NSX-T Data Center System group 'SystemVM_NSGroup' is not selected as an excluded group on the DFW exclusion list

Products

• VMware NSX

Issue/Introduction

Symptoms:

• Running NSX-T 3.2.2.
• In the UI the 'SystemVM_NSGroup' appears unselected under the DFW exclusion list 'User excluded groups' tab, suggesting it is not excluded from the DFW rules.
• Selecting the 'SystemVM_NSGroup' and saving the configuration does not work, the group remains unselected.

Environment

VMware NSX-T Data Center

Cause

This is issue occur due to the System group 'SystemVM_NSGroup' being incorrectly displayed in the User Excluded Groups section.

Resolution

• This issue is resolved in NSX-T 3.2.3 available at Broadcom Downloads.

 

Workaround:

There is no workaround to rectify the UI display issue.
To verify the 'SystemVM_NSGroup' are in the DFW exclusion list, use the following API's.

1. Determine 'SystemVM_NSGroup' UUID:

GET /policy/api/v1/infra/domains/default/groups

{

"expression": [],

"extended_expression": [],

"reference": false,

"resource_type": "Group",

"id": "########-####-####-####-########2347", 

"display_name": "SystemVM_NSGroup", 

"description": "System VMs are added to DFW exclude list via SystemVM_NSGroup",

"path": "/infra/domains/default/groups/########-####-####-####-########2347",

"relative_path": "########-####-####-####-########2347",

"parent_path": "/infra/domains/default",

"unique_id": "########-####-####-####-########5ea2", 

"realization_id": "########-####-####-####-########5ea2",

"marked_for_delete": false,

"overridden": false,

"_create_time": 1688649262937,

"_create_user": "system",

"_last_modified_time": 1688649262937,

"_last_modified_user": "system",

"_system_owned": true,

"_protection": "NOT_PROTECTED",

"_revision": 0

}

2. Verify the 'SystemVM_NSGroup' UUID is seen on the exclude list:

GET /policy/api/v1/infra/settings/firewall/security/exclude-list?system_owned=true

{

"members": [

"/infra/domains/default/groups/########-####-####-####-########0957",

"/infra/domains/default/groups/########-####-####-####-########2347" (SystemVM_NSGroup)

],

"resource_type": "PolicyExcludeList",

"id": "exclude-list",

"display_name": "exclude-list",

"path": "/infra/settings/firewall/security/exclude-list",

"relative_path": "exclude-list",

"parent_path": "/infra",

"unique_id": "########-####-####-####-########ecb0",

"realization_id": "########-####-####-####-########ecb0",

"marked_for_delete": false,

"overridden": false,

"_create_time": 1688649220691,

"_create_user": "system",

"_last_modified_time": 1688649263635,

"_last_modified_user": "system",

"_system_owned": false,

"_protection": "NOT_PROTECTED",

"_revision": 2

}