Examples of a firewall refresh causing disruption to vSAN iSCSI services.
Symptoms:
Examples of how vSAN iSCSI services can lose it's configuration.
- Running ESXi command 'esxcli network firewall refresh' on a ESXi host.
- Upgrading VC. This can push a refresh of ESXi firewall, in turn, disrupting vSAN iSCSI services.
esxupdate.0:2022-07-29T20:56:59Z esxupdate: msyslogd /etc/init.d/vmtoolsd /etc/init.d/hbr-agent
esxupdate.0:2022-07-29T20:56:59Z esxupdate: 13021993: LiveImageInstaller: INFO: Starting service /etc/init.d/vmware-fdm...
esxupdate.0:2022-07-29T20:56:59Z esxupdate: 13021993: vmware.runcommand: INFO: runcommand called with: args = '['/etc/init.d/vmware-fdm', 'start', 'upgrade']', outfile = 'None', returnoutput = 'True', timeout = '0.0'.
esxupdate.0:2022-07-29T20:56:59Z esxupdate: 13021993: LiveImageInstaller: DEBUG: Output: Not starting vmware-fdm now (upgrade). Will be started separately. success
esxupdate.0:2022-07-29T20:56:59Z esxupdate: 13021993: LiveImageInstaller: INFO: Executing post inst trigger : 'Firewall Refresh Trigger'
esxupdate.0:2022-07-29T20:56:59Z esxupdate: 13021993: LiveImageInstaller: INFO: Running firewall refresh...
esxupdate.0:2022-07-29T20:56:59Z esxupdate: 13021993: vmware.runcommand: INFO: runcommand called with: args = '/sbin/esxcli network firewall refresh', outfile = 'None', returnoutput = 'True', timeout = '0.0'.
- Inspect the firewall rules by running from ESXi CLI:
esxcli network firewall ruleset listThis check will confirm if it's enabled in the first place.
Then run:
esxcli network firewall ruleset rule listThis is to check if the vit firewall rules are expected.