NSX DFW exclusion list freezing when adding or removing a virtual machine

Products

• VMware vDefend Firewall

Issue/Introduction

When trying to add or remove a virtual machine (VM) from the Distributed Firewall (DFW) Exclusion List using the vSphere Web Client, the Exclusion List view freezes, it is not possible to interact with the user interface (UI) anymore and the part around the exclusion List view itself is greyed out, forcing to reload the vSphere Web Client.

Environment

NSX for vSphere 6.3.x

NSX for vSphere 6.4.x

Cause

This issue occurs when there is a VM with an empty scope is present in the DFW Exclusion List (this can sometimes occur with template or shell VMs).
 
On the above screen capture notice the empty scope for the virtual machine UPSA11.

Resolution

Important: The feature covered in this KB is owned by the ANS division. For cases matching this KB, transfer or clone the case to the ANS division. Do not suggest workarounds, recommend upgrades, or link this KB to the case without ANS TSE sign-off.
Support Product: VMware vDefend Firewall | Component: Distributed Firewall

This issue is resolved in VMware NSX Data Center for vSphere 6.4.7

 

Workaround

To be able to interact normally with the DFW exclusion list using the vSphere Web Client again, it is necessary to identify and remove the VM with an empty scope present in the DFW Exclusion List by using the REST API.

1. Use the following API call to query the complete DFW exclusion list configuration and identify the VMs without a "scope" section:
   GET https://{nsx-manager-ip}/api/2.1/app/excludelist
   
   
   Valid virtual machine:
   
   
   <member>
                <objectId>vm-28</objectId>
                <objectTypeName>VirtualMachine</objectTypeName>
                <vsmUuid>422B734B-6FC9-####-####-############</vsmUuid>
                <nodeId>37645b9f-9ebe-####-####-############</nodeId>
                <revision>11</revision>
                <type>
                    <typeName>VirtualMachine</typeName>
                </type>
                <name>HQ-VCSA-01a</name>
                <scope>
                    <id>resgroup-v83</id>
                    <objectTypeName>VirtualApp</objectTypeName>
                    <name>MGMT</name>
                </scope>
                <clientHandle></clientHandle>
                <extendedAttributes/>
                <isUniversal>false</isUniversal>
                <universalRevision>0</universalRevision>
                <isTemporal>false</isTemporal>
</member>
   
   
   Virtual machine with an empty scope:
   
   
   <member>
                <objectId>vm-141</objectId>
                <objectTypeName>VirtualMachine</objectTypeName>
                <vsmUuid>422B734B-6FC9-####-####-############</vsmUuid>
                <nodeId>37645b9f-9ebe-####-####-############</nodeId>
                <revision>20</revision>
                <type>
                    <typeName>VirtualMachine</typeName>
                </type>
                <name>UPSA11</name>
                <clientHandle></clientHandle>
                <extendedAttributes/>
                <isUniversal>false</isUniversal>
                <universalRevision>0</universalRevision>
                <isTemporal>false</isTemporal>
</member>
2. Remove the objects with no scope from the exclusion list with the following REST API call (the member ID is obtained from the GET output above):
   
   DELETE   https://{nsx-manager-ip}/api/2.1/app/excludelist/{memberID}
3. Once done, run a force sync for the firewall of the NSX prepared cluster, refresh the browser or log out/log back into vCenter.
4. It should now be possible to access and modify the Exclusion List again.