Distributed Firewall (DFW) Policy Sequencing: Policies Out of Order After Publishing

Products

• VMware NSX
• VMware vDefend Firewall

Issue/Introduction

You are making policy and/or rule modifications both new and existing entries.  Publishing the changes takes a long time (one minute) to complete on NSX.  Upon reviewing the changes, some policies have been re-ordered and found to be in a new order, thus causing problems for proper processing of traffic. 

Environment

NSX 4.2.1.3

Cause

Background
Before publishing changes on DFW policy changes, the existing policy order is structured sequentially in increments of one. When a new policy is added in the list, that policy takes the sequence number of the previous one in its spot.  All those below the newly-added policy then get re-sequenced in increments of 10, thus allowing for more space, or "air gaps" between policies for future additions.   Air gaps will allow for future policy insertion without the need for re-sequencing, until all those unused sequence numbers eventually get used, which will then trigger a new re-sequencing event.

The cause of the issue occurred when some policies did not get re-sequenced, which resulted a wrong order of those policies across the entire DFW policy list.   
The root cause is not yet understood.

Resolution

This issue is currently not reproducible.

Workaround
Manually move policies back to their correct order or load the policy draft to revert the change.

Additional Information

One indication of re-sequencing may when the act of publishing changes takes longer than usual.

This is an example of policy re-sequencing, as found in nsxapi.log.  Here, the internal sequence number 60000003 is changed to 60000040.

2025-10-22T17:53:28.584Z  INFO http-nio-127.0.0.1-7440-exec-18 AbstractCommunicationMapServiceImpl 5984 POLICY [nsx@6876 comp="nsx-manager" level="INFO" subcomp="manager"] Only Precedence (Sequence No) of the policy /infra/domains/default/security-policies/POLICY_XYZ created by principal identity [email protected] is changed from 60000003 to 60000040.