vMotion port 8000 blocked after ESXi host firewall rule change

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

• vMotion fails at 20%
• TCP 8000 is confirmed open between source and destination host on the physical network.
• UI shows Error: Connection closed by remote host, possibly due to timeout.
• Disabling the host(s) firewall results in successful vMotion.
• vMotion ESXI host firewall rule has vMotion IPs or all IPs allowed.
• ESXi hosts are installed using a Dell custom image.

Environment

VMware vSphere ESXi

VMware vCenter Server

Cause

In Host CLI 'esxcli network firewall ruleset' list shows a rule named and host firewall rules in the GUI shows a rule named 'daemon-dellism' which includes tcp port 8000 and allowed IPs don't include vMotion IPs.

Rule daemon-dellism is blocking port 8000 since the vMotion IPs are not in the list.

Resolution

Include vMotion IPs in the daemon-dellism allowed IP list.