

Args: tier1_id: Unique id (alphanumerics, hyphens, underscores); becomes /infra/tier-1s/. display_name: UI display name. tier0_path: Parent Tier-0 path, e.g. "/infra/tier-0s/"; omit for a standalone gateway. edge_cluster_path: Required for NAT and other stateful services. route_advertisement: Comma-separated: TIER1_CONNECTED, TIER1_STATIC_ROUTES, TIER1_NAT, TIER1_LB_VIP, TIER1_LB_SNAT, TIER1_DNS_FORWARDER_IP, TIER1_IPSEC_LOCAL_ENDPOINT. target: NSX Manager target from config (default if omitted).

[WRITE] Partially update an existing Tier-1 gateway via PATCH.

Only the fields you pass change. Use get_tier1_gateway first — route_advertisement is sent as a whole list, so include every type you want kept. Prefer this over create_tier1_gateway for an existing gateway: create is a PUT and overwrites everything. Re-applying identical values is harmless. Returns the updated gateway dict, else {"error", "hint"}.

Args: tier1_id: Gateway ID to update, as returned by list_tier1_gateways. display_name: New display name. Optional. tier0_path: New parent Tier-0 path, e.g. "/infra/tier-0s/". route_advertisement: Comma-separated types: TIER1_CONNECTED, TIER1_STATIC_ROUTES, TIER1_NAT, TIER1_LB_VIP, TIER1_LB_SNAT, TIER1_DNS_FORWARDER_IP, TIER1_IPSEC_LOCAL_ENDPOINT. target: NSX Manager target from config (default if omitted).

[WRITE] Delete a Tier-1 gateway. WARNING: removes attached segments and NAT rules.

Irreversible. Run get_tier1_gateway and list_nat_rules on the same tier1_id first to see what goes with it, and confirm with the user before deleting. Also removes the gateway's "default" locale-service first (the Policy API refuses to delete a Tier-1 that still has children); a missing locale-service is ignored. Returns a confirmation string, or an "Error: ..." string — not a dict.

Args: tier1_id: Gateway ID to delete, as returned by list_tier1_gateways. target: NSX Manager target from config (default if omitted).

[WRITE] Configure BGP settings on a Tier-0 gateway's locale-service.

Use get_tier0_gateway first to confirm the tier0_id. Sets BGP settings only (local AS, ECMP, inter-SR iBGP); neighbor creation is a separate Policy API object not exposed here, so peering will not come up from this call alone. Returns the updated BGP config dict, else {"error", "hint"}. Then check get_bgp_neighbors for session state.

Args: tier0_id: Tier-0 gateway ID, as returned by list_tier0_gateways. local_as_num: Local AS number as a string, e.g. "65001". enabled: Enable or disable BGP on the locale-service (default True). ecmp: Enable ECMP for BGP routes (default True). inter_sr_ibgp: Enable inter-SR iBGP (default True). locale_service_id: Locale-service identifier (default "default"). target: NSX Manager target from config (default if omitted).

[READ] Get active NSX alarms at one severity, with feature, description, and entity.

Returns the result envelope; check truncated before calling it complete. Note: the NSX severity filter is an EXACT match — "MEDIUM" returns only MEDIUM alarms, not MEDIUM-and-above, so call it once per severity to build a full picture.

Start a health check at get_nsx_manager_status, then come here, then drill into the entity the alarm names with get_transport_node_status or get_edge_cluster_status.

Args: severity: Exact severity: LOW, MEDIUM, HIGH or CRITICAL (default MEDIUM). target: NSX Manager target from config (default if omitted).

[READ] Get realized runtime status of one transport node (ESXi host or Edge node).

Use after list_transport_nodes when a node looks degraded or overlay tunnels are suspect; for cluster-wide edge health use get_edge_cluster_status instead. Returns one dict (not the list envelope): node_id, status (UP, DEGRADED, DOWN, UNKNOWN), control_connection_status, mgmt_connection_status, tunnel_status (up/down/degraded counts, BFD counters) and pnic_status. Point-in-time only — no history.

