Flow with Source and destination IP pair shows 2 DFW Firewall rules

Products

• VCF Operations for Networks

Issue/Introduction

Flow with Source and destination IP pair shows 2 DFW Firewall rules 

Refer to the screenshot below:

 

Environment

VCF Operations for Networks 6.13.0
VCF Operations for Networks 6.14.0
VCF Operations for Networks 6.14.1
VCF Operations for Networks 9.0.x

Cause

VCF Operations for Networks GUI can show more than one DFW Firewall rules, this is expected behavior.

When a firewall rule changes from R1 -> R2. for this change, VCF Operations for Networks (vRNI ) does not immediately remove the old firewall rule(R1) after it has changed.There is a time window of 6 hours before the old rule is removed.
So, for a maximum of 6 hours, you would be seeing both the rules. And if this happens multiple times (e.g. R1->R2->R3), user will see multiple FW rules for a single flow.

Resolution

If No changes at all have been ever been made to existing DFW Firewall rules on the NSX GUI, then this needs to be investigated further.

Open a support case with Broadcom Support to review your Aria Operations for Networks deployment. For more information, see Creating and managing Broadcom support cases.