SSP: Can not generate Security Segmentation Report because of max report limit is reached

Products

• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Even though numbers of Security Segmentation Report is within the limit of maximum number of reports, when user tries to generate a new Security Segmentation Report, report generation is not allowed with error of "Max report limit is reached".

Locate the kubeconfig file for SSP on the SSPI appliance and execute the following from command prompt of SSPI

export KUBECONFIG=<kubeconfig-path-on-sspi>

From the SSPI , check the log of security-pov pod.  First get the pod name using below command

kubectl -n nsxi-platform get pods | grep security-pov

Check the security-pov log while generating the Security Segmentation Report as below

kubectl logs <security-pov-pod-name> -f

Log should show below lines in case of error

....   ERROR     .....   max report limit is reached    {"limit": 50}

Environment

Security Services Platform 5.0 (SSP 5.0)

Cause

When calculation of Security Segmentation Score is triggered or a Security Segmentation Report is generated, a background job is created to process the request.

If calculation of Security Segmentation Score is being triggered as soon as job related to calculation of previous Security Segmentation Score completes, then this may lead to race condition between creation of new job for Security Segmentation Score and clean up done on completion of previous job for Security Segmentation Score. Which results into stale entries for Security Segmentation Score job in SSP Postgres tables.

As the number of entires of job becomes more than expected numbers because of stale entries of Security Segmentation Score job , maximum report limit error is returned while generating a new Security Segmentation Report.

Resolution

Stale entries for Security Segmentation Score job need to be found and these stale entries needs to be deleted from relevant SSP Postgres database tables. Please contact SSP BROADCOM support team for further assistance.