NSX API endpoint POST: /policy/api/v1/infra/domains/default/security-policies/?action=revise&anchor_path=&operation=insert_after for adding security policies to DFW order not guaranteed in NSX GUI when called parallelly.

Products

• VMware NSX

Issue/Introduction

Calling API endpoint POST: /policy/api/v1/infra/domains/default/security-policies/?action=revise&anchor_path=&operation=insert_after  may fail with error Exception *ConcurrentUpdateException* sometimes.

Similar error can be found in /var/log/proton/nsxapi.log

Error in API /nsxapi/api/v1/infra/domains/default/security-policies/f51bdf51-gf23-4cf0-2r1b-2251b5c96f9c?action=revise&anchor_path=%2Ftest%2Fpolicy%2Fdefault%2Fsecurity-policy%2F122eb090-gcc1-5g0e-9b2f-bb7578cfce1e&operation=insert_after caused by exception com.vmware.nsx.management.container.exceptions.ConcurrentUpdateException: {"moduleName":"common-services","errorCode":603,"errorMessage":"The object was modified by somebody else. Please retry.","details":"Operation failed because of conflicting transaction. Transaction ID: dd2583bb-7b61-5bd4-b79c-c2b3e235d2g4 Address: 41658826","errorData":{"STREAM_ID":"89c1ac25-####-####-####-b9e3fc8a7d08","CONFLICT_VALUE":"java.lang.Error: Unable to find the corresponding key","CONFLICT_KEY_HASH":"4050976643143975511","CONFLICT_KEY":"string_id: "/infra/domains/default/security-policies/f51bdf51-gf23-4cf0-2r1b-2251b5c96f9c"
","MAP_NAME":"89c1ac25-####-####-####-b9e3fc8a7d08","TRANSACTION_ID":"dd2583bb-####-####-####-c2b3e235d2g4","OFFENDING_ADDRESS":"41658826"}

Environment

VMware NSX-T Data Center
VMware NSX

Cause

The above exception is expected if we are run the POST API /policy/api/v1/infra/domains/default/security-policies/?action=revise&anchor_path=&operation=insert_after in parallel as this could lead to update the sequence number of same policy at the same time which leads to order not guarantee. Revising all polices in parallel could impact the order as all requests will try to re-order all other security policies internally which will lead to race condition.

Resolution

To achieve right order is either provide valid sequence number in a request or retry the requests.

Additional Information