Policy recommendations display "Nothing to recommend" due to missing or incorrect VM Discovery IP addresses

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

When attempting to run Policy Recommendations for a specific Virtual Machine (VM) in SSP, the system displays a "Nothing to recommend" message. This occurs because the VM's IP address displayed in vCenter Server does not match the discovery IP address stored in SSP, which continues to reflect the older or missing IP.

Environment

NSX 9.1, NSX 9.0.x, NSX 4.2.3.x and earlier versions

Cause

This is caused by a timing issue that occasionally occurs during a VM migration (vMotion) when a new IP address is assigned. If the network disconnect and reconnect events span across two separate synchronization cycles, the system may fail to update the IP address in SSP.

Resolution

Resolution: This issue is resolved in VMware NSX 4.2.4.x and later releases.

Workaround: For earlier NSX releases, you can resolve this issue by restarting the proton service on the NSX Manager which eventually will trigger data full sync to SSP

Steps for restarting the proton service on NSX Manager:

1. Identify the Intelligence agent service leader node. SSH into any NSX Manager node and run the following command to get the <uuid> : 

su admin -c "get cluster status verbose" | grep INTELLIGENCE_AGENT_SERVICE 

2. Run the following command to find the IP address of the leader node: 

su admin -c "get cluster status" | grep <uuid>

3. Log in to the NSX Manager appliance (leader node) via SSH using the IP address retrieved in the previous step. 

4. Restart the service by running the following command: 

systemctl restart proton

5. Wait for few minutes data full-sync on SSP to start and then watch postgres database till full sync is completed and published. Once data full sync is done recommendations can be run executed again.

A . Login to postgres from SSPi

  i : Get the postgres password by running following command.

     k get secret postgresql-password -o jsonpath='{.data.postgresql-password}' | base64 -d

 ii: Apply the obtained password from previous step to the PGPASSWORD value following command to access the postgres CLI.
         

      k exec -it postgresql-ha-pg-0 -- /bin/bash -c "PGPASSWORD=PGwAeX2IpBCDlnrA3gQt62x7crRJMMRe psql -d pace"

B : Run following SQL query and wait till the published column is `t`

SELECT a.agentseentime agentseentime,to_timestamp(a.starttime/1000) AS starttime, epoch, fullsynccomplete,published FROM nsx_config.policynsxconfigepoch a ORDER BY epoch DESC limit 1;

C. exit postgres using following commmad

\q

 

Note: Please reach out to Global Support Services (GSS) if you still experience the issue after the proton restart.