Incorrect NSX DFW rule realization caused by duplicate VIF IDs

Products

• VMware NSX

Issue/Introduction

• 2 different VM IP addresses are realized on same VIF on NSX.
  Can be validated in the Segments >> Ports section on NSX.
• This realization of different VMs on same VIF is resulting in the incorrect DFW realization based on the Group Match criteria.
• On the ESXi host of these VMs, com.vmware.port.extraConfig.vnic.external.id property is missing from "net-dvs -l" output for 1 of these VMs.
• Below logs can be observed in nsx-syslog.log on ESXi host:
  
  

  2026-04-04T00:11:43.499Z In(182) nsx-opsagent[2111311]: NSX 2111311 - [nsx@6876 comp="nsx-esx" subcomp="opsagent" s2comp="nsxa" tid="2112214" level="INFO"] [PortOp] Adding [com.vmware.port.extraConfig.vnic.external.id] value [1bxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx-1]  >>>>>>> The value being set is identical to the VIF ID of alreday existing VM

  2026-04-04T00:11:43.500Z Er(179) nsx-opsagent[2111311]: NSX 2111311 - [nsx@6876 comp="nsx-esx" subcomp="opsagent" s2comp="nsxa" tid="2112214" level="ERROR" errorCode="MPA44205"] [PortOp] Port set for extraConfig property [com.vmware.port.extraConfig.vnic.external.id] operation failed, error code [bad0004]

• The connectid for both the VMs is same in the "net-dvs -l" output:
  
          port 414:
                com.vmware.common.port.alias =  ,       propType = CONFIG
                com.vmware.common.port.connectid = 1 ,  propType = CONFIG

        port 415:
                com.vmware.common.port.alias =  ,       propType = CONFIG
                com.vmware.common.port.connectid = 1 ,  propType = CONFIG

Environment

VMware NSX

Cause

This is a known issue where the nsx-opsagent tries to configure a free port and fails due to a duplicate connect ID.

Resolution

The issue has been resolved in NSX 4.2.3.2 version.

For workaround, refer to KB Host Transport node shows NSX configuration status as failed with error "failed to set port opaque data".