DFW Rule publish operation failed with service profile configuration in existing firewall rules in 6.4.7

Products

• VMware NSX

Issue/Introduction

Symptoms:
Provided you are meeting these certain conditions, 

• If you are using Distributed Firewall with rules that contain multiple service profiles starting or ending with port ranges.
• If you are running NSX-v 6.4.7 (version 6.4.7-16509800 only) build.

Then you observe the following symptoms:

• Firewall Publish operation fails in NSX UI, when adding or modifying the firewall configuration when the port ranges are overlapping.
• Firewall rules are not realized on virtual machines where there is not overlapping port ranges between services

​​​

Cause

• The issue is encountered when a firewall rule is configured with service groups (2 or more) with a combination of port numbers and port ranges with Layer 3, using the same protocol type - TCP or UDP.
• The first configured service that is shown in the UI is not impacted unless there is an overlapping range.
• The issue also applies to a Firewall rule with a Service configured with 'Raw Port-Protocol' or a combination of Service name and 'Raw Port-Protocol' in the rule. 

Example 1: Overlapping Port Ranges

Configure Service Name_A: Layer 3, select 'protocol' is TCP (UDP), Source Ports/Destination ports: 2300-6000, 440,443,2100

Configure Service Name_B: Layer 3, select 'protocol' is TCP (UDP), Source Ports/Destination ports: 2300-6000,6443,7447,300-600

On the ESXi host:

This log shows that the Firewall publishing is failing on the ESXi host:
/var/log/vmkernel.log

2020-08-01T00:08:24.797Z cpu0:1068617)VSIPConversionCreateRuleSet: Cannot insert #1 rule 1294: 22
2020-08-01T00:08:24.798Z cpu0:1068617)VSIPConversionCreateRuleSet: Cannot insert #1 rule 1294: 22
2020-08-01T00:08:24.799Z cpu0:1068617)VSIPConversionCreateRuleSet: Cannot insert #1 rule 1294: 22
2020-08-01T00:32:36.979Z cpu0:1068617)VSIPConversionCreateRuleSet: Cannot insert #1 rule 1294: 22

Example 2: Without Overlapping Ranges

This example demonstrates the situation where there are two services. The first one (Name_A) having a port range (1-10) and the second (Name_B) having a port range (100-200) which will be misinterpreted as a list of ports. 
 

Configure Service Name_A: Layer 3, select 'protocol' is TCP (UDP), Source Ports/ Destination ports: 1-10, 5, 20.

Configure Service Name_B: Layer 3, select 'protocol' is TCP (UDP), Source Ports/ Destination ports: 100-200, 500.

The resulting rule on the host will be 1-10, 5, 20, 100, 200, 500. The ports between the range 100-200 (101-199) is not set. 

Resolution

This is a known issue with VMware NSX Data Center for vSphere 6.4.7. The issue is resolved with VMware NSX Data Center for vSphere 6.4.8.

Workaround:
Create firewall rule with only 1 service profile, add additional rules for each additional service profile or raw port-protocol set.

Additional Information

Impact/Risks:
DFW Firewall rule publish operation will fail on all DFW enabled ESXi hosts.

Or

Rules realized on host may have missing service ports without warning/ log message.