Endpoint Protection goes into failed state and shows error: "Could not find service definition for the given service definition id"

Products

• VMware NSX

Issue/Introduction

• When a user unregisters and re-registers Endpoint Protection service with an NSX Manager, the Service Profile for Endpoint Protection goes into failed state
• On NSX 3.x, the error shown is: "Could not find service definition for the given service definition id" on NSX Version 3.x
• On NSX 4.x, the error shown is: "ServiceDefinition id <service-id> <service-name> not found on MP"

Environment

VMware NSX 

Cause

When an Endpoint Protection service profile is created from the UI, it creates a Policy object known as a service reference for the particular service that is registered to the NSX Manager. If the user later wants to remove the service, the service deployments, endpoint rules and service profile are removed from the UI, and the Endpoint Protection service is unregistered from the NSX manager. If the user attempts to register the service again with the same NSX manager, the operation succeeds. However, when creating a new service profile, a stale service reference of the earlier service definition is found. As the earlier service has already been deleted, the operation throws the error: "Could not find service definition for the given service definition id."

Resolution

This is a known issue impacting VMware NSX.

Workaround:

1. First delete Endpoint Protection Rules attached to failed Service Profiles and also delete failed Service Profiles in NSX.
2. Check API call  "GET /policy/api/v1/infra/service-references."
3. Delete particular service reference pointing to the service using API call "DELETE /policy/api/v1/infra/service-references/<id>"
4. Refresh the Service Profiles tab.
5. Attempt to recreate Service Profile.