Hello,
I am trying to use a Distributed Switch to filter traffic on port level. I am able to create these rules through the Web Client, and when I do, they work as intended. However, I wish to make these changes automatically through the vSphere WebService-API. The XML-request I send can be found below, but it does not work at all, even though it is accepted and the task is completed without errors.
<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="urn:vim25" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <SOAP-ENV:Body> <ns1:ReconfigureDVPort_Task> <ns1:_this type="VmwareDistributedVirtualSwitch">dvs-101</ns1:_this> <ns1:port> <ns1:operation>edit</ns1:operation> <ns1:key>0</ns1:key> <ns1:name>New Test</ns1:name> <ns1:setting xsi:type="VMwareDVSPortSetting"> <filterPolicy> <inherited>false</inherited> <filterConfig xsi:type="DvsTrafficFilterConfig"> <inherited>false</inherited> <agentName>dvfilter-generic-vmware</agentName> <trafficRuleset> <enabled>true</enabled> <precedence>1</precedence> <rules> <description>Drop all</description> <sequence>40</sequence> <qualifier xsi:type="DvsIpNetworkRuleQualifier"/> <qualifier xsi:type="DvsMacNetworkRuleQualifier"/> <action xsi:type="DvsDropNetworkRuleAction"/> <direction>both</direction> </rules> </trafficRuleset> </filterConfig> </filterPolicy> </ns1:setting> </ns1:port> </ns1:ReconfigureDVPort_Task> </SOAP-ENV:Body></SOAP-ENV:Envelope>
It appears in the Web Client as if it is live and working, but no filtering is applied. In the /var/log/vmkernel.log on the host, I notice that the settings are first added but then removed. See below on row 11: "Applying 4 fastpath firewall rules (with replace: 1)" then on row 14: "Applying 0 fastpath firewall rules (with replace: 1)":
2014-07-14T12:30:01.762Z cpu8:35605)World: 14296: VC opID hostd-3afd maps to vmkernel opID 706706e5 2014-07-14T12:30:03.095Z cpu10:35605 opID=cd2394aa)World: 14296: VC opID 545c582b-ea maps to vmkernel opID cd2394aa 2014-07-14T12:30:03.095Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.common.port.connectid on port 0 2014-07-14T12:30:03.095Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.common.port.portgroupid on port 0 2014-07-14T12:30:03.096Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.common.port.block on port 0 2014-07-14T12:30:03.096Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:999: clearing data com.vmware.common.port.shaper.input on port 0 2014-07-14T12:30:03.096Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:999: clearing data com.vmware.common.port.shaper.output on port 0 2014-07-14T12:30:03.097Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.common.port.dvfilter on port 0 2014-07-14T12:30:03.097Z cpu5:33423 opID=cd2394aa)DVFilter: 3671: Already one filter instance of this agent on this vNic: 'dvfilter-generic-vmware' 2014-07-14T12:30:03.097Z cpu10:35605 opID=cd2394aa)dvfilter-generic-fastpath: DVFGenericRulesetPropWrite:81: Got DVFGenericPropWrite of length 1139 2014-07-14T12:30:03.097Z cpu10:35605 opID=cd2394aa)dvfilter-generic-fastpath: FWApplyRuleset:736: 0-swb8 08 20 50 16 45 69 ee-02 de 94 39 fe 0f 57 fe.dvfilter-generic-vmware.0: Applying 4 fastpath firewall rules (with replace: 1) fwFeatures = 0x0 2014-07-14T12:30:03.097Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data dvfilter-generic-vmware.ruleset on port 0 2014-07-14T12:30:03.097Z cpu10:35605 opID=cd2394aa)dvfilter-generic-fastpath: DVFGenericRulesetPropWrite:81: Got DVFGenericPropWrite of length 15 2014-07-14T12:30:03.097Z cpu10:35605 opID=cd2394aa)dvfilter-generic-fastpath: FWApplyRuleset:736: 0-swb8 08 20 50 16 45 69 ee-02 de 94 39 fe 0f 57 fe.dvfilter-generic-vmware.0: Applying 0 fastpath firewall rules (with replace: 1) fwFeatures = 0x0 2014-07-14T12:30:03.097Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data dvfilter-generic-vmware.ruleset on port 0 2014-07-14T12:30:03.098Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:999: clearing data com.vmware.common.port.respool.assoc on port 0 2014-07-14T12:30:03.098Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.common.port.ptAllowed on port 0 2014-07-14T12:30:03.098Z cpu10:35605 opID=cd2394aa)Team.etherswitch: TeamESPolicySet:5483: Port 0x3000004 frp numUplinks 1 active 1(max 1) standby 0 2014-07-14T12:30:03.098Z cpu10:35605 opID=cd2394aa)Team.etherswitch: TeamESPolicySet:5491: Update: Port 0x3000004 frp numUplinks 1 active 1(max 1) standby 0 2014-07-14T12:30:03.098Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.etherswitch.port.teaming on port 0 2014-07-14T12:30:03.098Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.etherswitch.port.security on port 0 2014-07-14T12:30:03.099Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.etherswitch.port.vlan on port 0 2014-07-14T12:30:03.099Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:999: clearing data com.vmware.etherswitch.port.ipfix on port 0 2014-07-14T12:30:03.099Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.etherswitch.port.txUplink on port 0 2014-07-14T12:30:03.100Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:999: clearing data com.vmware.etherswitch.port.lacp on port 0 2014-07-14T12:30:03.100Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:993: setting data com.vmware.common.port.volatile.persist on port 0 2014-07-14T12:30:03.101Z cpu10:35605 opID=cd2394aa)DVSDev: DVSDevDataSet:999: clearing data com.vmware.etherswitch.port.mirrorSessions on port 0 2014-07-14T12:30:04.394Z cpu14:35496)World: 14296: VC opID hostd-8977 maps to vmkernel opID 73a4491f
An even stranger problem arises when I later use the Web Client to try and edit the (nonworking) settings. Doing so, I am presented with an error on save. The error is shown in the picture below. This error persists until i manually disable traffic filtering on the port.
My questions are as follows:
What is this undocumented agentName-parameter? If I leave it out I get "A general system error occurred: Not initialized". If I pass it, the vCenter starts behaving as described above.
Has anyone else encountered this or a similar problem? If so, what did you do to solve it?
Any help is appreciated
Thanks,
Andreas