NSX-T V2T migration fails due to "Unexpected error"

Products

• VMware NSX Networking

Issue/Introduction

Symptoms:

• Ongoing migration from NSX for vSphere to NSX-T Data Center.
• NSX-T Data Center version 3.1.3.1 or lower.
• Migration will fail with the following error in '/var/log/migration-coordinator/v2t/summary.log':

"category": "Unexpected error",
"error": "Endpoint Protection Converter failed with ''NoneType' object has no attribute 'get''"

Environment

VMware NSX-T Data Center

Cause

NSX for vSphere has a Security Group configured with invalid Dynamic Membership Criteria.

Resolution

This issue is resolved in NSX-T Data Center 3.1.3.3 or higher, available at VMware downloads.

Workaround:
1. In Migration Coordinator log files, identify the conflicting Security Group:

 grep "\"isValid\": \"false\"" /var/log/migration-coordinator/v2t/nsxv-config/services.securitygroup.* 

2. Review the Security Group identified in step 1, and find the "name" of the Security group, e.g.:

less var/log/migration-coordinator/v2t/nsxv-config/services.securitygroup.securitygroup-78
{
    "api": "/api/2.0/services/securitygroup/securitygroup-78",
    "securitygroup": {
        "clientHandle": null,
        "description": "AB SOURCE Group",
        "dynamicMemberDefinition": {
            "dynamicSet": {
                "dynamicCriteria": {
                    "criteria": "belongs_to",
                    "isValid": "false",
                    "key": "ENTITY",
                    "operator": "OR"
                },
                "operator": "OR"
            }
        },
        "extendedAttributes": null,
        "inheritanceAllowed": "false",
        "isTemporal": "false",
        "isUniversal": "false",
        "name": "AB SOURCE Group",
        "nodeId": "3a6c56a6-a12d-bd42-bc85-c746501a0610",
        "objectId": "securitygroup-78",
        "objectTypeName": "SecurityGroup",
        "revision": "4",
        "scope": {
            "id": "globalroot-0",
            "name": "Global",
            "objectTypeName": "GlobalRoot"
        },
        "type": {
            "typeName": "SecurityGroup"
        },
        "universalRevision": "0",
        "vsmUuid": "41FBA2B4-E28E-1C4A-A88F-69A26CC6992E"
    }
}

3. Rollback Migration in NSX-T Data Center.
4. Remove conflicting Security Group ("AB SOURCE group" in the example above) in NSX for vSphere.
5. Start migration again.

Additional Information

Impact/Risks:
Migration from NSX for vSphere to NSX-T Data Center may fail.