The NSX Manager must determine which vSphere clusters the DFW rules are applied to. It performs this calculation based on the inventory updates from vCenter and the entity specified in the "Applied To" field.
When the "Applied To" field is a Security Group, the span is globalroot-0 which includes all the clusters. For performance optimization, the NSX Manager caches this information.
Due to a change introduced in NSX for vSphere 6.2.3, if a new cluster is added to the environment, the NSX managers cache is not updated to include the new cluster.
Because of this rules which have an "Applied To" field of Security Group are not pushed to all vSphere clusters for the following scenarios:
- DFW rule modification
- New DFW rule creation
- DFW section modification