IDFW Log Scraping (ELS) Failures Due to SNAT and IP Conflicts

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

• Identity Firewall (IDFW) rules utilizing Event Log Scraping (ELS) do not match for workstations.
• Workstation IP addresses are not populated in the Distributed Firewall (DFW) source address sets (`rextip`).
• User sessions appear intermittently or not at all in the Active IDFW User Sessions UI.
• NSX-T Manager logs show logout messages immediately followed by login events for different users on the same IP.

Environment

VMware vDefend Firewall /  IDFW with ELS configured

Cause

This issue occurs when traffic between the end-user workstations and the Domain Controllers (DC) is subject to Source Network Address Translation (SNAT). 

Because multiple workstations are SNAT'ed through a single firewall or gateway IP, NSX-T sees multiple login events originating from the same source IP. When NSX-T detects a new login for an IP already associated with a different user, it triggers a logout for the existing user to prevent session hijacking. This creates a "race condition" where only the last logged-in user is briefly active, or sessions are constantly cleared.

Resolution

To resolve this issue, the network path between the workstations and the Domain Controllers must be transparent for Identity Firewall to function correctly:

1.  Remove SNAT: Disable SNAT for traffic originating from the workstation subnets destined for the Active Directory Domain Controllers.
2.  Verify Routing: Ensure that the original workstation IPs are visible to the DCs in the Security Event Logs (Event IDs 4624/4634).
3.  Validate DFW Realization: Once SNAT is removed, verify the IP address realization on the ESXi host using:
    vsipioctl getfwconfig -f <dvfilter-id>

Additional Information

Troubleshooting

1. Enable IDFW Debug Logging

Enable debug logging on all Local Managers to capture the session conflict messages:

set service manager logging-level debug package com.vmware.nsx.management.idfw

2. Analyze NSX API Logs

Search `/var/log/proton/nsxapi.log` for the following pattern:

`Existing user session logout (other user has same ip) , domain: <Domain> user: <User> ip: <SNAT_IP>`

If you see multiple different users associated with the same IP in these logs, SNAT is likely interfering with the IDFW identity mapping.