Cannot disable the NSX distributed firewall (DFW) on a host in VMware NSX for vSphere 6.x
search cancel

Cannot disable the NSX distributed firewall (DFW) on a host in VMware NSX for vSphere 6.x

book

Article ID: 341213

calendar_today

Updated On:

Products

VMware NSX Networking

Issue/Introduction

Symptoms:
  • Cannot change the NSX Distributed Firewall (DFW) status from enabled to disabled or from disabled to enabled on a cluster prepared by NSX loaded with the DFW VIB.
  • After clicking the disabled link and refreshing the NSX User Interface (UI), the cluster status remains as enabled
  • When you run the show log command on the NSX Manager console, you see entries similar to:

    2015-07-16 20:23:09.192 GMT INFO http-nio-127.0.0.1-7441-exec-309 FirewallUIFacade:798 - Calling enable[false] cluster API...
    2015-07-16 20:23:09.195 GMT INFO http-nio-127.0.0.1-7441-exec-309 FirewallServiceImpl:2562 - Enable firewall[false] called for cluster[domain-c7]
    2015-07-16 20:23:09.204 GMT INFO http-nio-127.0.0.1-7441-exec-309 FirewallServiceImpl:2572 - Firewall is already disabled on {}

    Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.


Environment

VMware NSX for vSphere 6.2.x
VMware NSX for vSphere 6.1.x
VMware NSX for vSphere 6.3.x

Cause

This issue occurs when the Distributed Firewall (DFW) is enabled on some hosts and disabled on other hosts on the cluster.

Note: Changing the firewall status at the host level is not supported, and the User Interface (UI) correctly disallows this operation.

Disabling the NSX Distributed Firewall fails at the cluster level when the firewall functionality has been disabled on at least one host in the same cluster using REST API.

NSX does not automatically enforce the cluster-level status on newly added hosts. For example, if a host is added to an NSX prepared cluster with the DFW configured to be disabled, the host will have the firewall enabled.

Resolution

This issue is resolved in NSX for vSphere 6.2.2, available at VMware Downloads.

To work around this issue if you do not want to upgrade, use this REST API call to enforce the same firewall status across all ESXi hosts in the cluster.

Method: PUT
URL: https://nsxmgr-ip/api/4.0/firewall/domainID/enable/true|false

Note: Replace the domainID field with the Cluster ID of the cluster which has the firewall disabled.

For example:

PUT https://10.138.8.243/api/4.0/firewall/domain-c23/enable/true

For more information on how to make API calls to the NSX manager, see the Using the NSX REST API section of the VMware NSX for vSphere API Guide.

Note: Ensure to enable the firewall settings on the host before adding a new host to NSX prepared cluster.


Additional Information

Use this REST API call to confirm the host preparation status.

Note: The ESXi host must be prepared for NSX and have the DFW VIB installed.

https://<nsxmgr-ip>/api/2.0/nwfabric/status?resource=host-25

<?xml version="1.0" encoding="UTF-8"?>
<resourceStatuses>
<resourceStatus>
<resource>
<objectId>host-25</objectId>
<objectTypeName>HostSystem</objectTypeName>
<vsmUuid>421B3F36-48E2-F7A8-367A-249BB1B5807F</vsmUuid>
<revision>505</revision>
<type>
<typeName>HostSystem</typeName>
</type>
<name>10.155.5.31</name>
<scope>
<id>domain-c7</id>
<objectTypeName>ClusterComputeResource</objectTypeName>
<name>VC1-Cluster</name>
</scope>
<clientHandle></clientHandle>
<extendedAttributes/>
</resource>
<hostRebootRequired>false</hostRebootRequired>
<nwFabricFeatureStatus>
<featureId>com.vmware.vshield.firewall</featureId>
<featureVersion>5.5</featureVersion>
<updateAvailable>false</updateAvailable>
<status>GREEN</status> <===== DFW status
<installed>true</installed>
<enabled>true</enabled>
</nwFabricFeatureStatus>


Starting with NSX for vSphere releases 6.1.5 and 6.2.0, the cluster-level feature status reflects the status of its member hosts. In the following example output, the cluster (domain-c7) status is set to GREY, indicating that at least one member host has the DFW disabled.

GET on https://10.160.85.4/api/2.0/nwfabric/status?resource=domain-c7

<?xml version="1.0" encoding="UTF-8"?>
<resourceStatuses>
<resourceStatus>
<resource>
<objectId>domain-c7</objectId>
<objectTypeName>ClusterComputeResource</objectTypeName>
<vsmUuid>42135FC9-F7AE-2259-6358-77207692323F</vsmUuid>
<revision>5</revision>
<type>
<typeName>ClusterComputeResource</typeName>
</type>
<name>Cluster-1</name>
<scope>
<id>datacenter-2</id>
<objectTypeName>Datacenter</objectTypeName>
<name>Datacenter</name>
</scope>
<clientHandle></clientHandle>
<extendedAttributes/>
</resource>
<hostRebootRequired>false</hostRebootRequired>
<nwFabricFeatureStatus>
<featureId>com.vmware.vshield.vsm.vdr_mon</featureId>
<featureVersion>5.5</featureVersion>
<updateAvailable>false</updateAvailable>
<status>UNKNOWN</status>
<installed>false</installed>
<enabled>true</enabled>
</nwFabricFeatureStatus>
<nwFabricFeatureStatus>
<featureId>com.vmware.vshield.vsm.vxlan</featureId>
<featureVersion>5.5</featureVersion>
<updateAvailable>false</updateAvailable>
<status>UNKNOWN</status>
<installed>false</installed>
<enabled>true</enabled>
</nwFabricFeatureStatus>
<nwFabricFeatureStatus>
<featureId>com.vmware.vshield.firewall</featureId>
<updateAvailable>false</updateAvailable>
<status>GREY</status>
<installed>true</installed>
<enabled>false</enabled>
</nwFabricFeatureStatus>

<nwFabricFeatureStatus>
<featureId>com.vmware.vshield.vsm.nwfabric.hostPrep</featureId>
<featureVersion>6.1.5</featureVersion>
<updateAvailable>false</updateAvailable>
<status>GREEN</status>
<installed>true</installed>
<enabled>true</enabled>
</nwFabricFeatureStatus>
<nwFabricFeatureStatus>
<featureId>com.vmware.vshield.vsm.messagingInfra</featureId>
<updateAvailable>false</updateAvailable>
<status>GREEN</status>
<installed>true</installed>
<enabled>true</enabled>
</nwFabricFeatureStatus>
</resourceStatus>
</resourceStatuses>


To be alerted when this document is updated, click the Subscribe to Article link in the Actions box.
在 VMware NSX for vSphere 6.x 中,无法在主机上禁用 NSX Distributed Firewall (DFW)