SSP 5.2 – NSX-T Interoperability Issues
Article ID: 449638
Updated On:
Products
Issue/Introduction
This article lists known interoperability issues between VMware SSP (Security Services Platform) 5.2 and NSX-T, along with affected/fixed versions, SSP release impact, and available workarounds.
Environment
NSX-T versions with SSP 5.2
Cause
NA
Resolution
| Sl No. | Issue | Release Notes / KB |
Affected NSX Version(s)
|
Fixed Version(s)
|
Does it Affect SSP 5.0 / 5.1/ 5.2?
| Workaround |
|---|---|---|---|---|---|---|
| 1 | When On-Premises Malware Prevention Service (MPS) is enabled, creating a custom MPS profile via the NSX Manager UI always defaults the detection mode to SIGNATURE_BASED instead of SIGNATURE_AND_SANDBOXING_BASED. Impact: Dynamic sandboxing (deep analysis) is disabled for files processed under UI-created custom profiles. Verdicts are generated using static analysis (signatures) only. | https://knowledge.broadcom.com/external/article/450290
|
|
| 5.2.0 | Refer to published KB |
| 2 | The IDPS oversubscription metrics fail to increment for SCRX (Turbo Mode) hosts. When traffic exceeds the rate limit and packets are dropped by the dvFilter, the performance data counters (oversub_pps_peak and oversub_bps_peak) remain at 0. Impact: Because the host-level counters do not increment, the SSP IDPS dashboard cannot reflect the dropped packets. Any SSP metric queries for tn_security_monitoring.max_security_oversubscription_pkts_per_sec incorrectly return a value of 0.0 across all hosts, even when active rate-limiting and packet drops are occurring. | https://knowledge.broadcom.com/external/article?articleNumber=451580
|
| NSX 9.x Branch: Scheduled to be fixed in an upcoming NSX version | 5.2 | Refer to published KB |
| 3 | When ESX hosts report host CPU utilization (tn_security_monitoring.max_host_cpu_usage) exceeding 100% (due to ESX hyper-threading feature or peak metric sampling), the Health Assessment engine calculates available CPU cores using total_cores * (1 - usage / 100). Because the percentage usage is greater than 100%, this formula generates negative values, causing the SSP UI dashboard to display negative available CPU cores and trigger a CRITICAL health state. Impact: Cosmetic/reporting issue on the SSP dashboard displaying negative numbers for available CPU cores. | https://knowledge.broadcom.com/external/article/451711
|
| NA Fixed in upcoming SSP version | 5.2.0 | Refer to published KB |
| 4 | When Network Traffic Analysis (NTA) or NDR is deployed in SSP 5.2 without NSX Intelligence active, querying the security usage API (/policy/api/v1/licenses/security-usage) incorrectly returns "features_in_use": ["DISTRIBUTED_INTELLIGENCE"] and "intelligence_deployed": "true". Impact: The License Usage Meter and Security Usage dashboards report incorrect feature utilization data, showing NSX Intelligence as deployed/active when only NTA or NDR is enabled. | Release Notes Link
|
|
| 5.2 | Refer to Release Notes |
| 5 | When Network Traffic Analysis (NTA) and Network Detection and Response (NDR) are enabled on SSP 5.2 without NSX Intelligence active, querying the license usage API (/policy/api/v1/licenses/security-usage) fails to report core counts for the NDR feature, incorrectly displaying "NETWORK_DETECTION_RESPONSE": "0". Impact: Reporting discrepancy on the License and Security Usage dashboard where active NDR core consumption is not reflected, even though the NDR protection features are fully functional and operating on the environment. | Release Notes Link |
|
| 5.2. | Refer to Release Notes |
| 6 | When executing a fileless script (such as PowerShell or VBScript) via the Malware Prevention Service (MPS), the process fails on subsequent attempts following an initial execution. While the first script execution successfully generates a fileless event with a valid verdict (e.g.,
| Release Notes Link |
| NSX 9.x Branch / Main: Scheduled to be fixed in an upcoming NSX version | 5.1.1, 5.2.0 | Refer to Release Notes |
| 7 | After upgrading NSX, NSX Infrastructure Sync becomes DOWN in the Security Services Platform UI with the error message: "The NSX Infrastructure Sync Agent is not running". This prevents licenses and infrastructure data from syncing properly due to a race condition in certificate marker tracking during service lifecycle and leadership changes. | https://knowledge.broadcom.com/external/article/434265
|
|
| 5.1.1, 5.2.0 | Refer to published KB |
| 8 | When SSP (or NAPP) is down, disconnected, or failing to publish license events, the empty Kafka poll causes NSX Manager worker threads to continuously cycle through reinitialization calls ( Impact: The NSX Manager UI intermittently fails to load, API requests time out, logging into the NSX Manager VIP is extremely slow, and log bundle collections freeze after 5 minutes with error | https://knowledge.broadcom.com/external/article/446372
|
