Incomplete flow visibility in VCF Operations for Networks after migrating VMs from DVPG to NSX Segments

Products

• VCF Operations for Networks
• VMware vDefend Firewall
• VMware NSX

Issue/Introduction

• NSX 9.0.x is in use.
• One or more VMs are migrated from a DVPG to NSX Segments.
• Post migration, the flows for migrated VMs are no longer visible within VCF Operations for Networks.
• From within VCF Operations for Networks collector logs, flows are reported dropped due to being NON_DOMAIN_NSXT_FLOWS.
  
  /var/log/collector/latest.log
[Timestamp] INFO flow-processor 3837 [netw@4413 class="v2.helpers.IpfixRawFlowValidator" thread="five_tuple_task-6" method="printAndResetRejectionStats" line="472"] Raw Ipfix Record Rejection Stats [file=/var/flows/vds/nfcapd/nfcapd.202606120948]: DENY_FLOWS:0 WRONG_REPORTING_POINT:9 DATA_SOURCE_DISABLED:0 SESSION_NOT_ESTABLISHED:1716 NO_METRIC_DATA_4:0 NO_METRIC_DATA_6:0 ADDSTATE_WRONG_FLOW_TYPE:0 IPV6_LINK_LOCAL:0 NON_DOMAIN_NSXT_FLOWS:127209 UNSUPPORT
  
  
• On the ESX where the migrated VMs reside, the following command shows old port groups IDs persist.
  
  nsxcli -c get firewall ipfix-filters
Firewall IPFIX VIFs
1948######
9388######
1056######
1514######
...
  
  
  
• For a working scenario, ipfix-filters should show VIFID like:
  
  nsxcli -c get firewall ipfix-filters
Firewall IPFIX VIFs
#######-2412-48bf-8667-############
#######-2412-48bf-8667-############
#######-2412-48bf-8667-############
...

Environment

VMware NSX
VMware vDefend Firewall
VMware VCF Operations for Networks

Resolution

This issue is resolved in NSX 9.1, available at Broadcom downloads.

If you are having difficulty finding and downloading software, review the Download Broadcom products and software KB.

Workaround:

1. SSH to ESX host where migrated VMs reside, restart the exporter daemon (nsx-exporter restart will not cause any impact).
   
   /etc/init.d/nsx-exporter restart
   
   
2. Confirm that the IPFIX command now populates VIFIDs correctly.
   
   nsxcli -c get firewall ipfix-filters
   
   
3. Wait 30 minutes and check within VCF Operations for Networks to confirm flows are now populating.

Additional Information

NOTE: VCF Operations for Networks was formerly named Aria Operations for Networks (AON), and prior to that was named vRealize Network Insight (vRNI)