Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

DFW rules are incorrectly applied to NSX Edge ESGs and DLRs (52901)

Last Updated: 5/10/2019Categories: TroubleshootingTotal Views: 5985Language:
Chinese (Simplified)English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Symptoms

NSX Edge Services Gateway (ESG) VMs and/or Distributed Logical Router (DLR) appliances experience partial or 100% packet loss.

Traffic flows traversing NSX ESG experience reduced performance.

ESGs or DLRs impacted were recently created, upgraded or redeployed.

You see a 'slot-2' dvFilter applied to the ESG or DLR appliance even though you do not have any DFW rules configured to apply to them when running the summarize-dvfilter command from an ESXi command prompt.

For example:

world 4498886 vmm0:Testing-Edge-1-0 vcUuid:'50 1e 5b 00 2f 49 1c a0-08 34 e2 7b b4 7a 14 50'
port 50331766 Testing-Edge-1-0.eth0
vNic slot 2
name: nic-4498886-eth0-vmware-sfw.2
agentName: vmware-sfw
state: IOChain Attached
vmState: Detached
failurePolicy: failClosed
slowPathID: none
filter source: Dynamic Filter Creation
vNic slot 1
name: nic-4498886-eth0-dvfilter-generic-vmware-swsec.1
agentName: dvfilter-generic-vmware-swsec
state: IOChain Attached
vmState: Detached
failurePolicy: failClosed
slowPathID: none
filter source: Alternate Opaque Channel

In the NSX Manager logs, you see entries similar to:

2018-02-09 13:42:05.237 CST INFO VirtualMachineDvfilterMonitor-1 VirtualMachineWorkQueue:534 - Updating exclude list with vm-245204 (Testing-Edge-0)...
2018-02-09 13:42:05.237 CST INFO VirtualMachineDvfilterMonitor-1 ExcludeListServiceImpl:240 - Get VnicIds for Exclude list Member Ids
2018-02-09 13:42:05.237 CST INFO VirtualMachineDvfilterMonitor-1 FirewallInstallManagerImpl:443 - Getting firewall enabled clusterIds
2018-02-09 13:42:05.238 CST INFO VirtualMachineDvfilterMonitor-1 FirewallInstallManagerImpl:452 - Firewall is enabled for the clusters : [domain-c71337, domain-c243225, domain-c71339, domain-c190120, domain-c80]
2018-02-09 13:42:05.488 CST INFO VirtualMachineDvfilterMonitor-1 VirtualMachineWorkQueue:522 - Update DvFilter Settings failed. com.vmware.vshield.vsm.exceptions.ObjectNotFoundException: core-services:202:The requested object : domain-c243225 could not be found. Object identifiers are case sensitive.

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Cause

This issue occurs because by default, the NSX components DLR and ESGs are tracked by NSX Manager as system resources and instructs the ESXi hosts not to apply DFW filter on these VMs. The NSX Manager achieves this by publishing the list of VMs to be part of exclusion list to every NSX prepared cluster. An exception was observed in the vsm logs for one of the clusters to which the exclusion list need to be published. It happened because one of the cluster that exists in firewall_status_cluster table does not exist in domain_object_table or vCenter inventory. The workflow that can cause this database inconsistency is when the user deletes an NSX prepared cluster with no ESXi hosts from vCenter without un-preparing the cluster from NSX. After the above workflow, if a user deploys or re-deploys an NSX edge the VMs can get applied with DFW filters.

Note: This issue can effect any vm which has been added to the exclusion list, not just automated system object such as DLRs or ESGs.

Impact / Risks

Because the firewall rules were likely not designed with the intention of filtering flows in/out of DLR and ESG appliances, unpredictable filtering may be experienced. This can result in partial or complete packet loss depending on the rule-set. Also, because ESGs tend to funnel a large amount of north/south traffic, the addition of the slot-2 filter increases overhead and may cause performance impact.

Resolution

This issue is resolved in:

VMware NSX for vSphere 6.3.6, available at VMware Downloads.

VMware NSX for vSphere 6.4.1, available at VMware Downloads.

Workaround

To work around this issue if you do not want to upgrade, run a 'Force Sync' of firewall services to vSphere Clusters with impacted ESGs/DLRs which removes the slot-2 dvFilter.

Note: This is a temporary solution, as the filter may be applied again should the appliances be re-deployed or upgraded. The slot-2 filter will also be applied to any newly created ESGs until the stale DB entry is removed.

To remove the stale cluster entry from the firewall_status_cluster table, contact VMware Support and quote this Knowledge Base article ID (52901) in the problem description. For more information, see How to Submit a Support Request.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)English

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware NSX for vSphere

Related Versions:

VMware NSX for vSphere 6.4.x

VMware NSX for vSphere 6.3.x

Take Our Survey

Support Assistant