Windows VM Network Interruption with VMXNET3 and Fortinet NDIS Filter

Products

• VMware vSphere ESXi

Issue/Introduction

• Windows Server VMs using VMXNET3 may lose connectivity with a "yellow bang" in Device Manager.
• VM lost network connection
• The NDIS dmp is generated and found from Windows Application events
• NDIS dumps reveal:

BUGCHECK_CODE:  15e

BUGCHECK_P1: 25

BUGCHECK_P2: 21

BUGCHECK_P3: ffffe20962497378

BUGCHECK_P4: 0

NDIS!ndisWaitForExternalDriver+0x75
NDIS!Ndis::BindEngine::UpdateBindings+0x7b

• Customer is using Fortinet Client 5.6.6

Environment

VMware vSphere ESXi

Cause

The Fortinet ftvnic.sys or FortiFilter.sys driver fails to release NBLs (Network Buffer Lists), causing the VMXNET3 driver to hang while transitioning to a PAUSING state.

Resolution

1. Contact Microsoft for further investigation along with NDIS dmp to determine the impact for the NIC
2. Re-install VMware Tools to ensure its integrity.
3. Upgrade Fortinet Client to the latest version.
4. Disable the Fortinet NDIS LightWeight Filter in the virtual NIC properties if the issue persists.

Additional Information

Reference KB: https://knowledge.broadcom.com/external/article?articleNumber=419513