Security group deletion fails or gets stuck in progress in NSX

Products

• VMware NSX

Issue/Introduction

• This article outlines the procedure to safely delete unused security groups in NSX to optimize datapath IP counts or clean up obsolete configurations.
• Deletion attempt may fail or the status gets stuck in "In Progress" within the NSX Manager UI. This occurs if the target security group remains actively referenced by other platform components (such as Distributed Firewall rules), violating relational integrity constraints.
• Security group deletion fails or gets stuck in progress in NSX Manager with the following error:

"The object path=[/global-infra/domains/<domain-name>/groups/<group-name>] cannot be deleted as either it has children or it is being referenced by other objects path=[/infra/domains/default/security-policies/<policy-name>/rules/<rule-name>]".

 

Environment

VMware NSX

Cause

A security group cannot be deleted if its reference count is greater than 0. This occurs when the group is mapped to active Distributed Firewall (DFW) Rules, Gateway Firewall Rules, nested parent Security Groups, or Endpoint Protection/Service Insertion Rules.

Resolution

Verifying Dependencies Before Deletion

To prevent deletion errors, verify if the Security Group is actively referenced by other NSX objects before attempting to remove it.

1. Log in to the NSX Manager UI.

2. Navigate to Inventory > Groups.

3. Locate the target Security Group in the inventory list.

4. Click the vertical ellipsis (three dots) next to the group name and select View Related Objects, or click directly on the numerical link under the References column.

5. Review the list of associated objects, such as Distributed Firewall Rules, Gateway Firewall Rules, or Security Policies. If active references exist, you must reassign or remove them within their respective configurations before the group can be safely deleted.

 

Resolving Deletion Errors Due to Active References

If a deletion attempt has already failed with an error indicating the object has children or is being referenced by other objects, clear the specific dependencies to successfully delete the group.

1. Analyze the Error Message: Review the alarm prompt to identify the exact path of the referencing objects. The error will explicitly list the dependent policies and rules (e.g., /infra/domains/default/security-policies/<policy-name>/rules/<rule-name>).

2. Locate the Referencing Rules: Navigate to Security > Distributed Firewall (or the specific security section identified in the error path).

3. Edit the Rules: Locate the exact policy and rules mentioning the affected group. Edit each rule to remove the target Security Group from the Source, Destination, or Applied To fields. Replace it with an alternative group if required.

4. Publish Changes: Click Publish to commit the updated firewall configurations to the data plane.

   • Note on Cache Expiration: After removing a group from firewall policies, wait a few minutes before attempting to delete the group itself to allow the system’s dependency checks to update.

5. Delete the Group: Navigate back to Inventory > Groups, locate the original Security Group, and initiate the deletion. The object will now delete successfully without triggering the dependency lock.

 

Delete Unused Security Groups via NSX Manager UI

1. Log in to the NSX Manager user interface.

2. Navigate to Inventory > Groups.

3. Locate the unused group to delete.

4. Verify the References column for the group shows 0.

5. Click the vertical ellipsis (three dots) next to the target group and select Delete.

6. Confirm the action in the prompt by clicking Delete.

Delete Unused Security Groups via Policy API

For environments requiring programmatic deletion or bulk removal, utilize the NSX Policy API:

• Identify the target group-id.

• Execute the following DELETE payload against the NSX Manager:
  DELETE https://<nsx-manager-ip>/policy/api/v1/infra/domains/default/groups/<group-id>

 

If you preformed the workaround above and the issue persist, please open a support case with Broadcom Support and refer to this KB article.

For more information, see Creating and managing Broadcom support cases.