If tunnels are down on one segment only, follow up with get_logical_port_status rather than blaming the node.

Args: node_id: Transport node UUID, as returned by list_transport_nodes. target: NSX Manager target from config (default if omitted).

[READ] Check status of an edge cluster (member health, overall status).

Use this after list_edge_clusters when north-south traffic, NAT or BGP looks broken — Tier-0/Tier-1 stateful services run on these members. Returns one dict (not the list envelope): cluster_id, edge_cluster_status, member_count and members (transport_node_id, transport_node_name, status). Member status only — why a member is degraded comes from get_transport_node_status.

Args: cluster_id: Edge cluster UUID, as returned by list_edge_clusters. target: NSX Manager target from config (default if omitted).

[READ] Get NSX Manager cluster status (node health, control/management plane).

Start any NSX health check here: if the manager cluster is degraded, every other reading is suspect. Returns one dict (not the list envelope): cluster_id, overall_status, control_cluster_status, mgmt_cluster_status, online_node_count and nodes. Only online nodes are listed, so a node missing from nodes is down rather than absent. Then list_nsx_alarms for what is actually firing.

Args: target: NSX Manager target from config (default if omitted).

[READ] List all NSX network segments with type, subnet, admin state, and port count.

Returns the result envelope: rows under items, plus returned, limit, total (the collection's result_count, null when the API omits it), truncated and hint. Check truncated before calling this the complete set — when true, more rows exist. Every list tool here returns that shape.

Use this first to resolve a segment_id, then get_segment for its ports and linked gateway, or get_logical_port_status for realized state. Distributed firewall rules are not here — use vmware-nsx-security.

Args: target: NSX Manager target from config (default if omitted).

[READ] Get full details for one network segment, including its attached ports.

Use after list_segments to inspect one segment. Returns one dict (not the list envelope): id, display_name, type, admin_state, subnets, transport_zone_path, connectivity_path (linked gateway), vlan_ids, port_count, and the first 50 ports only. A segment with attached ports cannot be deleted — check port_count before calling delete_segment. For per-port realized state use get_logical_port_status; to change the segment use update_segment.

Args: segment_id: Segment ID — final component of /infra/segments/, as returned by list_segments. target: NSX Manager target from config (default if omitted).

[READ] List all Tier-0 gateways with HA mode and transit subnets.

Returns the result envelope; check truncated before calling it complete. Use this first to resolve a tier0_id, then get_tier0_gateway for HA detail and the tier0_path that create_tier1_gateway needs, or get_bgp_neighbors for peering state. Tier-0s are not created by this skill — only Tier-1s are.

Args: target: NSX Manager target from config (default if omitted).

[READ] Get configuration details for one Tier-0 gateway (north-south edge router).

Use after list_tier0_gateways to inspect HA configuration, or to build the tier0_path ("/infra/tier-0s/") that create_tier1_gateway needs. For BGP peering state use get_bgp_neighbors instead. Returns one dict (not the list envelope): id, display_name, ha_mode, failover_mode, transit_subnets, internal_transit_subnets, rd_admin_field. Static config only — it does not say whether the gateway is currently forwarding.

Args: tier0_id: Tier-0 gateway ID, as returned by list_tier0_gateways. target: NSX Manager target from config (default if omitted).

[READ] List all Tier-1 gateways with linked Tier-0 path and route advertisement.

Returns the result envelope; check truncated before calling it complete. Use this first to resolve a tier1_id — create_nat_rule, create_static_route, list_nat_rules and update_tier1_gateway all take one. A row with an empty tier0_path is standalone and cannot reach north-south. Then get_tier1_gateway for detail.

Args: target: NSX Manager target from config (default if omitted).

[READ] Get detailed info for one Tier-1 gateway.

Use after list_tier1_gateways, and always before update_tier1_gateway — update is a PATCH, so you need the current values to know what you are changing. Returns a single detail dict (not the list envelope): id, display_name, tier0_path, failover_mode, route_advertisement_types, type. Attached segments are not listed here — use list_segments for those.

