NSX-T Tags not getting replicated from primary site to recovery site using vsphere tag replication policy

Products

• VMware NSX Networking

Issue/Introduction

This is a known issue.

Symptoms:

• NSX-T Tag replication from primary site to recovery site using tag replication policy does not work, if VM is connected to a vCenter managed DVPG
• Affected versions of NSX-T : 3.2.0, 3.2.1, 3.2.2, 4.0.0, 4.0.1, 4.1.0
• Below exceptions will be seen in the logs.

 Relevant log’s location:

/var/log/nsx-ccp.log, or /var/log/syslog

2023-01-27T11:45:43.073Z WARN Owl-worker-13 ExecutorTask 3701 - [nsx@6876 comp="nsx-controller" level="WARNING" subcomp="owl"] Failed to process dataUpdate for listener ContainerEventsListenerNewImpl, error message: Invalid UUID string: 1587579992, error stack:java.lang.IllegalArgumentException: Invalid UUID string: 1587579992

  at java.util.UUID.fromString(UUID.java:194)

  at com.vmware.nsx.ccp.domain.entity.Vni.getLogicalPortAttachmentId(Vni.java:66)

  at com.vmware.nsx.ccp.federationsrm.cache.VmTagDrCache.lambda$buildVmEntityMsgs$2(VmTagDrCache.java:254)

 

 

Environment

VMware NSX-T Data Center

Cause

• DrVmTagMsg cannot be published to recovery sites due to the IllegalArgumentException, which interrupts the Falcon transaction in Federation-SRM app.

 

Resolution

• This is fixed with NSX-T 3.2.3 and in upcoming versions.

Workaround:
Step:1 - Identify all the VM's which are connected to DVPG from the NSgroups configured for tag replication using below API 

GET https://<global-manager-ip>/global-manager/api/v1/global-infra/vm-tag-replication-policies/<policy-id>

snippet:
 

GET https://<global-manager-ip>/global-manager/api/v1/global-infra/vm-tag-replication-policies/

{
    "result_count": 1,
    "results": [
        {
            "protected_site": "/global-infra/sites/XXXX",
            "recovery_sites": [
                "/global-infra/sites/XXXX"
            ],
            "vm_match_criteria": "MATCH_BIOS_UUID_NAME",
            "groups": [
                "/global-infra/domains/default/groups/test1"
            ],
            "resource_type": "VMTagReplicationPolicy",
            "id": "policy1", <<<<< this is the policy-id >>>>>
            "display_name": "vm tag replication policy test",
            "description": "vm tag replication policy1",
            "path": "/global-infra/vm-tag-replication-policies/policy1",
            "relative_path": "policy1",
            "parent_path": "/global-infra",
            "unique_id": "XXX-eada-4849-a77c-XXX",
            "marked_for_delete": false,
            "overridden": false,
            "_create_time": 1670581076492,
            "_create_user": "admin",
            "_last_modified_time": 1670581076492,
            "_last_modified_user": "admin",
            "_system_owned": false,
            "_protection": "NOT_PROTECTED",
            "_revision": 0
        }
    ],
    "sort_by": "display_name",
    "sort_ascending": true
}

Step: 2- Move the interface of VM's identified in step 1 to Virtual Standard Switch or NSX backed Logical Switch

 

Additional Information

Impact/Risks:

• Customers will observe that DrVmTagMsg is missing in recovery sites and thus the disaster-recovery policy applied on the VM won't work.