netopa firewall ruleset missing from ESXi host after upgrading

Products

• VMware vSphere ESXi

Issue/Introduction

After performing a ESXi upgrade, the "netopa" outbound firewall rule may disappear from the [Configure] - [Firewall] settings of specific ESXi hosts in the vSphere Client.

• The issue occurs on a subset of ESXi hosts within the same vCenter Server.
• No manual configuration changes were made during the upgrade process.
• Latency metric collection for Aria Operations for Networks (formerly vRNI) is enabled.
• The configuration file /etc/vmware/firewall/netOPARuleset.xml exists on the host, but the rule is not visible or active in the management interface.

Environment

VMware ESXi
VMware Aria Operations for Networks

Cause

The ESXi firewall module failed to properly reload or parse the existing /etc/vmware/firewall/netOPARuleset.xml file into the active running configuration following the upgrade or host reboot.

Resolution

To resolve this issue, manually refresh the ESXi firewall rulesets to reload the configuration from the disk.

1. Log in to the affected ESXi host via SSH.
2. Execute the following command to refresh the firewall configuration:
   esxcli network firewall refresh
3. Verify that the netopa rule is now visible and correctly configured:
   esxcli network firewall ruleset list | grep netopa

Additional Information

The netopa (Network Operations Agent) service is utilized by Aria Operations for Networks to collect inter-host latency data via TCP port 1991.

For more information on managing the ESXi firewall via CLI, refer to:
Using ESXCLI Firewall Commands to Configure ESXi Behavior

---

アップグレード後に ESXi ホストから netopa ファイアウォールルールセットが欠落している