Can not change configuration in Application profile

Products

• VMware NSX

Issue/Introduction

• Configuration change for application profile in the NSX Manager UI and success.

GET /policy/api/v1/infra/lb-app-profiles/

  "x_forwarded_for" : "INSERT",
  "http_redirect_to_https" : false,
  "ntlm" : true,
  "idle_timeout" : 15,
  "request_header_size" : 1024,
  "response_timeout" : 500,
  "response_header_size" : 4096,
  "response_buffering" : false,
  "server_keep_alive" : true,
  "resource_type" : "LBHttpProfile",
  "id" : "***********",
  "display_name" : "***********",
  "path" : "/infra/lb-app-profiles/***********",
  "relative_path" : "***********",
  "parent_path" : "/infra",
  "remote_path" : "",
  "unique_id" : "********-****-****-****-************",
  "realization_id" : "********-****-****-****-************",
  "owner_id" : "********-****-****-****-************",
  "marked_for_delete" : false,
  "overridden" : false,
  "_create_time" : 1693203155606,
  "_create_user" : "***********",
  "_last_modified_time" : 1766473658802,        <-------- It's been updated
  "_last_modified_user" : "***********",
  "_system_owned" : false,
  "_protection" : "NOT_PROTECTED",
  "_revision" : 7

 

• But the changes are not actually applied.

/nsxapi/api/v1/loadbalancer/application-profiles

      {
        "_create_time": 1693203156064,
        "_create_user": "nsx_policy",
        "_last_modified_time": 1693203156064,          <-------- Not updated
        "_last_modified_user": "nsx_policy",
        "_protection": "REQUIRE_OVERRIDE",
        "_revision": 0,
        "_system_owned": false,
        "display_name": "***********",
        "http_redirect_to_https": false,
        "id": "********-****-****-****-************",
        "idle_timeout": 15,
        "ntlm": false,
        "request_header_size": 1024,
        "resource_type": "LbHttpProfile",
        "response_buffering": false,
        "response_header_size": 4096,
        "response_timeout": 60,
        "server_keep_alive": false,
        "tags": [
          {
            "scope": "policyPath",
            "tag": "/infra/lb-app-profiles/****"
          }
        ],
        "x_forwarded_for": "INSERT"
      },

 

• Found error event in /var/log/proton/nsxapi.log

ERROR providerTaskExecutor-1-67 PolicyProviderUtil 86926 POLICY [nsx@6876 comp="nsx-manager" errorCode="PM0" level="ERROR" subcomp="manager"] Created alarm Alarm [policyPath=/infra/realized-state/enforcement-points/default/lb-app-profiles/<display_name>/alarms/********-****-****-****-************, message=[error_code=23730, module_name=LOAD-BALANCER, error_message='To deploy the load balancer service on logical router********-****-****-****-************, the logical router should connect to tier0 logical router, or have one centralized service port.'],errorId=PROVIDER_INVOCATION_FAILURE, path=null, apiError=error_code=23500, module_name=LOAD-BALANCER, error_message='Found errors in the request. Please refer to the related errors for details.'

 

• The load balancer to which the application profile is applied does not have a T0 or T1 service interface.

 

 

Environment

VMware NSX

Cause

LoadBalancer is attached with Tier-1 and users have removed Tier-0 from Tier-1 in previous release, after upgrade, we still allow users to update other fields for this Tier-1, and the existing LoadBalancer object won’t be impacted. But when users update LoadBalancer objects, it could report realization errors mentioned in this bug to inform users to add a tier-0 in tier-1 or tier-1 interface in tier-1.

Resolution

This will be fixed in a future release

 

Workaround steps:

1. Configure Tier-0 in Tier-1 /infra/tier-1s/

2. Wait for 5 min to wait for the realization framework retry and then you can check the API for the APP profile realization status:

GET policy/api/v1/infra/realized-state/realized-entities?intent_path=/infra/lb-app-profiles/<display_name>
It should have no errorsin the realization status output("state": "REALIZED")