Host Profile remediation fails or custom firewall rulesets are not saved in vSphere
search cancel

Host Profile remediation fails or custom firewall rulesets are not saved in vSphere

book

Article ID: 342622

calendar_today

Updated On:

Products

VMware vCenter Server VMware vSphere ESXi

Issue/Introduction

In VMware vSphere environments, firewall rulesets for dynamic or non-default services are not saved or applied when extracting or applying a Host Profile.

Symptoms include:

  • Custom firewall rules or modified allowed IP address ranges are not extracted from a reference host into a Host Profile.

  • Applying a Host Profile containing custom firewall rules fails to apply those rules to target hosts, reverting allowed IP address ranges to default (allowing all IP addresses).

  • Host Profile remediation fails with the error message: rule already exists.



Environment

VMware vCenter Server 
VMware ESXi 

Cause

This behavior is by design. Specific firewall rulesets are explicitly ignored by the Host Profile compliance engine (IGNORED_FIREWALL_RULESETS) because they are dynamically managed by their underlying system services rather than static host profiles. These ignored rulesets include: 

  • iSCSI
  • nfsClient
  • fdm
  • faultTolerance
  • vpxHeartbeats
  • netDump
  • autodeploy
  • vit
  • ipv6spy
  • iofiltervp
  • rdt
  • cmmds
  • vsanvp
  • vsanEncryption
  • ntpClient
  • vsanhealth-unicasttest
  • dynamicruleset
  • bfdDP
  • 'bridgeHA
  • 'hyperbus
  • nsx-mpa
  • nsx-opsagent
  • nsxMPAPI
  • nsxProxyRule
  • nsx-sha-tsdb
  • nsxRMQ
  • spherelet
  • vShield-Endpoint-Mux
  • vShield-Endpoint-Mux-Partners
  • trusted-infrastructure-kmxa
  • trusted-infrastructure-kmxd
  • nsxOverlay
  • etcdClientComm
  • etcdPeerComm
  • nsxIntel
  • netopa
  • CIMHttpsServer

 

Resolution

If stale firewall rule entries prevent Host Profile application or remediation with the error rule already exists, reset the firewall kernel module state on the affected ESXi host:

  1. Log in to the affected ESXi host via SSH or ESXi Shell as root.

  2. Unload the firewall engine to clear stale firewall entries:

    esxcli network firewall unload

  3. Load the firewall engine to re-initialize active rulesets:

    esxcli network firewall load

  4. Re-evaluate host compliance and apply the Host Profile from vCenter Server.

Additional Information

 

  • Standard firewall rulesets not listed in the ignored ruleset array can still be managed directly via Security and Services > Firewall configuration within the Host Profile editor.

  • Refer to Broadcom documentation for detailed information on host profile configuration:  vSphere Host Profiles

 

Powered by Wolken Software