"File Extraction Service Unreachable" alarm for "Malware Prevention" feature is in open state

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

"File Extraction Service Unreachable" alarm for "Malware Prevention" feature is in open state on ESX host with no guest VMs for protection.

On NSX Manager 

"Service Malware Prevention is degraded on <transport_node_name_or_ip>. Unable to communicate with file extraction functionality. All file extraction abilities on the <transport_node_name_or_ip> are paused."

This issue may be seen  typically  after manual reset of Malware Prevention Service VM from VCenter

Environment

All versions of NAPP / SSP

Cause

After hard reset of the SVM, nsx-context-mux component on the ESX host does not detect loss of connection as there are no protected guest VMs on the host sending events to the SVM.

Resolution

This issue auto resolves typically within 2 hours when stale connections are cleaned up on the ESX host and mux establishes new connection with the SVM.

The alarm may also trigger when the ESX host enters or exits maintenance mode. During maintenance, when vMotion is triggered, the SVM may be powered off and later powered back on. This can cause the same "File Extraction Service Unreachable" alarm, which will resolve itself within 120 minutes as the system cleans up stale connections.