Migration Coordinator fails to migrate DFW rules applied on NSX Edge to T1 Gateway Firewall

Products

• VMware NSX
• VMware NSX Firewall
• VMware NSX-T Data Center

Issue/Introduction

V2T migration With BYOT is fails during CONFIG_TRANSLATION_L3_L7 by choking on the number of DFW rules:

Config migration failed [Reason: HTTP Error: 400: GatewayPolicy path=[/infra/domains/default/gateway-policies/HOFDNCLT0EGINTCHSA01-V2T-DFW-Pre-Rule] has more than 1,000 allowed rules for url: http://localhost:7440/nsxapi/api/v1/infra/domains/default/gateway-policies/HOFDNCLT0EGINTCHSA01-V2T-DFW-Pre-Rule/rules/3244-V2T-DFW-Pre-Rule]

Environment

VMware NSX-T Data Center
VMware NSX-T Data Center 3.x
VMware NSX-T Data Center 4.x

Cause

- Existing code logic doesn't split the DFW rules which are applied on Edges

- There's a limit of 1000 rules for Policy API and same can be seen in cm.log

2024-10-21 10:56:52,240 308858 CM.clients.base_client ERROR  Failed to PATCH >http://localhost:7440/nsxapi/api/v1/infra/domains/default/gateway-policies/HOFDNCLT0EGINTCHSA01-V2T-DFW-Pre->Rule/rules/3244-V2T-DFW-Pre-Rule with status: 400 and reason: {   "httpStatus" : "BAD_REQUEST",   "error_code" : >500230,   "module_name" : "Policy",   "error_message" : "GatewayPolicy path=[/infra/domains/default/gateway->policies/HOFDNCLT0EGINTCHSA01-V2T-DFW-Pre-Rule] has more than 1,000 allowed rules” }

Resolution

• Please log a ticket with support to implement the workaround steps
• Fix is in 4.2.2

Note: The current fix is effective for DFW sections with fewer than 1,000 rules applied on a Edge in NSX-V