"Service Router Limit Per Edge Exceeded" Alarm and "No Gateway Found " when attempting to change the Gateway Firewall Settings
search cancel

"Service Router Limit Per Edge Exceeded" Alarm and "No Gateway Found " when attempting to change the Gateway Firewall Settings

book

Article ID: 388145

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • The issue is likely to appear after an upgrade to NSX 4.x.
  • An alarm regarding "Service Router Limit Per Edge Exceeded" is raised
  • Navigate to the 'Security -> Gateway firewall -> Settings -> Gateways specific Settings' in the NSX Manager UI results in the page reporting "No Gateway Found".

Environment

VMware NSX

Cause

  • The NSX UI fails to display available Tier-0 (T0) Gateways when one or more T0 gateways are missing the T0SecurityConfig feature array.

  • When a T0 gateway returns a blank or empty T0SecurityConfig configuration, the UI is unable to properly parse it. The UI expects the T0SecurityConfig object to contain a feature attribute, and its absence prevents the gateway from being displayed in the interface.

Resolution

  • A fix is planned in a future release.
  • To permanently resolve the "Service Router Limit Per Edge Exceeded" alarm, the Gateway Firewall needs to be disabled. Disabling the Gateway Firewall is not possible via UI because of the "No Gateways Found" issue, hence, that needs to be performed via APIs. 
    1. Take nsx-manager backup.
    2. Run the following API: GET https://{{gmhost}}/policy/api/v1/global-infra/tier-0s/. 
    3. Copy the response.
    4. In the response, update "disable_firewall" to "true".
    5. Run the following API with the updated response as a body: PATCH https://{{lmhost}}/policy/api/v1/global-infra/tier-0s/
    6. Run the API GET https://{{gmhost}}/policy/api/v1/global-infra/tier-0s/. 
    7. Verify "disable_firewall" to confirm if its disabled.
  • In order to permanently resolve the "No Gateways Found issue", we need to fix the T0 SecurityConfig array:
    1. Identify the T0 gateway with no feature array. 
    2. Once the gateway(s) have been identified, delete and recreate the gateways. 
    3. This will generate a gateway with the correct T0SecurityConfig array.

Additional Information

For assistance identifying the T0 gateway with no feature array, engage NSX Support and refer to these articles:

Powered by Wolken Software