During upgrade, when existing DFW flows are migrated from 3.2.X to 4.2.X the flows are not classified correctly resulting in matching incorrect rules.

Products

• VMware vDefend Firewall

Issue/Introduction

VMware NSX upgrade is in place.

VMware vDefend Firewall is deployed and L7 firewall rules are in place.

During ESXi upgrade when VMs are vMotioned to upgraded hosts, some L7 traffic does not match correct rules.

Environment

VMware NSX 4.2.X.

VMware vDefend Firewall.

Cause

This is due to an AppID translation problem with the ruleset on the upgrade dvfilter.

Resolution

This is an known issue impacting VMware NSX 4.2.X as there is currently no fix.

New flows after the migration will not be impacted.