VMs on an affected host lose network connectivity post host reboot or exiting maintenance mode in NSX-v 6.4.7 or 6.4.8

Products

• VMware NSX

Issue/Introduction

Symptoms:
VMs moved to the affected host will lose network connectivity.

• Netcpa cannot connect to CCP on port 1234 after rebooting ESXi host.
• Netcpa.log has the following log message : "Error code: Connection timed out, system"

Environment

VMware NSX Data Center for vSphere 6.4.x

Cause

On a reboot of ESXi, undetermined situations (root cause in progress) may cause delay launching hostd before netcpa has attempted to restart.  When this happens, netcpa might not be able to establish connectivity with the controllers (SYN_SENT) due to the packets being dropped on the ESXi host firewall.

Resolution

This issue is fixed with NSX Data Center for vSphere 6.4.9 

Workaround:
After a reboot or bringing a host out of maintenance mode, run the following command:

   esxcli network firewall ruleset list -r netCP

If netCP = false, restart netCPA process by running command: 

/etc/init.d/netcpad restart