VM IP Address Missing in NSX Group

Products

• VMware NSX

Issue/Introduction

• You have an NSX group configured with dynamic criteria e.g., VM Name contains specific text.
• When viewing the group members in the NSX inventory, the Virtual Machine's IP address is displayed, but the VM name is missing or blank.
• The port is empty, when viewing Virtual Interface details in the UI:
  Inventory > Virtual Machines > VIEW DETAILS
• The affected VM has a cloned copy that is powered off in another Disaster Recovery site.
• The following error can be seen on an NSX manager in /var/log/proton/nsxapi.log
<DATE>  INFO SecurityLogicalPortSyncer1 SecurityLogicalPortSyncer 5906 SWITCHING [nsx@6876 comp="nsx-manager" level="INFO" subcomp="manager"] Deleting logical port ########-####-####-####-############ as there are 2 logical ports associated with originId ## ## ## ## ## ## ## ##-## ## ## ## ## ## ## ##:# and this logical port has an older timestamp.
• From a support bundle for an NSX Manager, when reviewing the desired_state_manager.json file, you observe that the _last_sync_time is stale for the affected VM.
  _last_sync_time": ############# 
  Note: the time is in Unix epoch time and needs converting. 
• Alternatively you can verify the same with an API call:
  GET https://<NSX_MANAGER>/policy/api/v1/fabric/virtual-machines?display_name=<VM_NAME>
• Impact: The Distributed Firewall (DFW) rule does not apply to this specific VM, while the other VMs in the group match the rule correctly.
• This issue is observed in VMware NSX 4.2.3.

Note: The preceding log excerpts only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX

Cause

The validation process for logical ports mistakenly identified and deleted a port as a duplicate because two separate Virtual Machines (VMs) on different hosts shared the same originId.

Resolution

This is a condition that may occur in a VMware NSX environment.

To resolve this issue, force a resync of the affected ESXi host transport node that contains the VM missing in the group, from the NSX Manager using the Policy API:

1. Identify the UUID of the host transport node where the affected VM is currently residing.
2. Authenticate to the NSX Manager and execute the following API call to force a host configuration resync:
   POST https://<nsx-manager>/policy/api/v1/infra/sites/default/enforcement-points/default/host-transport-nodes/<host-uuid>?action=resync_host_config
3. Refresh the NSX UI and verify the group to confirm the VM name is now correctly populated alongside its IP address.

Additional Information

NSX-T API usage