VMware NSX for vSphere 6.x Distributed Firewall (DFW) is non-functional on an ESXi host

Products

• VMware vDefend Firewall

Issue/Introduction

^Symptoms:

• ^{Virtual machines migrated to an ESXi host are not firewalled and are accessible from systems that should be blocked.}
• ^{The VXLAN and Logical Distributed Router services are also experiencing failures on the ESXi host.}
• ^{Running the command esxcli software vib list | egrep "vxlan|vsip|switch-sec" fails to display any VIBs running.}
• ^{In the /var/log/esxupdate.log file on the ESXi host, you see entries similar to:}
  

  ^{YYYY-MM-DD esxupdate: imageprofile: INFO: Adding VIB VMware_bootbank_esx-vxlan_5.5.0-0.0.2318233 to ImageProfile (Updated) ESXi-5.5-1331820-RollupISO-standard}
  

  ^{YYYY-MM-DD esxupdate: imageprofile: INFO: Adding VIB VMware_bootbank_esx-vsip_5.5.0-0.0.2318233 to ImageProfile (Updated) ESXi-5.5-1331820-RollupISO-standard}
  

  ^{YYYY-MM-DD esxupdate: imageprofile: INFO: Adding VIB VMware_bootbank_esx-dvfilter-switch-security_5.5.0-0.0.2318233 to ImageProfile (Updated) ESXi-5.5-1331820-RollupISO-standard}
  

  ^{YYYY-MM-DD esxupdate: HostImage: WARNING: Failed to acquire lock: ('/var/run/esximg.pid', 'Error locking lock file: [Errno 11] Resource temporarily unavailable')}
  

  ^{YYYY-MM-DD esxupdate: esxupdate: ERROR: LockingError: Another process is updating the ESX image. Please try again later.}
  

  ^{YYYY-MM-DD esxupdate: esxupdate: DEBUG: <<<}

   

Environment

VMware NSX for vSphere 6.0.x
VMware NSX for vSphere 6.1.x
VMware NSX for vSphere 6.2.x

Cause

This issue occurs if the esx-vxlan, esx-vsip and esx-dvfilter-switch-security VIBs did not install correctly on the affected ESXi host.

Resolution

^{To resolve this issue:}

1. ^{Place the affected ESXi host on maintenance mode.}
2. ^{Reboot the ESXi host.}
3. ^{Move the ESXi host out of the NSX Prepared cluster.}
4. ^{Move the ESXi host back into the NSX Prepared cluster.}
5. ^{Verify the VIBs are correctly installed.} 

^{Try this instead of rebooting Esxi.}

^{Find out the process_id that is locking the file by running the following command:}

^{lsof | grep /var/run/esximg.pid}

^{kill -9 <process_id>}

Additional Information