Publishing a firewall rule after configuring layer2RuleOptimize set to FALSE through API fails in NSX-v
search cancel

Publishing a firewall rule after configuring layer2RuleOptimize set to FALSE through API fails in NSX-v

book

Article ID: 336638

calendar_today

Updated On:

Products

VMware vDefend Firewall

Issue/Introduction

Symptoms:
After configuring layer2RuleOptimize to FALSE using API https://NSXMGR_IP/api/4.0/firewall/config/globalconfiguration, you see these symptoms:

  • Publishing a firewall rule fails.
  • In the vsfwd.log file, you see entries similar to:

    2018-01-11T00:00:25Z vsfwd: [INFO] Received vsa message of GlobalConfiguration, length 8
    2018-01-11T00:00:25Z vsfwd: [INFO] gVsaMsgCount 1
    2018-01-11T00:00:25Z vsfwd: [INFO] Processing vsa message of GlobalConfiguration, length 8
    2018-01-11T00:00:25Z vsfwd: [INFO] Change global config - L3 rule optimization: on
    2018-01-11T00:00:25Z vsfwd: [INFO] Saved global config file /etc/vmware/vsfwd/vsip_global_config.dat
    2018-01-11T00:00:25Z vsfwd: [INFO] Applied global config
    2018-01-11T00:00:27Z vsfwd: [INFO] Received vsa message of RuleSet, length 1619
    2018-01-11T00:00:27Z vsfwd: [INFO] gVsaMsgCount 1
    2018-01-11T00:00:27Z vsfwd: [INFO] Processing vsa message of RuleSet, length 1619
    2018-01-11T00:00:27Z vsfwd: [INFO] Free existing ruleset config
    2018-01-11T00:00:27Z vsfwd: [WARN] ruleset action is not replace: 3
    2018-01-11T00:00:27Z vsfwd: [INFO] L2 rule optimization is enabled
    2018-01-11T00:00:27Z vsfwd: [INFO] loaded ruleset
    2018-01-11T00:00:27Z vsfwd: [INFO] L3 rule optimization is enabled
    2018-01-11T00:00:27Z vsfwd: [INFO] Applied shared addrsets of gen number 1515621648594
    2018-01-11T00:00:27Z vsfwd: [INFO] Applying firewall config to vnic list on host host-21
    2018-01-11T00:00:27Z vsfwd: [INFO] Applied RuleSet 1515621648594 on vnic ########-####-####-####-########4091.000
    2018-01-11T00:00:27Z vsfwd: [INFO] Applied RuleSet 1515621648594 on vnic ########-####-####-####-########2029.000
    2018-01-11T00:00:27Z vsfwd: [INFO] Applied RuleSet 1515621648594 for all vnics
    2018-01-11T00:00:27Z vsfwd: [INFO] Compressed config data from 1619 to 558 bytes
    2018-01-11T00:00:27Z vsfwd: [INFO] Successfully saved config to file /etc/vmware/vsfwd/vsipfw_ruleset.dat
    2018-01-11T00:00:27Z vsfwd: [INFO] loaded addrset
    2018-01-11T00:00:27Z vsfwd: [INFO] Config data of 19 bytes was not compressed
    2018-01-11T00:00:27Z vsfwd: [INFO] Successfully saved config to file /etc/vmware/vsfwd/vsipfw_ruleset.dat_update
    2018-01-11T00:00:27Z vsfwd: [INFO] cleanup protobuf
    2018-01-11T00:00:27Z vsfwd: [INFO] cleanup protobuf
    2018-01-11T00:00:27Z vsfwd: [INFO] Sending vsa reply of domain-c19 host host-21: 0


    Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.



Environment

VMware NSX-T Data Center for vSphere 6.4.x

Cause

This issue occurs due to the NSX Manager failing to re-publish rule immediately after making a global config change to layer2RuleOptimize through an API call.

Resolution

This issue is resolved in VMware NSX-T Data Center for vSphere 6.4.2.

Workaround:
To work around this issue, perform a force sync. For more information, see the Force Sync Distributed Firewall Rules section of the NSX Administration Guide.