DHCP offer packets from a DHCP server are blocked after VCF converge and inventory synchronization.

Products

• VMware NSX
• VMware Cloud Foundation
• VMware vDefend Firewall

Issue/Introduction

Symptoms
After converging an existing NSX4.x to a VCF9.x environment and performing an inventory synchronization, you may observe the following:

• Virtual machines or servers are unable to obtain IP addresses via DHCP.
• An NSX Transport Node Profile (TNP) is automatically assigned to clusters that were not previously prepared for NSX.
• "NSX on DVPGs" is automatically enabled for this cluster.
• The default Segment Security Profile is applied to existing DVPGs, causing DHCP offer packets from a DHCP server to be blocked.

Environment

VMware NSX 4.x / 9.x
VMware Cloud Foundation 9.x
VMware vDefend Firewall

Cause

This behavior is expected in VCF 9.x as part of the management of configuration drift between vCenter Server and SDDC Manager. During inventory synchronization, if a cluster is not configured for NSX, SDDC Manager applies a TNP to the cluster and installs NSX. Additionally, "NSX on DVPGs" is enabled. This results in the application of the default Segment Security Profile, which blocks DHCP offer packets from a DHCP server.

This behavior is described in the following document.
Remediate VCF Domain Configuration Drift

Resolution

To prevent service disruption during the VCF converge and synchronization process, consider the following options:

• Manually apply a TNP to the cluster before performing synchronization. For example, use a TNP that only includes a new VLAN transport zone with no segments created.
  1. Log in to the NSX Manager UI.
  2. Navigate to [System] - [Fabric] - [Hosts] - [Transport Node Profile].
  3. Click "Add Transport Node Profile".
  4. Create a TNP with the VLAN transport zone applied.
  5. Navigate to [System] - [Fabric] - [Hosts] - [Clusters].
  6. Check the cluster where NSX will be installed.
  7. Click "Configure NSX", then select the TNP created in Step 4, and click "SAVE".

If the issue has already occurred:

• Disabling "NSX on DVPG" from the cluster settings.
  1. Log in to the NSX Manager UI.
  2. Navigate to [System] - [Fabric] - [Hosts] - [Clusters].
  3. Check the affected clusters.
  4. Click "Deactivate NSX on DVPGs" from [ACTIONS].
  
  
• Create a new segment security profile with "Server Block" disabled and apply it to the DVPG.
  1. Log in to the NSX Manager UI.
  2. Navigate to [Networking] - [Segments] - [Profiles] - [Segment Profiles].
  3. Create a new Segment Security Profile and ensure the DHCP Server Block setting is toggled to Disabled.
  4. Navigate to [Networking] - [Segments] - [Distributed Port Groups]
  5. Edit the affected DVPG and change it to the Segment Security Profile created in Step 3.

Additional Information

Refer to the following document for information regarding NSX on DVPGs.
Activate NSX on Distributed Virtual Port Groups

Refer to KB437286 for the issue where the default Segment Security Profile affects DHCP.
Virtual Machines Not Receiving DHCP Offers Due to NSX Segment Security Profile