ESXi may PSOD after migrating VMs from NSX-V to NSX

Products

• VMware NSX
• VMware vDefend Firewall

Issue/Introduction

•  In VMware NSX 4.1.1, 4.1.2, 4.1.2.1
•  A migration of VMs from NSX-V hosts to NSX hosts has occurred
•  The ESXi host in NSX environment crashes with a PSOD
•  The PSOD backtrace may contain the following lines

#PF Exception 14 in world <world#>:NetWorld-VM- IP <IP> addr 0x332 
..........
Code start: 0x420006600000 VMK uptime: 12:21:57:14.023
0x453ab89986d0:[0x4200089c2bb9][email protected]#1.0.7.0.22589044+0x3225 stack: 0x2       
0x453ab8998c90:[0x42000895c0f3][email protected]#1.0.7.0.22589044+0x400 stack: 0x45bed842ad18       
0x453ab899a3d0:[0x42000896423c][email protected]#1.0.7.0.22589044+0x859 stack: 0x14    
0x453ab899a740:[0x42000896480f][email protected]#1.0.7.0.22589044+0x160 stack: 0x453ab899a782     
0x453ab899a810:[0x420008966492][email protected]#1.0.7.0.22589044+0x56f stack: 0x453ab899a9d8         
0x453ab899a920:[0x42000896ccd9][email protected]#1.0.7.0.22589044+0x28b6 stack: 0x453ab899a9a8
0x453ab899ab90:[0x4200089ed8e1][email protected]#1.0.7.0.22589044+0x9ee stack: 0x0
0x453ab899aea0:[0x4200088f3d50][email protected]#1.0.7.0.22589044+0x4e9 stack: 0x0
0x453ab899b670:[0x420007139494][email protected]#v2_9_0_0+0xa9 stack: 0x1
0x453ab899b6b0:[0x420006828df9]IOChain_Resume@vmkernel#nover+0x2e6 stack: 0x430711333330
0x453ab899b750:[0x42000686ccf2]PortOutput@vmkernel#nover+0x237 stack: 0x453ab899bdd0
0x453ab899b7e0:[0x4200068a7e73]vmk_PortOutputFrom@vmkernel#nover+0x218 stack: 0x6e
0x453ab899b860:[0x42000851c18e][email protected]#1.1.7.0.22589044+0x11b stack: 0x0
0x453ab899b8f0:[0x42000851dc91][email protected]#1.1.7.0.22589044+0x3d2 stack: 0x0
0x453ab899bc50:[0x420006828dd9]IOChain_Resume@vmkernel#nover+0x2c6 stack: 0x43071132e0f0
0x453ab899bcf0:[0x42000686ced2]Port_InputResume@vmkernel#nover+0xbf stack: 0x0
..........

Or

#PF Exception 14 in world <world#>:vmnic0-pollW IP <IP> addr 0x73

Environment

VMware NSX 4.1.x

Cause

• This issue occurs when VMs with DFW applied are moved from an NSX-V host to an NSX 4.1.x ESXi host. (NSX in 4.1.0.2 and 4.1.2.2+ are not impacted.)
• If a packet is delivered to an imported VM DFW filter at the same time as the cfgagent is pushing a new NSX configuration, then a crash can occur.

Resolution

This issue is resolved in VMware NSX 4.1.2.2
This issue is resolved in VMware NSX 4.2.0

Workaround:
To prevent a PSOD from occurring:

• Disable DFW in destination environment (NSX), migrate all VMs, re-enable DFW
  
  or
  
  
• Migrate from NSX-V to NSX-T version 3.2.3.1 or 4.1.0.2 and once VM migration is complete, upgrade to 4.1.2.2+ or 4.2.0+