Unable to modify ESXi firewall settings once a firewall configuration task fails due to duplicate IP addresses

Products

• VMware vSphere ESXi

Issue/Introduction

When configuring the allowed IP list which has duplicated IP entries for ESXi firewall settings, the task may fail with the following error messages in the vSphere Client:

Status: An error occurred during host configuration.
Error stack: Operation failed, diagnostics report: Unable to complete Sysinfo operation. Please see the VMkernel log file for more details.: Already exists

Subsequently, even after removing the duplicate IP addresses from the list and attempting to apply the firewall settings again, the same error continues to occur.

Environment

VMware vSphere ESXi 7.0
VMware vSphere ESXi 8.0

Cause

When saving an ESXi firewall configuration that contains duplicate IP addresses, the configuration task fails. However, partial information remains in the cache, resulting in an inconsistency between the cache and the stored configuration data.

Consequently, even when subsequently attempting to apply a valid configuration containing no duplicates, this inconsistency causes the same error to occur as when registering duplicate addresses, making it impossible to change the firewall configuration.

 

Resolution

This issue is resolved in ESX 9.0.

 

Workaround

Reboot the ESXi host to clear the cache and reload the valid firewall configuration from the configstore.

 

Additional Information

It is possible to resolve this issue without a reboot by manually removing the stale entries from the cache. However, this requires identifying the specific data left in the cache.

If a host reboot is not feasible, please contact Broadcom Support for assistance with clearing the cache manually.