Under some circumstances there can be a disparity between two ESXi ConfigStore data pertaining to configured firewall rules for some services.
Due to order in the which firewall rules are re-applied (from the ConfigStore data), following ESXi firewall rule refresh operations (either pushed from vCenter or manually performed by an ESXi administrator), this can result in an unintended 'enabled: false' value being applied for the firewall rule of a service (e.g. CMMDS and RDT here). This results in the firewall rule for this service being disabled until the host is rebooted.
Example:
Problematic node example output:
[root@hostname:~] cd /etc/vmware/configstore
[root@hostname:~] /usr/lib/vmware/sqlite/bin/sqlite3 current-store-1
SQLite version 3.7.17 2013-05-20 00:56:22
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> .mode line
sqlite> select * from Config where Name='firewall_rule_sets' and Identifier='rdt';
Component = esx
ConfigGroup = network
Name = firewall_rule_sets
Identifier = rdt
ModifiedTime = 2023-10-11 11:10:19
CreationTime = 2023-04-23 09:12:10
Version = 1.3
Success = 1
AutoConfValue = {"name": "rdt", "enabled": true} <---Normal
UserValue = {"name": "rdt", "enabled": false} <---Abnormal
VitalValue = {"name": "rdt", "num_clients": 0}
CachedValue =
DesiredValue =
Revision = 35
sqlite> select * from Config where Name='firewall_rule_sets' and Identifier='cmmds';
Component = esx
ConfigGroup = network
Name = firewall_rule_sets
Identifier = cmmds
ModifiedTime = 2023-10-11 11:10:19
CreationTime = 2023-04-23 09:12:10
Version = 1.3
Success = 1
AutoConfValue = {"name": "cmmds", "enabled": true} <---Normal
UserValue = {"name": "cmmds", "enabled": false} <---Abnormal
VitalValue = {"name": "cmmds", "num_clients": 0}
CachedValue =
DesiredValue =
Revision = 35
Non-problematic node example output:
[root@hostname:~] cd /etc/vmware/configstore
[root@hostname:~] /usr/lib/vmware/sqlite/bin/sqlite3 current-store-1
SQLite version 3.7.17 2013-05-20 00:56:22
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> .mode line
sqlite> select * from Config where Name='firewall_rule_sets' and Identifier='rdt';
Component = esx
ConfigGroup = network
Name = firewall_rule_sets
Identifier = rdt
ModifiedTime = 2023-10-12 15:03:02
CreationTime = 2023-04-23 11:06:19
Version = 1.3
Success = 1
AutoConfValue =
UserValue = {"name": "rdt", "enabled": true} <---Normal
CachedValue =
DesiredValue =
Revision = 35
These values can also be checked in less detail (but more quickly) using:
# configstorecli config current get -c esx -g network -k firewall_rule_sets -i cmmds
# configstorecli config current get -c esx -g network -k firewall_rule_sets -i rdt