IDFW is disabled on all host clusters every 5 minutes in NSX

Products

• VMware vDefend Firewall

Issue/Introduction

Even though IDFW is enabled on host clusters:

IDFW rules are not realized on hosts in host clusters.

In NSX, /var/log/proton/nsxapi.log logs the following message:

2026-09-16T22:50:00.049Z INFO NSX 9735 [nsx@4413 comp="nsx-manager" level="INFO" logger="ProviderInvocationTask" msgID="POLICY" subcomp="manager" threadName="providerTaskExecutor-1-1"] ProviderInvocationTask: 1489007882 calling pushPolicyIntent on provider IdfwIdsToggleProviderNsxT with key: IdfwIdsToggleProviderNsxT-project-paths for operation PushPolicyIntent from 6 paths with {DfwFirewallConfiguration=[/orgs/default/projects/project-01/infra/settings/firewall/security]}

The following message should be logged in a working scenario:

2026-09-16T22:50:00.049Z INFO NSX 9735 [nsx@4413 comp="nsx-manager" level="INFO" logger="ProviderInvocationTask" msgID="POLICY" subcomp="manager" threadName="providerTaskExecutor-1-129"] ProviderInvocationTask: 424576290 calling pushPolicyIntent on provider IdfwIdsToggleProviderNsxT with key: IdfwIdsToggleProviderNsxT-local-paths for operation PushPolicyIntent from 4 paths with {DfwFirewallConfiguration=[/infra/settings/firewall/security]}

First, IdfwIdsToggleProviderNsxT is printed in both working and non-working scenario. In the non-working scenario, /orgs/default/projects/<project name>/infra/settings/firewall/security is printed in the message. Comparing the working case, /infra/settings/firewall/security is printed.

There is a similar KB covers the federation deployments:
https://knowledge.broadcom.com/external/article?articleNumber=455440

 

Environment

• NSX 9.1.0.x and NSX 9.1.1.
• IDFW is enabled
• There is at least one project created in NSX
• NSX Manager is not onboarded to a GM (Global Manager)

Cause

When projects are configured on NSX, NSX mistakenly include projects to calculate the path for firewall security setting. As a result, IDFW setting for all host clusters is set as false, which is the default value.

Resolution

This issue is resolved in VMware NSX 9.1.1.0100.