ESXi may PSOD after migrating VMs from NSX-V to NSX

Products

• VMware NSX
• VMware vDefend Firewall

Issue/Introduction

•  NSX 4.1.1, 4.1.2, 4.1.2.1
•  A migration of VMs from NSX-V hosts to NSX hosts has occurred
•  The ESXi host crashes with a PSOD
•  The PSOD backtrace may contain the following lines

2023-09-09T09:31:12.685Z cpu18:2098025)@BlueScreen: #PF Exception 14 in world 3078012:vmnic1-pollW IP 0x130003bca102 addr 0x1200
2023-09-09T09:31:12.685Z cpu18:2098025)0x4538d7b98980:[0x420002cbd109]pf_sort_port_rules@(nsxt-vsip-22339670)#<None>+0x1a1 stack: 0x43382c31a520

Environment

VMware NSX 4.1.x

Cause

• This issue occurs when VMs with DFW applied are moved from an NSX-V host to an NSX 4.1.1, 4.1.2 or 4.1.2.1 ESXi host. NSX 4.1.0.2 is not impacted.
• If a packet is delivered to an imported VM DFW filter at the same time as the cfgagent is pushing a new NSX configuration then a crash can occur.

Resolution

This issue is resolved in VMware NSX 4.1.2.2
This issue is resolved in VMware NSX 4.2.0

Workaround:
To prevent a PSOD from occurring:

• Disable DFW in destination environment (NSX), migrate all VMs, re-enable DFW
  
  or
  
  
• Migrate from NSX-V to NSX-T version 3.2.3.1 or 4.1.0.2 and once VM migration is complete, upgrade to 4.1.2