VSIP module Errors observed in vmkernel log and nsx-syslog in an ESXI host

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Certain errors are observed on an ESXi hosts related to the VSIP module and DFW. There is no observed impact to the DFW functionality. 

Following errors are observed in /var/run/log/vmkernel.log

2026-03-13T15:48:13.468Z In(182) vmkernel: cpu2:#######)pf_set_state_attributes_five_tuple: failed to set attribute (ret = 45)
2026-03-13T15:48:13.468Z In(182) vmkernel: cpu2:#######)VSIPConversionSetConnAttr: failed to set connection attributes

Following errors are observed in the /var/run/log/nsx-syslog.log

2026-03-27T19:59:09.026Z Wa(28) nsx-opsagent[#######]: vsipfw: VsipFWCmd.cpp:execute():226 missing uid to sid mapping

2026-03-27T19:59:09.026Z Wa(28) nsx-opsagent[#######]: vsipfw: VsipFWCmd.cpp:execute():226 missing uid to sid mapping

2026-03-27T19:59:09.026Z Er(179) nsx-opsagent[#######]: NSX ####### - [nsx@6876 comp="nsx-esx" subcomp="opsagent" s2comp="ctxteng" tid="#######" level="ERROR" errorCode="CTX1007"] DfwConnector: Failed to SetConnectionAttr for filter ## ## ## ## ## ## ## ##-## ## ## ## ## ## ## ##, user: S-1-5-##-##########-##########-##########-#### process key: ####################, status 70

2026-03-27T19:59:09.026Z Er(179) nsx-opsagent[#######]: NSX ####### - [nsx@6876 comp="nsx-esx" subcomp="opsagent" s2comp="ctxteng" tid="#######" level="ERROR" errorCode="CTX1007"] DfwConnector: Failed to SetConnectionAttr for filter## ## ## ## ## ## ## ##-## ## ## ## ## ## ## ##,, user: S-1-5-##-##########-##########-##########-####, process key: ####################, status 70

Environment

VMware vDefend Firewall

SSP with Security Intelligence

Windows VMs with MySQL server configured

Cause

This happens when 2 connections from the same Windows VM and within milliseconds of each other have the same 5-tuple. This error occurs while trying to write the same 5-tuple into the vsip table. The 2nd connection attempt is from the MySQL server process on a Windows VM.

 

Resolution

Find out Windows VMs in the environment, that have the MySQL installed and why they open tcp connection on same 5 tuple.

Please open a case with Broadcom Support if assistance is needed to identify the VMs.