Updating Policy Security Group with invalid VIF external_id changes groups status to DOWN

Products

• VMware NSX

Issue/Introduction

Symptoms:

• You are using NSX-T 3.0
• A Group with VIF/VM static members is shown as Failed on the UI.
• A group will succeeds when created through the API and the VM id specified ExternalIDExpression is not a valid:

{
  "expression" : [
  {
    "member_type" : "VirtualMachine",
    "external_ids" : [ "invalid-vm-id" ],
    "resource_type" : "ExternalIDExpression"
  }
  ],
  "resource_type" : "Group",
  "id" : "test",
  "display_name" : "test"
}

The on UI, the status is shown as Failed:

Environment

VMware NSX-T

Cause

This issue occurs when the group gets created, Policy does not have the VM details. creating it the group without checking for valid Virtual Machine ids. While creating on the MP, the validation fails, as MP has the list of the valid Virtual Machine ids.

Resolution

Currently, there is no resolution.

Workaround:

To resolve this issue from th API

Update the group by explicitly removing the invalid VM/VIF id from the group.

To resolve this issue from the UI

1. Open the group to edit.
2. Click on the Compute members for the group.
3. Without making any changes, click Apply.
4. Click Save to update the group.