Changes to IP 0.0.0.0 behaviour in VMware NSX version 4.1.2.0 and 4.1.2.1

Products

• VMware vDefend Firewall
• VMware NSX

Issue/Introduction

VMware NSX 4.1.2.0 or 4.1.2.1 is in use in the environment. 

vDefend Distributed Firewall is deployed.

Security groups used within the DFW rules have the IP address 0.0.0.0 specified.

Rules where the 0.0.0.0 IP is used match all traffic, regardless of flow IP address.

Environment

VMware NSX

vDefend Firewall

Cause

In NSX 4.1.2 or 4.1.2.1, the 0.0.0.0 address, when programmed in a group, gets converted into 0.0.0.0/0 instead of 0.0.0.0/32.

The rules that contain this address set will always match a flow, acting as an ANY/ANY rule.

Resolution

This issue is resolved in NSX 4.1.2.3, 4.2 and later release.

Additional Information

Workaround:

Identify group with 0.0.0.0 IP and remove it from the group or change 0.0.0.0 IP to 0.0.0.0/32 in group.