After NSX Manager upgrade, cluster / host upgrade fails with error "Can not remove module nsx-dvfilter-switch-security: module"

Products

• VMware NSX Networking

Issue/Introduction

• After NSX Manager upgrade, cluster / host upgrade fails with error "Can not remove module nsx-dvfilter-switch-security: module"
• Manual attempt to remove the esx-nsxv VIB fail with the same error:

[root@Hostname:~] esxcli software vib remove -n esx-nsxv
Failed to unload nsx-dvfilter-switch-security [rc=1]: vmkload_mod: Can not remove module nsx-dvfilter-switch-security: module symbols in use
[Errno 1] vmkload_mod: Can not remove module nsx-dvfilter-switch-security: module symbols in use

Environment

NSX for vSphere 6.3.2

Cause

The issue is due to dvportgroup NSX parameters (com.vmware.common.port.dvfilteraltvmx and dvfilter-generic-vmware-swsec.config) applied incorrectly on uplink dvport.
The parameters, com.vmware.common.port.dvfilteraltvmx and dvfilter-generic-vmware-swsec.config, respectively MAC learning and IP discovery, should never be configured on uplink dvports.

Resolution

This issue is resolved in NSX for vSphere 6.3.5 and 6.4.0

Workaround

Open a Support Request with Broadcom Support and note this Knowledge Base article ID (303272) in the problem description

Additional Information

Impact/Risks:

ESXi hosts NSX VIBs cannot be upgraded.