While accessing Security Explorer / Visualization page, group filters fail to populate and UI displays: “The application server encountered an error while trying to fulfill your request. (400 Bad Request)”

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Firewall

Issue/Introduction

Users encounter NullPointerException errors when accessing visualization batch auto-completion APIs in SSP, specifically when processing segObj* group/classification filters. The error occurs due to missing display names in SSP group config table, causing "Comparable.compareTo" to fail when attempting to compare null objects during group filtering operations.

 

This issue typically manifests when:

• Accessing Security Group visualization features
• Using batch auto-completion APIs for group filtering
• Processing classification filters in the UI
• Performing operations that require group display name comparisons

 

Steps to Identify

To confirm whether your SSP instance is experiencing this specific issue, follow these steps to check the service logs and database records :

1. Check Visualization Service Logs

Log in to the Security Services Platform Infrastructure (SSPI) and check for NullPointerException errors by running:

k get pods -A | grep visualization
k logs -n nsxi-platform <visualization-service-pod-name> | grep -i "nullpointer"

 

2. Verify Database for Missing Display Names

Connect to the Postgres database and check if there are any groups missing their display names:

# Connect to the database

(1) k exec -it postgresql-ha-postgresql-0 -n nsxi-platform -- /bin/bash

(2) After that grab the password for postgres by the below command
printenv | grep PASS

Note the POSTGRES_PASSWORD

(3) PGPASSWORD=$POSTGRES_PASSWORD psql -d pace

 

# Query for empty or null group display names

SELECT 
    id AS group_id, 
    metainfo->>'groupDisplayName' AS display_name, 
    deleted as is_deleted 
FROM nsx_config.normalizedgroupconfig 
WHERE metainfo->>'groupDisplayName' IS NULL 
   OR metainfo->>'groupDisplayName' = '';

 

 

Conclusion: If you find NullPointerException messages in your logs and the database query returns rows with missing display names, your system is affected by this issue.

Environment

vDefend SSP >= 5.0 and SSP < 5.2

Cause

This issue occurs when federated groups are deleted from the Global Manager (GM) while still having active references in the Local Manager (LM). Consequently, these groups are marked for deletion but persist in the LM until all references are removed, leading to missing display names in the SSP database. Specifically, after the group deletion process on the GM, the display names may not correctly preserved in SSP's `nsx_config.normalizedgroupconfig` table, resulting in null values. When the visualization batch auto-completion API tries to process these groups for filtering, the comparison logic fails with a `NullPointerException` because it cannot compare null display names.

The root cause is related to:

• Deletion of federated group from GM which has active reference in LM
• Missing display name in config table for such group

 

Resolution

Please reach out to Broadcom Support for further assistance

 

This will be fixed in an upcoming version of SSP
This is being tracked by Internal Ticket 3711774