"This API is not supported as is deactivated in ALB." error when querying NSX DFW rules with a group

Products

VMware NSX

Issue/Introduction

In the NSX UI Security > Distributed Firewall > Category Specific Rules, click in 'Filter by Name, Path and more' and select Source > Source > Groups and select a group and click apply, then the following error is displayed on the NSX UI:

ERROR: General error has occured. java.util.concurrent.ExecutionException: org.springframework.web.client.RestClientResponseException: {"error":"This API is not supported as is deactivated in ALB."}

The Advanced load balancer was deployed some time in the past, but has since been removed from NSX.
The NSX manager log, /var/log/proton/nsxapi.log shows the same error:

ERROR: General error has occured. java.util.concurrent.ExecutionException: org.springframework.web.client.RestClientResponseException: {"error":"This API is not supported as is deactivated in ALB."}

Environment

VMware NSX

Cause

This issue can occur when the Advanced Load balancer is removed from NSX, some components can remain in the NSX database.

From VMware NSX 4.1.1 onwards, some ALB integration features were removed, this lead to some stale objects remaining.
Please refer to the following KB for more detail on the ALB deprecation: Deprecation Announcement of NSX-T ALB Policy API and UI

Resolution

If you believe you have encountered this issue, please open a support case with Broadcom Support and refer to this KB article.

For more information, see Creating and managing Broadcom support cases.

The stale entries are in the internal corfu database, Broadcom support is required to edit/remove these entries.

Additional Information

A similar issue with stale ALB objects is described in this KB NSX UI is not loading, showing a "Search index is out of sync for Generic Policy realized Resource" error."

When opening the NSX support case, please provide the following information.

Log into one of the NSX Manager nodes as the root user and execute the following commands to capture the current state:

Navigate to the root directory:
```
cd /root/
```

Dump the relevant Corfu database tables:

/opt/vmware/bin/corfu_tool_runner.py -o showTable -n nsx -t ALBControllerAdminCreds >> ALBControllerAdminCreds.dump/opt/vmware/bin/corfu_tool_runner.py -o showTable -n nsx -t GenericPolicyRealizedResource >> GenericPolicyRealizedResource.dump/opt/vmware/bin/corfu_tool_runner.py -o showTable -n nsx -t Alarm >> Alarm.dump

Export the ALB Enforcement Point API data:

curl -k -u admin https://localhost/policy/api/v1/infra/sites/default/enforcement-points/alb-endpoint > alb-endpoint.api

Upload all four files to your Broadcom Support case for verification.