vMotion from an NSX-T to NSX-v environment fails with DFW in use.

Products

• VMware NSX

Issue/Introduction

• NSX-T VMs that participate in the NSX-T DFW (Distributed Firewall) are vMotioned to an NSX-v environment.
• While the vMotion is successful, the VM is found to be unreachable from any other VMs. 
• Entries similar to the below will be observed on the destination ESXi host for the vMotion in /var/run/log/vmkernel.log:

  cpu57:2098201)Importing nic-#######-eth0-vmware-sfw.2, Version 1100
  cpu57:2098201)unsupported version: 1100
  cpu57:2098201)Failed to restore datapath state : Limit exceeded
  cpu57:2098201)DVFilter: 1324: No unrestored state left, freeing pending state for world #######
  cpu57:2098201)DVFilter: 1340: Bringing down port due to failed DVFilter state restoration and failPolicy of FAIL_CLOSED.

• Placing the impacted VM in the NSX-v DFW Exclusion List following the vMotion does not resolve the issue with entries on the ESXi host similar to the below observed in var/run/log/vmkernel.log:

  cpu57:2098201)Destroyed filter: nic-#######-eth0-vmware-sfw.2
  cpu60:7901657)Failed to find filter nic-#######-eth0-vmware-sfw.2

• Disconnecting and reconnecting the impacted VMs vNIC restores connectivity. 

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Cause

You cannot migrate workload VMs from NSX-T to NSX-v that participate in the NSX-T DFW.

Resolution

This is a condition that may occur in a VMware NSX environment.

Workaround

Place the VM in the NSX-T DFW Exclusion List prior to the NSX-v to NSX-T vMotion. 

Additional Information

NSX 4.2 Migration Guide