| NSX 4.2.x Branch: Scheduled to be fixed in an upcoming NSX version NSX 9.x Branch: Scheduled to be fixed in an upcoming NSX version | 5.1.1, 5.2.0 | Refer to published KB |
| 9 | When Application and Tier groups are deleted in bulk on NSX, the deleted group records are removed immediately from the internal Impact: The permanent "Pending Groups" list causes continuous, repetitive update messages for the same groups across subsequent sync cycles, creating high Kafka message lag ( | https://knowledge.broadcom.com/external/article/450617
|
| NSX 4.2.x Branch: Scheduled to be fixed in an upcoming NSX version NSX 9.x Branch: Scheduled to be fixed in an upcoming NSX version | SSP 5.1.1, SSP 5.2 | Refer to published KB |
| 10 | During a single long-running delta sync in NSX PACE agent, the sync process takes independent table snapshots as it iterates rather than a single point-in-time snapshot. When a group undergoes rapid churn (such as deleting and re-creating/re-publishing an App Group with the same name during SSP offboard/onboard at scale), both the deleted MP UUID and the new MP UUID are picked up in the same delta sync. Because the deleted UUID is hard-deleted from the database, the PACE agent fails to resolve it, leading to a permanent | https://knowledge.broadcom.com/external/article/451493
|
| NSX 4.2.x Branch: Scheduled to be fixed in an upcoming NSX version NSX 9.x Branch: Scheduled to be fixed in an upcoming NSX version | SSP 5.2 | Refer to published KB |
| 11 | SSP loses inventory sync with NSX Manager after services activation due to dangling delta producers in NSX. Details:
| https://knowledge.broadcom.com/external/article/437093
|
| NSX 4.2.x Branch: Scheduled to be fixed in an upcoming NSX version NSX 9.x Branch: Scheduled to be fixed in an upcoming NSX version | 5.1.1, 5.2.0 | Refer to published KB. |
| 12 | When NappAgentCertProfileMarker is set to true, the required NAPP agent certificates may still be missing on NSX if CertificateShardingServiceImpl was not the leader across the NSX cluster. This missing certificate profile causes the NSX Infrastructure Sync to drop/go down on the workload SSP. The fix implements leadership-based re-evaluation in CertificateShardingServiceImpl so that upon becoming leader, it re-evaluates and generates any missing cluster certificates automatically. | https://knowledge.broadcom.com/external/article/434265
|
| NSX 4.2.x Branch: Scheduled to be fixed in an upcoming NSX version NSX 9.x Branch: Scheduled to be fixed in an upcoming NSX version | 5.1.1, 5.2.0 | Refer to published KB. |
| 13 | Discovery IP addresses (ip_discovery_ips) for a Virtual Machine fail to update or display correctly in Druid/SSP following cross-vCenter VM migrations or network interface disconnect/reconnect events. This occurs due to a race condition where VniMsg events (e.g., CREATE, DELETE, CREATE) are spread across separate delta sync cycles, resulting in cache update misses. Consequently, running recommendation jobs for the affected VM returns "Nothing to Recommend," even when unprotected flows are present. | https://knowledge.broadcom.com/external/article/451492
|
| NSX 4.2.x Branch: Scheduled to be fixed in an upcoming NSX version NSX 9.x Branch: Scheduled to be fixed in an upcoming NSX version | 5.1.1, 5.2.0 | Refer to published KB |
| 14 | When managing gRPC connections or consumer configurations with external services such as Avi/SSP in NSX Manager, thread termination in Impact: Leaked threads accumulate over time, continuously waking up every 100 ms to consume CPU cycles, leading to high NSX Manager CPU usage, high load averages, and potential management plane unresponsiveness. | https://knowledge.broadcom.com/external/article?articleNumber=442855
|
| NSX 4.2.x Branch: Scheduled to be fixed in an upcoming NSX version NSX 9.x Branch: Scheduled to be fixed in an upcoming NSX version | 5.1.1, 5.2.0 | Refer to published KB |
| 15 | Policy Recommendation failures or warnings in Security Intelligence due to stale/ghost compute UUIDs remaining in groups after VM deletion operations. Symptom:
Cause: During VM backup/restore workflows (e.g., using third-party backup tools like Commvault), a temporary backup VM is created that retains the same Virtual Interface (VIF) / | https://knowledge.broadcom.com/external/article/440687
|
| NSX 4.2.x Branch: Scheduled to be fixed in an upcoming NSX version NSX 9.x Branch: Scheduled to be fixed in an upcoming NSX version | 5.1.1, 5.2.0 | Refer to published KB |
| 16 | When running SSP 5.2 connected to NSX version 4.2.0, the ATP POV score displays as 0 for all IDPS categories, and Security Assessment report generation/score calculation fails or is blocked. This occurs because SSP 5.2 does not sync ids_rule and security_feature_toggle tables from NSX 4.2.0, preventing IDPS and combined DFW+IDPS coverage data from being accurately calculated. | Release Notes Link |
| NSX 4.2.x Branch: Scheduled to be fixed in an upcoming NSX version NSX 9.x Branch: N/A | 5.1.1, 5.2.0 | Refer to Release Notes |
Feedback
