- The issue is encountered when a firewall rule is configured with service groups (2 or more) with a combination of port numbers and port ranges with Layer 3, using the same protocol type - TCP or UDP.
- The first configured service that is shown in the UI is not impacted unless there is an overlapping range.
- The issue also applies to a Firewall rule with a Service configured with 'Raw Port-Protocol' or a combination of Service name and 'Raw Port-Protocol' in the rule.
Example 1: Overlapping Port Ranges
Configure Service Name_A: Layer 3, select 'protocol' is TCP (UDP), Source Ports/Destination ports: 2300-6000, 440,443,2100
Configure Service Name_B: Layer 3, select 'protocol' is TCP (UDP), Source Ports/Destination ports: 2300-6000,6443,7447,300-600
On the ESXi host:This log shows that the Firewall publishing is failing on the ESXi host:
/var/log/vmkernel.log
2020-08-01T00:08:24.797Z cpu0:1068617)VSIPConversionCreateRuleSet: Cannot insert #1 rule 1294: 22
2020-08-01T00:08:24.798Z cpu0:1068617)VSIPConversionCreateRuleSet: Cannot insert #1 rule 1294: 22
2020-08-01T00:08:24.799Z cpu0:1068617)VSIPConversionCreateRuleSet: Cannot insert #1 rule 1294: 22
2020-08-01T00:32:36.979Z cpu0:1068617)VSIPConversionCreateRuleSet: Cannot insert #1 rule 1294: 22Example 2: Without Overlapping Ranges
This example demonstrates the situation where there are two services. The first one (Name_A) having a port range (1-10) and the second (Name_B) having a port range (100-200) which will be misinterpreted as a list of ports.
Configure Service Name_A: Layer 3, select 'protocol' is TCP (UDP), Source Ports/ Destination ports: 1-10, 5, 20.
Configure Service Name_B: Layer 3, select 'protocol' is TCP (UDP), Source Ports/ Destination ports: 100-200, 500.
The resulting rule on the host will be 1-10, 5, 20, 100, 200, 500. The ports between the range 100-200 (101-199) is not set.