Args: tier1_id: Tier-1 gateway ID, as returned by list_tier1_gateways. target: NSX Manager target from config (default if omitted).

[READ] List all NSX transport zones — the overlay/VLAN boundaries segments attach to.

Use this first when building a segment: create_segment requires a transport_zone_path of "/infra/sites/default/enforcement-points/default/transport-zones/" built from the id returned here. Returns the result envelope; each row has id, display_name and transport_type (OVERLAY_STANDARD, VLAN_BACKED, …). A VLAN-backed zone needs create_segment's vlan_ids, an overlay zone needs its subnet — passing the wrong one is rejected.

Args: target: NSX Manager target from config (default if omitted).

[READ] List all transport nodes (ESXi hosts and Edge nodes) with type and status.

Returns the result envelope; check truncated before calling it complete. Use this first to resolve a node_id, then get_transport_node_status for that node's tunnels, controller connectivity and pNICs — the summary status here does not explain why a node is degraded.

Args: target: NSX Manager target from config (default if omitted).

[READ] List all edge clusters with member count and deployment type.

Returns the result envelope; check truncated before calling it complete. Use this first to resolve a cluster_id, then get_edge_cluster_status for member health. The id is also what create_tier1_gateway's edge_cluster_path is built from — a Tier-1 without an edge cluster cannot run NAT.

Args: target: NSX Manager target from config (default if omitted).

[WRITE] Create an IP address pool with one static subnet and allocation range.

IP pools supply addresses to NSX consumers such as tunnel endpoints. Run list_ip_pools first to avoid overlapping ranges; start_ip and end_ip must both fall inside cidr. The same pool_id overwrites (PUT). Returns the created pool dict, else {"error", "hint"}. Then verify with get_ip_pool_usage; delete_ip_pool is the inverse.

Args: pool_id: Unique id (alphanumerics, hyphens, underscores only); becomes /infra/ip-pools/. display_name: UI display name. start_ip: First allocatable IPv4 address, e.g. "192.168.1.10". end_ip: Last allocatable IPv4 address, e.g. "192.168.1.100". cidr: Subnet containing the range, e.g. "192.168.1.0/24". gateway_ip: Subnet default gateway, e.g. "192.168.1.1". target: NSX Manager target from config (default if omitted).

[WRITE] Permanently delete an IP address pool.

Irreversible: consumers such as transport endpoints can no longer allocate, and NSX rejects the delete if the pool still has active allocations. Run get_ip_pool_usage on the same pool_id first to confirm it is unused, and confirm with the user before deleting. Returns a confirmation string, or an "Error: ..." string — not a dict.

Args: pool_id: IP pool ID to delete, as returned by list_ip_pools. target: NSX Manager target from config (default if omitted).

[WRITE] Create a NAT rule on a Tier-1 gateway's USER NAT section.

Run list_tier1_gateways for tier1_id and list_nat_rules to avoid an id clash — the same rule_id overwrites. The gateway must have an edge cluster (see create_tier1_gateway) or NAT cannot be realized, and TIER1_NAT advertisement must be set via update_tier1_gateway for the translated address to be reachable from outside. Returns the created rule dict, else {"error", "hint"}. Then confirm with list_nat_rules; delete_nat_rule is the inverse.

Args: tier1_id: Gateway ID, as returned by list_tier1_gateways. rule_id: Unique ID for the NAT rule. action: "SNAT", "DNAT" or "REFLEXIVE" (default "DNAT"). source_network: Source CIDR (required for SNAT). destination_network: Destination CIDR (required for DNAT). translated_network: Translated network/IP (required for all three). target: NSX Manager target from config (default if omitted).

[WRITE] Permanently delete a NAT rule from a Tier-1 gateway's USER NAT section.

Irreversible: traffic matched by the rule stops being translated immediately, which can break inbound (DNAT) or outbound (SNAT) connectivity. Run list_nat_rules on the same tier1_id first to confirm the rule_id and review its action and networks, and confirm with the user before deleting. Returns a confirmation string, or an "Error: ..." string — not a dict.

