"Nothing to Recommend" message when Multicast or Broadcast traffic are included in recommendation boundary

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

In SSP 5.1.1, the "Use Existing Section" workflow cannot generate micro-segmentation recommendations for broadcast or multicast traffic (e.g., UDP 5353 mDNS). This failure happens despite the user explicitly enabling the "Include Broadcast Traffic" and "Include Multicast Traffic" options, and even when the traffic is actively listed under Unprotected Flows.

Observed Symptoms

1. Multicast or broadcast traffic (such as Source 10.xx.xx.xx → Destination 224.0.0.251, UDP 5353) properly appears in the SSP UI within the Unprotected Flows section.
2. The user runs the recommendation workflow with both the Include Broadcast Traffic and Include Multicast Traffic settings turned on.
3. The system fails to generate a policy, incorrectly returning a "Nothing to Recommend" message.

Environment

SSP 5.1.1

Cause

In SSP 5.1.1, the "Use Existing Section" workflow (used for reusing existing security policies) fails to process multicast and broadcast flows correctly. During execution, the system translates the destination into a multicast IP address, classifying both the source and destination as standard IP-based entities. The flow direction logic then evaluates these entities against context computes. Since neither the source nor the destination maps to a recognized compute entity, the logic mistakenly filters these flows out, preventing them from appearing in the generated recommendations.

Resolution

This is a known issue affecting SSP 5.1.1. VMware by Broadcom is working to resolve this in a future release.

As a temporary solution, use the Create New Section workflow instead of Use Existing Section, as it is not impacted by this logic error :

 

1. Navigate to the recommendation in SSP.
2. Start recommendation and select Create New Section.
3. Enable inclusion of Broadcast and Multicast traffic and run the recommendation

 

This is actively being tracked in BUG ID 3673116