Service Router Limit Per Edge Exceeded alarm even when the support limit has not reached in NSX 4.2.3.1

Products

• VMware NSX

Issue/Introduction

• Gateway Firewall is enabled.
• Following alarm message is being generated in NSX UI:

 

The number of T0/T1 Service routers 4 or bridges 0 with Gateway Firewall feature enabled on edge XXX-XXX-XXX-XXX-XXX has exceeded the maximum threshold of 98%. Maximum number of Service routers and bridges supported with Gateway Firewall feature enabled is 5.

 

• /var/log/syslog showing the following log snippets:

 

YYYY-MM-DDTHH:MM:SS.983Z YYYYYYYYYYY NSX 10886 - [nsx@6876 comp="nsx-edge" s2comp="nsx-monitoring" entId="XXX-XXX-XXX-XXX-XXX" tid="11026" level="WARNING" eventState="On" eventFeatureName="gateway_firewall" eventSev="warning" eventType="service_router_limit_per_edge_approaching"] The number of T0/T1 Service routers 4 or bridges 0 with Gateway Firewall feature enabled on edge XXX-XXX-XXX-XXX-XXX is approaching the maximum threshold of 90%. Maximum number of Service routers and bridges supported with Gateway Firewall feature enabled is 5.he number of T0/T1 Service routers 4 or bridges 0 with Gateway Firewall feature enabled on edge XXX-XXX-XXX-XXX-XXX is approaching the maximum threshold of 90%. Maximum number of Service routers and bridges supported with Gateway Firewall feature enabled is 5.

 

YYYY-MM-DDTHH:MM:SS.983Z YYYYYYYYYYY NSX 10886 - [nsx@6876 comp="nsx-edge" s2comp="nsx-monitoring" entId="XXX-XXX-XXX-XXX-XXX" tid="11026" level="FATAL" eventState="On" eventFeatureName="gateway_firewall" eventSev="critical" eventType="service_router_limit_per_edge_exceeded"] The number of T0/T1 Service routers 4 or bridges 0 with Gateway Firewall feature enabled on edge XXX-XXX-XXX-XXX-XXX has exceeded the maximum threshold of 98%. Maximum number of Service routers and bridges supported with Gateway Firewall feature enabled is 5.

Environment

VMware NSX 4.2.3.1 or below

Resolution

Pending fix in future release

 

Workaround:

If the alarm is triggered while your T0/T1/Bridge components with Gateway Firewall (GFW) enabled are operating within specified resource limits, take one of the following actions:

• Suppress or disable the alarm.