Migration Coordinator Fails at Configuration Migration Step when IPs are directly entered with comma in NSX-T

Products

• VMware NSX

Issue/Introduction

Symptoms:

• This issue occurs during Migration from NSX-V to NSX-T.
• The migration coordinator is failing with the message:

HTTP Error: 400: Field level validation errors: {value '#.#.#.#,#.#.#.#...' of property expression[0].ip_addresses[0] violates format 'address-or-block-or-range'} for url: http://localhost:6440/policy/api/v1/infra/domains/default/groups/ipaddress-group-b100dfb726345924cbed5ad4f2e############################

• The above message can be found on the NSX-T Manager in the /var/log/migration-coordinator/v2t/summary.log log file.
• More details about the exact API call can be found on the NSX-T Manager in the /var/log/migration-coordinator/v2t/cm.log file.

2021-07-30 18:57:58,459 4589 CM.clients.base_client DEBUG API tracker: REQUEST method=PATCH, url=http://localhost:6440/policy/api/v1/infra/domains/default/groups/ipaddress-group-138926938f4bafb1005ebc53e#########################, non-session-headers=None, params=None, data={"display_name": "ipaddress-group-138926938f4bafb1005ebc##################", "expression": [{"resource_type": "IPAddressExpression", "ip_addresses": ["#.#.#.#,#.#.#.#"]}], "tags": [{"scope": "v_origin", "tag": "IPAddressExpressionGroup-ipaddress-group-138926938f4bafb1005ebc53e17f647c1579e#########################"}]}
2021-07-30 18:57:58,467 4589 CM.clients.base_client ERROR Failed to PATCH http://localhost:6440/policy/api/v1/infra/domains/default/groups/ipaddress-group-138926938f4bafb1005ebc53e######################### with status: 400 and reason: {
  "details" : "Field level validation errors: {value '#.#.#.#,#.#.#.#' of property expression[0].ip_addresses[0] violates format 'address-or-block-or-range'}",
  "httpStatus" : "BAD_REQUEST",
  "error_code" : 255,
  "module_name" : "common-services",
  "error_message" : "Field level validation errors: {value '#.#.#.#,#.#.#.#' of property expression[0].ip_addresses[0] violates format 'address-or-block-or-range'}"

Environment

VMware NSX-T Data Center 3.x
VMware NSX-T Data Center

Cause

During the migration, the Migrator Coordinator is using the following API to create the group used in NSX-v firewall: PATCH /policy/api/v1/infra/domains/<domain-id>/groups/<group-id>.

This NSX-T API doesn't support list of IP separated by comma as documented here.

 

Resolution

Fixed in NSX-T 3.2.0.0.0.17707 and higher.

Workaround:

Based on the IP addresses reported in the error message or in the logs highlighted in the symptoms, navigate to the NSX-v firewall section and replace the IP separated by comma:

• #.#.#.#,#.#.#.#

By two distinct object or a range.

Example:

{
    "display_name": "test",
    "expression": [
        {
            "resource_type": "IPAddressExpression",
            "ip_addresses": ["#.#.#.#,#.#.#.#,#.#.#.#"]=======>issue 
        }
    ]
}
However this format is incorrect. The correct format is:
{
    "display_name": "test",
    "expression": [
        {
            "resource_type": "IPAddressExpression",
            "ip_addresses": ["#.#.#.#","#.#.#.#","#.#.#.#"]=====> correct format 
        }
    ]
}

Additional Information

Impact/Risks:
The Migration of the environment from NSX-v to NSX-T cannot proceed.