Alarm on guard rails for group-ipset association cache

Products

• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

• Alarm raised on guard rail hit due to in-memory cache used for group-ipset association lookup.
• Large number of unique IP address are causing high memory consumption in nsx-config pod due to increase in size of group-ipAddress association cache. Hence limiting the number of unique IP address that can be added to group-ipAddress association cache via guardrail. 

Environment

     SSP 5.1 onboarded to NSX 4.2.1 and above.

Cause

• The current unique IP address count is close to reaching or already reached the maximum threshold of unique IP addresses for group-ipAddress association cache.
• Once the limit is reached, further new IPsets won't get added to the cache.

Resolution

There are two possible remediations.

• Delete stale or unused IP address from the group using NSX UI/API.
• Use CIDRs instead of individual IPs which will help in reducing the number of unique IP addresses.