VMs drop from NSX dynamic groups when VMware Tools is not running
search cancel

VMs drop from NSX dynamic groups when VMware Tools is not running

book

Article ID: 449656

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

In VMware NSX, virtual machines (VMs) are unexpectedly removed from dynamic NSX security groups when the guest-side VMware Tools service is stopped or not installed.

Observed symptoms include:

  • Virtual machines drop from dynamic NSX security groups unexpectedly.

  • Guest attributes in the NSX Manager UI display as "Not Set" or "N/A".

  • Network traffic hits default drop firewall rules despite confirmed underlying network Layer 2/3 reachability.

  • VMware Tools is either not installed or the service is not currently running inside the guest operating system.

Environment

VMware NSX

Cause

Dynamic group membership criteria is configured using the Computer Name attribute, which depends on the active guest-side VMware Tools daemon to populate inventory metadata.

Resolution

Update the dynamic group membership criteria in NSX Manager to utilize control-plane or inventory-based attributes that operate independently of guest OS daemons:

  1. Log in to NSX Manager.

  2. Navigate to Inventory > Groups.

  3. Select the impacted Group and click Edit.

  4. Under Membership Criteria, locate the rule evaluating Computer Name.

  5. Change the attribute dropdown to Name (vSphere VM Display Name) or Tag.

    • If selecting Name, ensure the value matches the VM name in vCenter Server.

    • If selecting Tag, ensure the VM object has the corresponding NSX or vSphere tag assigned.

  6. Click Apply and Save.

  7. Verify that the VM correctly populates under Effective Members.

Note: By utilizing NSX Tags, group membership is driven by control-plane metadata attached directly to the VM object UUID. Just as the ARP snooping table maintains a realized IP-to-MAC binding in the dataplane to automatically keep a VM in an IP-based group during a VMware Tools outage, an NSX Tag acts as a persistent, stateful binding in the control plane. This ensures the VM remains securely locked into its assigned firewall group completely independent of guest OS daemon status, IP address configuration, or active dataplane traffic.

Additional Information

NSX Distributed and Gateway Firewalls drop VM traffic when IP discovery is through VM Tools.

Distributed firewall rules fail to apply on VMs without VMware tools.

Powered by Wolken Software