Verifying the Transport-Node Firewall Rule Count in SSP Firewall Insight

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

This article provides instructions on how to verify the firewall rule count directly on an ESXi host. It also outlines the troubleshooting steps to follow if there is a discrepancy between the rule count on the ESXi host and the count displayed in the SSP UI (Firewall Insight > Transport Node).

Verification of the firewall rule count on 
1) ESXi host 
2) SSP 

Environment

SSP 5.x

Cause

NA

Resolution

Part 1: Verifying the Rule Count on the ESXi Host

To check the current firewall rule count applied at the host level, run the following command directly on the ESXi host (SSH via root) :

/opt/vmware/nsx-cli/bin/nsx-appctl -t /var/run/vmware/nsx-cfgagent/cfgagent-cli dfw/tnMetrics

Sample Output:

[root@<HOSTNAME>:~] /opt/vmware/nsx-cli/bin/nsx-appctl -t /var/run/vmware/nsx-cfgagent/cfgagent-cli dfw/tnMetrics
{"sp_v_rule_cnt":208,"rule_cnt":51626,"tn_uuid":"<TN_UUID>","update_time":"1778754947"}

(Note: The "rule_cnt" value indicates the total number of rules on the host.)

Part 2: Troubleshooting Count Discrepancies

If there is a discrepancy between the count observed on the ESXi host and the count shown in the SSP UI, you will need to enable and capture debug logs on the SSPI-VM for further analysis.

Step 1: Enable Debug Logging Log in to the SSPI-VM via sysadmin and enable debug logging on the metrics manager by executing the following command:

k -n nsxi-platform get pod | grep metrics-manager | awk '/Running/{print $1}' | while read pod; do k -n nsxi-platform exec "$pod" -- curl -d "{\"traceLevel\":3}" -X PUT localhost:5010/manager/debugLogger; done

Important Note: Setting the trace level to 3 will log each incoming message. Because debug mode prints a high volume of logs, the log files will roll over much faster than usual.

Step 2: Monitor and Capture Logs Allow the system to run in debug mode for 10–15 minutes. Search for the number_of_rules string in the metrics-manager logs to observe the rule count reported by each Transport Node:

# k -n nsxi-platform logs <metrics-manager-xyxyxy> | grep number_of_rules 

(Be sure to replace <metrics-manager-pod-name> with your actual pod name, e.g., metrics-manager-xyxyxy).

Step 3: Disable Debug Logging Once you have captured the necessary logs, you must disable debug logging to prevent log saturation. Run the following command to reset the trace level to 0:

# k -n nsxi-platform get pod | grep metrics-manager | awk '/Running/{print $1}' | while read pod; do k -n nsxi-platform exec "$pod" -- curl -d "{\"traceLevel\":0}" -X PUT localhost:5010/manager/debugLogger; done

 

Additional Information

If you have identified a confirmed discrepancy between the SSP Firewall Insight rule count and the ESXi host rule count, please open a Service Request with Broadcom/VMware Support and provide the captured metrics-manager logs for further investigation.