Alarm for GeoIP bundle sync failure

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Firewall
• VMware NSX Firewall

Issue/Introduction

Event ID: geoip.bundle_sync_error

Added in release: 9.0.0

Alarm Description

• Purpose: Failure to sync the GeoIP bundle
• Impact: The GeoIP bundle is used to determine the country that an IPv4 address belongs to. Outdated GeoIP bundle might result in incorrect IP country categorization and inaccurate Geo traffic could be allowed or denied.

Environment

VMware NSX Data Center 9.0

Cause

• Internet connectivity issue between NSX manager and NTICS.
• Invalid license to download GeoIP bundle.

 

Resolution

Important: The feature covered in this KB is owned by the ANS division. For cases matching this KB, transfer or clone the case to the ANS division. Do not suggest workarounds, recommend upgrades, or link this KB to the case without ANS TSE sign-off.
Support Product: VMware vDefend Firewall | Component: Distributed Firewall

 

Check if there is a valid license to download GeoIP bundle from NTICS. This can be checked on the NSX Manager UI by going to the System > Licenses page.

With valid licenses in place, use the UI to manually trigger GeoIP bundle download. If the error persists, please ensure that there is internet connectivity from NSX Manager to NTICS by issuing the following API:

POST https://api.nsx-sec-prod.com/1.0/auth/register

{

license_keys:[XXXXX-XXXXX-XXXXX-XXXXX],

device_type:NSX-Edge,

client_id: client_username

}

To temporarily disable the alarm, the user can turn off auto download of GeoIP bundle.

Additional Information

Maintenance window required for remediation?
No