Args: tier1_id: Gateway that owns the rule, as returned by list_tier1_gateways. rule_id: NAT rule ID to delete, as returned by list_nat_rules. target: NSX Manager target from config (default if omitted).

[READ] List NAT rules on a Tier-1 gateway (USER section).

Returns the result envelope; check truncated before calling it complete. Get tier1_id from list_tier1_gateways first. Use this before create_nat_rule to avoid an id clash, and before delete_nat_rule to confirm what a rule does. Only the USER section is listed — NSX-internal NAT is not shown.

Args: tier1_id: Gateway ID, as returned by list_tier1_gateways. target: NSX Manager target from config (default if omitted).

[READ] Get BGP configuration and neighbor status for a Tier-0 gateway.

Use this to verify dynamic routing after configure_tier0_bgp, or when troubleshooting north-south connectivity. Returns one dict (not the list envelope): tier0_id, locale-service info, BGP config (local AS, enabled, ECMP), neighbors (peer IP, remote ASN, timers) and realized session status (connection_state, in/out prefix counts). Only the gateway's FIRST locale-service is read; a gateway with none returns a hint, not an error.

If sessions are down, check get_edge_cluster_status — BGP runs on the edge members. Static routes are listed separately by list_static_routes.

Args: tier0_id: Tier-0 gateway ID, as returned by list_tier0_gateways. target: NSX Manager target from config (default if omitted).

[READ] List static routes on a Tier-0 or Tier-1 gateway.

Returns the result envelope; check truncated before calling it complete. Use this before create_static_route to avoid an id clash, and before delete_static_route to confirm the destination and next hops. gateway_type must match where the route actually lives — querying the wrong tier returns an empty list, not an error. BGP-learned routes are not here; use get_bgp_neighbors.

Args: tier1_id: Gateway ID (Tier-0 or Tier-1, per gateway_type), as returned by list_tier0_gateways / list_tier1_gateways. gateway_type: Either "tier0" or "tier1" (default "tier1"). target: NSX Manager target from config (default if omitted).

[READ] List all IP address pools with subnets and usage summary.

Returns the result envelope; check truncated before calling it complete. Use this first to resolve a pool_id, then get_ip_pool_usage for the actual allocations — the summary here does not tell you which addresses are taken. Run it before create_ip_pool to avoid overlapping ranges.

Args: target: NSX Manager target from config (default if omitted).

[READ] Get current IP allocations for one IP address pool.

Use this after list_ip_pools to see how much of a pool is consumed — e.g. diagnosing TEP address exhaustion, or before delete_ip_pool, which cannot proceed while allocations remain. Returns a single dict (not the list envelope): pool_id, allocation_count and allocations (id, display_name, allocation_ip). An empty allocations list means the pool is unused, not that the query failed. On failure returns {"error", "hint"}.

Args: pool_id: IP pool ID, as returned by list_ip_pools. target: NSX Manager target from config (default if omitted).

[WRITE] Create a static route on a Tier-0 or Tier-1 gateway via the Policy API.

Use this for destinations not covered by connected or advertised routes, e.g. a VPN or external subnet. Run list_static_routes first to avoid an id clash — the same route_id overwrites (PUT). For the Tier-0 to advertise a Tier-1's static route upstream, the gateway needs TIER1_STATIC_ROUTES advertisement, set via update_tier1_gateway. Returns the created route dict, else {"error", "hint"}. Then confirm with list_static_routes; delete_static_route is the inverse.

Args: tier1_id: Gateway ID (Tier-0 or Tier-1, per gateway_type), from list_tier0_gateways / list_tier1_gateways. route_id: Unique id (alphanumerics, hyphens, underscores only). network: Destination network in CIDR notation, e.g. "10.0.0.0/8". next_hop: Next-hop IPv4 address, e.g. "192.168.1.254". gateway_type: Either "tier0" or "tier1" (default "tier1"). target: NSX Manager target from config (default if omitted).

