Host PSOD after migrating VMs from NSX-V to NSX

Products

• VMware NSX
• VMware vDefend Firewall
• VMware vSphere ESXi

Issue/Introduction

•  The ESXi host in NSX environment crashes with a PSOD
•  The PSOD backtrace may contain errors like the following:

#PF Exception 14 in world <world#>:NetWorld-VM- IP <IP> addr 0x332 
..........
Code start: 0x420006600000 VMK uptime: 12:21:57:14.023
0x453ab89986d0:[0x4200089c2bb9][email protected]#1.0.7.0.22589044+0x3225 stack: 0x2       
0x453ab8998c90:[0x42000895c0f3][email protected]#1.0.7.0.22589044+0x400 stack: 0x45bed842ad18       
0x453ab899a3d0:[0x42000896423c][email protected]#1.0.7.0.22589044+0x859 stack: 0x14    
0x453ab899a740:[0x42000896480f][email protected]#1.0.7.0.22589044+0x160 stack: 0x453ab899a782     
0x453ab899a810:[0x420008966492][email protected]#1.0.7.0.22589044+0x56f stack: 0x453ab899a9d8         
0x453ab899a920:[0x42000896ccd9][email protected]#1.0.7.0.22589044+0x28b6 stack: 0x453ab899a9a8
0x453ab899ab90:[0x4200089ed8e1][email protected]#1.0.7.0.22589044+0x9ee stack: 0x0
0x453ab899aea0:[0x4200088f3d50][email protected]#1.0.7.0.22589044+0x4e9 stack: 0x0
0x453ab899b670:[0x420007139494][email protected]#v2_9_0_0+0xa9 stack: 0x1
0x453ab899b6b0:[0x420006828df9]IOChain_Resume@vmkernel#nover+0x2e6 stack: 0x430711333330
0x453ab899b750:[0x42000686ccf2]PortOutput@vmkernel#nover+0x237 stack: 0x453ab899bdd0
0x453ab899b7e0:[0x4200068a7e73]vmk_PortOutputFrom@vmkernel#nover+0x218 stack: 0x6e
0x453ab899b860:[0x42000851c18e][email protected]#1.1.7.0.22589044+0x11b stack: 0x0
0x453ab899b8f0:[0x42000851dc91][email protected]#1.1.7.0.22589044+0x3d2 stack: 0x0
0x453ab899bc50:[0x420006828dd9]IOChain_Resume@vmkernel#nover+0x2c6 stack: 0x43071132e0f0
0x453ab899bcf0:[0x42000686ced2]Port_InputResume@vmkernel#nover+0xbf stack: 0x0
..........

Or

#PF Exception 14 in world <world#>:vmnic0-pollW IP <IP> addr 0x73

Or

#PF Exception 14 in world <world#>:vmnic5-pollW IP <IP> addr 0x2
Code start: 0x420031c00000 VMK uptime: 229:22:52:45.518
0x45395a9187c0: [0x420033ffa490][email protected]#1.0.7.0.22589044+0x148 stack: 0x433d48603d30

Environment

3.2.3.1.3263187 Hot Patch, 4.1.1, 4.1.2, 4.1.2.1

Cause

This issue occurs when VMs with DFW applied are moved from an NSX-V host to an NSX 4.1.x ESXi host. 

If a packet is delivered to an imported VM DFW filter at the same time as the cfgagent is pushing a new NSX configuration, a crash can occur.

 

Resolution

Resolved in 4.1.2.2 and 4.2.0

Workaround:

• Disable DFW in destination environment (NSX), migrate all VMs, and re-enable DFW
  or
• Migrate from NSX-V to NSX-T version 3.2.3.1 or 4.1.0.2. Once the VM migration is complete, upgrade to 4.1.2.2+ or 4.2.0+

Additional Information

4.1.0.2 not impacted.