No Recommendation being seen for flows on NSX Intelligence/Security-Intelligence

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Firewall

Issue/Introduction

No Recommendation being seen  for flows for NSX Intelligence.                       

Cause

- May be flows are not hitting the default rule.
- Flow tables are not updated on the NSX DB
- DFW rules are not applied on the VM(s) across the hosts.
- VIF information is missing on the NSX-manager.

Resolution

 Resolution/ Explanation
- Recommendation are based on the flows that hit the default rule, these would be seen under Visualization with flows marked as red-dotted line.
- Recommendation would consider flows hitting default rule would be marked "unprotected" flow(s) and would need rules to be created to protect the flows. ( the same applies even for uni-directional flows)
-  Only scope side of the flow(vm belong to the recommendation context input) will be evaluated, and if that side hit default rule, then the flow will be considered.
- If the system only has protected flows, where flows are hitting rules with source group and destination-group( not "any"/"any") then "no recommendation available" would be seen.
- Broadcast/Multicast flows won't be considered, and the actual flow action can be protected or unprotected.

 

If it is believed certain flows are to be considered by recommendation however none seen.(i.e., No Recommendation available)
 1)  check if there is flows marked 'RED" under visualization ( NOTE:- "No recommendations" for Flows marked "GREEN")
 2)  Note the flow details -  Source vm-uuid, Destination vm-uuid, dst-port

 

1) On Esxi host

# nsxcli -c get intelligence flows config
# nsxcli -c get intelligence flows stats

# nsxcli -c get intelligence flows stats ack

Please Open Service request with Broadcom to further assist in resolving the issue.