Virtual Machines deployed from a template are unreachabe due to the distributed port ID being in a blocked state

Products

• VMware NSX

Issue/Introduction

• VMs deployed from a template are unreachable on the network due to their dvPort ID being in a "blocked" state. 
• The distributed port group(s) used by affected VMs have all security settings set to 'Reject' (Promiscuous Mode, MAC Address Changes, Forged Transmits) 
• The issue may only present itself on VMs deployed on a single host, or the issue may only present itself on one host at a time. 
• On the ESXi host with affected VMs, vmkernel.log shows similar messages to: 

2025-12-11T16:34:20.329Z In(182) vmkernel: cpu65:2618845 opID=2952520f)World: 12750: VC opID mei1j64s-5843768-auto-3h92x-h5:70603053-6b-01-19-e5a7 maps to vmkernel opID 2952520f

2025-12-11T16:34:20.329Z In(182) vmkernel: cpu65:2618845 opID=2952520f)FlowCache.fc: FC_ClearPortData:###: [nsx@6876 comp="nsx-esx"]Cleared portData on port 0x#######, portData :0x############

2025-12-11T16:34:20.329Z In(182) vmkernel: cpu65:2618845 opID=2952520f)FlowCache.fc: FC_PortCacheDisable:####: [nsx@6876 comp="nsx-esx"]FC Port Disable 0x#######

2025-12-11T16:34:20.329Z In(182) vmkernel: cpu65:2618845 opID=2952520f)FlowCache.fc: FCInvalidatePortEntity:###: [nsx@6876 comp="nsx-esx"]FC unref inval port 0x#######

2025-12-11T16:34:20.329Z In(182) vmkernel: cpu65:2618845 opID=2952520f)FlowCache.fc: DVSFCPropPortCleanup:####: [nsx@6876 comp="nsx-esx"]FC prop cleanup successful for port 0x#######

2025-12-11T16:34:20.329Z In(182) vmkernel: cpu65:2618845 opID=2952520f)NetPort: ####: disabled port 0x#######

2025-12-11T16:34:20.329Z In(182) vmkernel: cpu65:2618845 opID=2952520f)kcp: KCP_DeletePort:###: [nsx@6876 comp="nsx-esx" subcomp="kcp"]Port ######## is cleared and blocked

2025-12-11T16:34:20.329Z In(182) vmkernel: cpu65:2618845 opID=2952520f)Net: 3834: dissociate dvPort ########-####-####-####-############ from port 0x#######

2025-12-11T16:34:20.329Z In(182) vmkernel: cpu65:2618845 opID=2952520f)Net: 3841: disconnected client from port 0x#######

2025-12-11T16:34:20.330Z In(182) vmkernel: cpu51:2100209)Failed to get portset lock of port 0x########, error : Not found

2025-12-11T16:34:20.330Z In(182) vmkernel: cpu51:2100209)Failed to read config of filter nic-#######-eth0-vmware-sfw.2: Not found

2025-12-11T16:34:20.330Z In(182) vmkernel: cpu51:2100209)NetX DVF: refreshing SI filter (from IOCTL)

2025-12-11T16:34:20.330Z In(182) vmkernel: cpu51:2100209)NetX Classifier: VSIPNetXClassifierPFRegister for pfi: 0x###########, vsip_filter: 0x###########, port_store: 0x4327b9af49a8, classifier_store: 0x###########

 

Environment

• VMware NSX 4.2.0.x
• VMware NSX 4.2.1.0, 4.2.1.1, 4.2.1.2, 4.2.1.3
• VMware NSX 9.0.0.0
• VMware vSphere ESXi

Cause

This issue appears to be related to CCP issues between ESXi Transport Nodes and NSX Managers, as a result of the Managers being affected by the JDK-8330017: ForkJoinPool bug. 

Resolution

Perform a rolling reboot of all 3 NSX Managers to workaround this issue. 

Note: If experiencing this issue currently, restarting the affected service or rebooting the affected NSX Manager node resolves the immediate symptoms. However, without upgrading NSX (to a version where this issue is resolved), the problem will recur over time.