Application Port Profiles Reflect Across Multiple Organizations in VMware Cloud Director

Products

• VMware Cloud Director
• VMware NSX

Issue/Introduction

This article addresses an issue in VMware Cloud Director (VCD) where custom Application Port Profiles created within a specific Organization are visible and functional in other Organizations within the environment. This behavior results in firewall rules being applied globally rather than remaining isolated within the intended Organization VDC, violating multi-tenancy isolation.

Environment

VMware Cloud Director 10.6.1.x
VMware NSX 4.1.x

Cause

The issue is caused by Application Port Profiles being created at the Provider scope, or utilizing identical names across multiple Organizations.

In NSX-T, Application Port Profiles defined at the Provider level are treated as global entities. If profiles in different Organizations share the same name, or if the profile is defined at the Provider scope, NSX-T collapses these configurations into a single shared service. This causes the profile configuration to be applied globally across the NSX-T environment rather than being scoped to a specific Organization.

Resolution

This issue has not been observed within NSX 4.2.x. Upgrade to NSX 4.2.x or later and confirm if the issue is resolved. 

Workaround

If an immediate upgrade is not feasible, apply the following configuration changes to enforce logical isolation:

1. Enforce Unique Naming: Ensure all custom Application Port Profiles use unique names that include the Organization identifier. Example: Instead of Web_HTTPS_Port, use Web_HTTPS_OrgA and Web_HTTPS_OrgB.

2. Tenant-Scoped Creation: Ensure that all custom Application Port Profiles are created exclusively via the Tenant Portal (rather than the Provider Portal).

   1. Log in to the Tenant Portal.
   2. Navigate to Networking > Edge Gateways.
   3. Click on the Edge name.
   4. Navigate to Security > Application Port Profiles.
   5. Create the new custom Application Port Profile within this context to ensure it is scoped to the specific Organization.

Additional Information

The scope of an Application Port Profile can be identified sending a GET to the Application Port Profiles API /cloudapi/1.0.0/applicationPortProfiles and reviewing the output.