NSX-T Data Center Capacity Dashboard generates false alarm for Total Gateway Firewall rules

Products

• VMware vDefend Firewall

Issue/Introduction

• You are using NSX-T 3.X or 4.X
• You have received a similar alarm to the one below in the NSX-T UI
• When you run the  API GET https://<nsxmanagerIP>/policy/api/v1/infra/capacity/dashboard/usage you may see a similar output with the maximum_supported_count being 4000

            "usage_type": "NUMBER_OF_GATEWAY_POLICY",

            "display_name": "System wide Total Gateway Firewall Rules",

            "current_usage_count": 6000,

            "max_supported_count": 4000,

            "min_threshold_percentage": 70.0,

            "max_threshold_percentage": 100.0,

            "current_usage_percentage": 189.75,

            "severity": "CRITICAL"

        },

• You may see similar logging reporting the alarm seen in the UI on the NSX Manager in /var/log/syslog

 

2024-05-21T10:16:59.749Z NSX-Manager-1 NSX 14571 MONITORING [nsx@6876 alarmId="33a33369-0c2c-49f8-84c8-c47be64be7b1" alarmState="ACKNOWLEDGED" comp="nsx-manager" entId="5be62df8-bc24-32e2-ba00-69a5c0ba3adb" errorCode="MP701099" eventFeatureName="capacity" eventSev="HIGH" eventState="On" eventType="maximum_capacity_threshold" level="ERROR" nodeId="1abda63c-f4e3-4964-87fe-732ccb889eab" subcomp="monitoring"] The number of objects defined in the system for System wide Total Gateway Firewall Rules has reached 6000 which is above the maximum capacity threshold of 100.0%.

• As per the Maximums guide for a large NSX Manager the System Wide Total Gateway Firewall Rules should be 55K

 

Environment

VMware NSX-T Data Center

Cause

This alarm is caused when the Maximum capacity of 4000 is hit in the NSX-T Manager. However, this is a mismatch as it Maximum capacity should be 55,000 as per  Maximums guide.

This is a false alarm and can be ignored.

Resolution

This issue is resolved in NSX-T version 3.2.4 and NSX-T version 4.1.1