[WRITE] Permanently delete a static route from a Tier-0 or Tier-1 gateway.

Irreversible: traffic to the route's destination CIDR immediately falls back to remaining routes or is dropped. Run list_static_routes on the same tier1_id first to confirm the route_id, destination and next hops, and confirm with the user before deleting. gateway_type must match where the route lives. Returns a confirmation string, or an "Error: ..." string — not a dict.

Args: tier1_id: Gateway that owns the route (Tier-0 or Tier-1, per gateway_type), from list_tier0_gateways / list_tier1_gateways. route_id: Static route ID to delete, as returned by list_static_routes. gateway_type: Either "tier0" or "tier1" (default "tier1"). target: NSX Manager target from config (default if omitted).

[WRITE] Create an overlay or VLAN-backed NSX network segment.

Run list_transport_zones first for transport_zone_path; it decides whether subnet or vlan_ids applies — the wrong one is rejected. The same segment_id overwrites (PUT). Returns the created segment dict, else {"error", "hint"}. A segment with no gateway is isolated: link it with create_tier1_gateway, then verify with get_segment.

Args: segment_id: Unique id (alphanumerics, hyphens, underscores only); becomes /infra/segments/. display_name: UI display name. transport_zone_path: Full path, e.g. "/infra/sites/default/enforcement-points/default/transport-zones/". vlan_ids: VLAN ID(s) for a VLAN-backed zone, e.g. "100,200". subnet: Gateway IP in CIDR for an overlay zone, e.g. "192.168.1.1/24" — the gateway address, not the network address. target: NSX Manager target from config (default if omitted).

[WRITE] Update an existing network segment (partial update via PATCH).

Only the fields you pass change. Use get_segment first, and prefer this over create_segment for an existing segment: create is a PUT and overwrites everything. Changing subnet re-addresses the gateway and can drop traffic for attached VMs, so check port_count first. Returns the updated segment dict, else {"error", "hint"}.

Args: segment_id: Segment ID to update, as returned by list_segments. display_name: New display name. Optional. subnet: New gateway CIDR, e.g. "192.168.1.1/24". Optional. target: NSX Manager target from config (default if omitted).

[WRITE] Delete a network segment. WARNING: this disconnects all attached VMs.

Irreversible. Run get_segment on the same segment_id first and check port_count — NSX refuses to delete a segment that still has attached ports — and confirm with the user before deleting. Returns a confirmation string, or an "Error: ..." string — not a dict.

Args: segment_id: Segment ID to delete, as returned by list_segments. target: NSX Manager target from config (default if omitted).

[READ] Check realized state of all ports on a segment (first 50 ports).

Use this after get_segment_port_for_vm has told you which segment a VM sits on, or before delete_segment to see whether ports are still attached. Returns per-port admin_state, attachment (type/id) and realized state: attached, realized_bindings_count, transport_node_ids. NSX does not expose a single UP/DOWN flag per segment port — an attached port with realized bindings on at least one transport node is healthy. Only the first 50 ports are returned.

If bindings are missing everywhere, check get_transport_node_status.

Args: segment_id: Segment ID whose ports to inspect, as returned by list_segments. target: NSX Manager target from config (default if omitted).

[READ] Find which segment(s) a VM is attached to via its VIF attachments.

Start here for "why can this VM not reach the network?" — it is the only tool mapping a VM name onto NSX topology. Looks the VM up in the fabric inventory, fetches its VIFs, and matches segment ports by lport_attachment_id. Returns one dict (not the list envelope): VM info (external_id, host, power state) and matched_ports (segment id/name, port id/name). Matching is on exact display name, and empty matched_ports means no VIF is attached, not that the VM is missing.

Then get_logical_port_status on the segment it names. VM power and placement are not managed here — use vmware-aiops.

Args: vm_display_name: VM display name as shown in vCenter/NSX inventory. target: NSX Manager target from config (default if omitted).