Stale IP Addresses in NSX-T Dynamic Security Groups due to Trust on First Use

Products

• VMware vDefend Firewall

Issue/Introduction

Dynamic security groups in NSX-T may retain outdated IP addresses for virtual machines, including Avi Service Engines, after an IP change. This issue occurs when the IP Discovery Segment Profile is configured with "Trust on First Use" (TOFU) enabled, preventing the system from automatically updating the realized IP bindings.

Environment

VMware vDefend Firewall.

Cause

By default, ARP and ND snooping operate in "Trust on First Use" (TOFU) mode. In this mode, NSX learns the first IP address assigned to a port and stores it permanently in the IpDiscoveryPersistedBinding table. This entry does not automatically age out or update when the IP changes, leading to stale entries in dynamic security groups.

Resolution

Resolution: To resolve this issue, configure the affected segment to use "Trust on Every Use" (TOEU) mode to allow stale bindings to age out.

1. Create a Custom IP Discovery Profile:

   • Navigate to Networking > Segments > Profiles.
   • Add a new IP Discovery profile.
   • Set Trust on First Use (TOFU) to Disabled.
   • Set the ARP Binding Limit to a value greater than or equal to the maximum number of IPs expected on a single port.

2. Apply the Profile:

   • Navigate to the affected Segment.
   • Edit the segment and apply the newly created custom IP Discovery profile.

3. Wait for Aging:

   • Allow at least 10 minutes (default timeout) for stale realized bindings to age out of the IpDiscoveryPersistedBinding table.

4. Verification:

   • Verify that the stale IP is removed and the correct current IP is realized.
   • If strict security policies require TOFU, re-apply the original profile after the bindings have correctly updated.

Additional Information

• Contact Broadcom Support
• For further updates on product fixes, subscribe to this article.