ESXi upgrade from 9.0.x to 9.1.x generates a warning: Live Patch scan script warning: Getting a list of addrsets on global filter FAILED

Products

• VMware NSX
• VMware vSphere ESXi

Issue/Introduction

• During an in-place upgrade or remediation of ESXi hosts to version 9.1.x, the process may report a warning during the pre-check/scan phase related to NSX components. The specific message is:
  
  Live Patch scan script '01_nsxhost_scan.py' returned a warning: Getting a list of addrsets on global filter FAILED. Please check if nsxt-vsip is running, it is possible that no addrsets are configured
  
  
  
• This warning is not present when performing a maintenance mode upgrade or remediation.
• Despite rebooting the affected ESXi hosts, the scan script continues to return the same warning.
• The distributed firewall (DFW) is not enabled in NSX.

Environment

• VMware vSphere ESX 9.x
• VMware NSX 9.x

Cause

During the ESX 9.x upgrade pre-check phase, the 01_nsxhost_scan.py script first checks to see if the the nsxt-vsip (DFW) module is loaded. This module is loaded by default in VCF 9.x, regardless of whether the DFW is in use. When the script sees that the module is loaded, it then attempts to query DFW rules on the host. When the DFW is not enabled, there will be no rules present on the host and an error is returned, resulting in the pre-check warning.

Resolution

This warning can be ignored and the in-place upgrade can be allowed to proceed.

Additional Information

If the DFW is enabled and this same warning is generated, an investigation of the health of the nsx-vsip module on the affected ESX hosts will be needed. Open a support case with Broadcom Support. For more information, see Creating and managing Broadcom support cases.

If the upgrade pre-check produces the same message but it is an Error and not a Warning, the most likely scenario is that there are layer-7 firewall rules applied to the host. In this scenario, the upgrade must be changed to a maintenance mode based upgrade or the specific firewall rules must be disabled.

See In-Place Upgrades for more information on the limitations of in-place upgrades in VCF 9.1