NSX alert "DFW Vmotion Failure" triggered after ESXi patching

Products

• VMware NSX

Issue/Introduction

• ESXi is patching from 7.x to 8.x.
• Alert "DFW Vmotion Failure" is appearing in the NSX Manager.
• Virtual machines are not able to vMotion:
  
  The DFW vMotion for DFW filter nic-**********-eth0-vmware-sfw.2 on destination host **** has failed and the port for the entity has been disconnected.
  
  
• The ESXi /var/run/log/vmkernel.log shows that DFW root table entries were lost:
  
  cpu46:2098014)pfr_attach_table: nic-2172581-eth1-vmware-sfw.2: ERROR ***************** local root table ####-####-####-####-#### not found
cpu46:2098014)pfr_attach_table: nic-2172581-eth1-vmware-sfw.2: ERROR ***************** local root table #### not found


• The ESXi /var/run/log/nsx-syslog.log shows packet loss between the NSX Manager and transport nodes:
  
  nestdb-server[2099701]: NSX 2099701 - [nsx@6876 comp="nsx-esx" subcomp="nsx-nestdb" s2comp="nsx-net" tid="2099715" level="INFO"] StreamConnection[21 Closing on tcp://0.0.0.0:2480 sid:21] Closing (reason: by peer)
nestdb-server[2099701]: NSX 2099701 - [nsx@6876 comp="nsx-esx" subcomp="nsx-nestdb" s2comp="nsx-net" tid="2099715" level="INFO"] StreamConnection[21 Closed on tcp://0.0.0.0:2480 sid:-1] Closed (reason: by peer, error: 2-End of file)
nestdb-server[2099701]: NSX 2099701 - [nsx@6876 comp="nsx-esx" subcomp="nsx-nestdb" s2comp="nsx-rpc" tid="2099715" level="INFO"] RpcConnection[21 Connected on tcp://0.0.0.0:2480 0] Closing (network error)

Environment

VMware NSX 4.2.0
VMware vSphere ESXi 7.x
VMware vSphere ESXi 8.x

Cause

DFW root table entries were lost due to packet loss between the NSX Manager and transport nodes.

Resolution

To resolve the issue, upgrade to NSX-T 4.2.1.
NSX-T 4.2.1 improves packet loss tolerance between NSX Manager and transport nodes. More information can be read from VMware NSX 4.2.1 Release Notes.