NAT Rule Priority Unexpectedly Changes in NSX

Products

• VMware NSX

Issue/Introduction

• NAT rules appear to shift priority automatically.
• Sudden service disruption occurs due to a NAT rule no longer being evaluated in the expected order.
• Network services (ie. DNS) fail because a higher-priority rule is now matching traffic first.
• Log entries similar to the below are seen in the NSX Manager logs:
  • Note that the below logs contain the Nat rule ID, old NAT rule priority, new NAT rule priority, API username and source.
     
    /var/log/syslog
    
    

    <NSX Manager Node> NSX 4699 ROUTING [nsx@6876 comp="nsx-manager" level="INFO" reqId="<Req ID>" subcomp="manager" username="<NSX Manager Username>"] Updated NAT Rule <Internal NAT Rule ID>.
    ---
    <NSX Manager Node> NSX 4699 ROUTING [nsx@6876 audit="true" comp="nsx-manager" depr="true" entId="<NAT Rule ID>" level="INFO" method="PUT" path="/nsxapi/rpc/call/NatFacade" reqId="<Req ID>" subcomp="manager" update="true" username="admin"] UserName="admin", Src="<Source Hostname or IP>", ModuleName="Nat", Operation="UpdateNatRule", Operation status="success", Old value=[{"rule_priority":<Old Rule Priority>,"action":"SNAT","match_destination_network":"<Destination Network>","translated_network":"<Translated Network>","enabled":true,"logging":false,"logical_router_id":"<Logical-Router ID>","firewall_match":"BYPASS","internal_rule_id":"<Internal NAT Rule ID>","pb_vpn_mode":"BYPASS","resource_type":"NatRule","id":"<NAT Rule ID>","display_name":"<Internal NAT Rule ID>","_create_time":1595330768658,"_create_user":"<NSX Manager Username>","_last_modified_time":1770196532834,"_last_modified_user":"<NSX Manager Username>","_system_owned":false,"_protection":"NOT_PROTECTED","_revision":136}], New value=["<Logical-Router ID>" "<NAT Rule ID>" {"rule_priority":<New Rule Priority>,"action":"SNAT","match_destination_network":"<Destination Network>","translated_network":"<Translated Network>","enabled":true,"logging":false,"firewall_match":"BYPASS","pb_vpn_mode":"BYPASS","resource_type":"NatRule","id":"<NAT Rule ID>","display_name":"<Internal NAT Rule ID>","_system_owned":false,"_protection":"UNKNOWN","_revision":136}]15:46:

Environment

VMware NSX

Cause

This behavior typically occurs when an external API call is made to update the firewall or NAT configuration.

NSX does not autonomously change rule priorities as a background task. Instead, the change is triggered by:

1. Manual API Calls: A user or script directly updates a rule via the NatFacade or Policy API.
2. Automation Sync: Tools like Terraform or Ansible perform a "full state sync," which can reorder rules if the priority is not explicitly defined.
3. Mix-Mode Configuration: A conflict between Management Plane (MP) and Policy API configurations forces the system to re-calculate and re-realize the rule order.

Resolution

This is a condition that may occur in a VMware NSX environment.

Workaround
If the change was unintended, adjust the rule priority value back to the desired value and review the automation scripts on the source host (if applicable) to prevent future overwrites.

For more information on configuring NAT rules, see the NSX Administration Guide.