Security Intelligence recommendation engine creates anonymous destination groups instead of reusing pre-configured IP groups

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Security Intelligence application recommendation engine fails to reuse pre-configured IPSet groups for external/physical networks.

Instead of mapping network flows to existing inventory groups, the recommendation analysis ignores them and generates new, anonymous destination groups.

Users may find themselves blocked from efficiently publishing security policies due to the generation of a large, unmanageable volume of these anonymous groups.

Environment

Security Services Platform (SSP) 5.1.1

Cause

This behavior is the result of a product design change. In previous versions (e.g., v5.0), a "group reuse threshold" setting (a UI sliding bar) was available to manage the threshold for matching IP set ranges.

In version 5.1.1, this setting was removed from the UI to enforce an "application bootstrapping" workflow and promote the use of tier groups. Without this user-defined threshold in the UI, the recommendation service fails to match flows to existing inventory groups based on IP ranges, defaulting instead to creating new, anonymous groups.

Resolution

To resolve this issue, a backend workaround must be applied directly to the database to manually adjust the IP group reuse thresholds.

Important Note: Because this workaround interacts directly with active jobs, the database update step must be repeated for every single recommendation run. The SQL command must be executed immediately after the UI request is submitted to apply the correct thresholds for that specific run.

Steps:

1. Access the Database: From the SSPI (Installer VM), exec into the PostgreSQL pod by running the following command:

    

   (1) k exec -it postgresql-ha-postgresql-0 -n nsxi-platform -- /bin/bash 
   
   
   (2) Note : Grab the password for postgres by the below command
   
   printenv | grep PASS
   
   (3) k exec -it postgresql-ha-postgresql-0 -- /bin/bash -c 'PGPASSWORD=$POSTGRES_PASSWORD psql -d pace'
   
   
   

2. Trigger Recommendation: Start or rerun the security recommendation job from the NSX UI.

3. Apply Threshold Update: Immediately after submitting the request in the UI, execute the following SQL command in the database shell to adjust the threshold for that run:

    

   UPDATE intelligence.recommendation SET ipv4_group_reuse_threshold = 32, ipv6_group_reuse_threshold = 128;
   

4. Validate: Review the recommendation results to confirm that the existing external/physical network groups were successfully re-used.