Workaround to remove orphaned Rule Analysis UI plugin from NSX

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

If SSP if forced deleted, we skip the Rule Analysis feature deactivation that is required to de-register the Rule Analysis UI plugin from NSX. That plugin continues to show and display an error message.

Environment

SSP 5.X

Cause

Rule Analysis UI plugin not de-registered from NSX

Resolution

Prerequisite: Before executing the commands below, ensure you have command-line access. You must either:

• Log in via SSH to the NSX Manager using root credentials.

• Use an external machine (such as the SSP Installer VM) that has direct network access to the NSX Manager API endpoint.

1. Confirm the Plugin is Registered (Optional)

Run the following command to verify if the orphaned plugin is currently present:

curl -sk -u "admin:<password>" \
  "https://<nsx-mgr>/policy/api/v1/ui-controller/remote-ui-plugins" \
  | python3 -c "import sys,json; d=json.load(sys.stdin); [print(p['id']) for p in d['results']]"

Expected sample output (if the plugin is present):

security-ui
rule-analysis-ui

2. Delete the Plugin

Run the following DELETE request to remove the orphaned plugin:

curl -sk -u "admin:<password>" \
  -X DELETE \
  -H "X-Allow-Overwrite: true" \
  "https://<nsx-mgr>/policy/api/v1/ui-controller/remote-ui-plugins/rule-analysis-ui"

Expected output (only the default UI remains):

security-ui

 

Important Notes

• Idempotency: Deleting a plugin that no longer exists returns an HTTP 200 status code with an empty body rather than a 404 error. Because of this, you can safely re-run Step 2 at any time without generating errors.

• Ownership Error Without the Header: The -H "X-Allow-Overwrite: true" header is strictly required. If it is omitted, the NSX Manager will reject the request with the following error:

  {"error_code": 289, "error_message": "Principal 'admin' ... attempts to delete or modify an object it doesn't own. (createUser=napp_platform_egress, allowOverwrite=null)"}
  

• Automatic Re-registration: The plugin is designed to re-register automatically whenever the rule-analysis deployment starts up. If the rule-analysis service is still active and healthy, the plugin will reappear after the next pod restart. This workaround is only permanent if the underlying rule-analysis deployment has been scaled down or completely uninstalled.