Workloads in an NSX-T environment are experiencing impact to traffic for Northbound/Southbound traffic. Traffic Northbound is leaving the NSX-T edge uplink but not seen on the vmnic of the ESXi host where the Edge VM is deployed.
When logging in to the ESXi host via SSH and reviewing the installed VIBs, it is found that the esx-nsxv VIB is installed.
esxcli software vib list | grep -i 'nsx' esx-nsxv 6.7.0-0.0.18516827 VMware VMwareCertified 2021-10-08
If the command output shows nsx-v vibs the host where the NSX-T Edge VM is deployed (as above), then proceed to check the dvfilter for the Edge VM and if there are any attached rules. Below we see that there is a filter attached at slot 2 for each of the interfaces on the manually deployed NSX-T Edge OVA/OVF.
[root@ds-tse-d44:~] summarize-dvfilter | grep -iA24 demo-nsxt-edge world 4940159 vmm0:demo-nsxt-edge-3.2.1.0.0.19801966 vcUuid:'<UUID>' port 100663330 demo-nsxt-edge-3.2.1.0.0.19801966.eth4 vNic slot 2 name: nic-4940159-eth4-vmware-sfw.2 <---- Filter name agentName: vmware-sfw state: IOChain Attached vmState: Attached <---- filter is attached, need to check rules failurePolicy: failClosed serviceVMID: 2 filter source: Dynamic Filter Creation vNic slot 1 name: nic-4940159-eth4-dvfilter-generic-vmware-swsec.1 agentName: dvfilter-generic-vmware-swsec <---- this is a different filter for L2 security (spoofguard). This is outside the scope of this KB and is not of concern. state: IOChain Attached vmState: Detached failurePolicy: failClosed serviceVMID: none filter source: Alternate Opaque Channel
After adding the Edge VM to the NSX-V Exclusion list, the state that we want to see the Edge VM in is as follows. This indicates that the L3 DFW rules have been removed and the dvfilters at slot 2 on the vnic have been removed.
[root@ds-tse-d44:~] summarize-dvfilter | grep -iA32 demo-nsxt-edge world 4940159 vmm0:demo-nsxt-edge-3.2.1.0.0.19801966 vcUuid:'<UUID>' port 100663331 demo-nsxt-edge-3.2.1.0.0.19801966.eth3 vNic slot 1 <---- Only slot 1 is attached now. Slot 2 is detached. name: nic-4940159-eth3-dvfilter-generic-vmware-swsec.1 agentName: dvfilter-generic-vmware-swsec state: IOChain Attached vmState: Detached failurePolicy: failClosed serviceVMID: none filter source: Alternate Opaque Channel port 100663330 demo-nsxt-edge-3.2.1.0.0.19801966.eth4 vNic slot 1 name: nic-4940159-eth4-dvfilter-generic-vmware-swsec.1 agentName: dvfilter-generic-vmware-swsec state: IOChain Attached vmState: Detached failurePolicy: failClosed serviceVMID: none filter source: Alternate Opaque Channel