NSX Field Advisory – March 2017 Edition

Important Note
Subscribe to RSS Feed http://feeds.feedburner.com/NSX for up-to-date information on new products, patches and fix announcements regarding VMware NSX for vSphere.

Minimum Recommended Release

NSX for vSphere 6.2.2 and vSphere 6.0 Update 2 remains the recommended release combination. For more information, see Minimum recommended version for NSX for vSphere with GID, ESXi and vCenter Server (2144295).

GA Announcement

VMware NSX for vSphere 6.2.6 and 6.3.0 is now available for download.

• https://my.vmware.com/web/vmware/info/slug/networking_security/vmware_nsx/6_x
• NSX for vSphere 6.2.6 Build 4977495
• NSX for vSphere 6.3.0 Build 5007049

Fixed issues in NSX for vSphere 6.3.0

• Windows VM with NSX Network Introspection driver lose TCP connectivity (2148218)
• NSX Edge uplink interface does not process any traffic after it is disabled and re-enabled (2145468)
• Creating or upgrading the NSX 6.x Edges fails after adding an IPv6 address under NSX Management interface (2127561)
• IPv4 IP address do not get auto approved when SpoofGuard policy is set to Trust On First Use (TOFU) (2144649)
• NSX Edge virtual machine does not failover during a vSphere HA event (2143998)
• NSX Plugin does not appear in Web Client when ESXTOP plug-in installed (2145808)
• Floating Static Routes are preferred to OSPF Dynamic Routes (2147998)
• VM fails to add in Dynamic Security Groups (2146757)
• Netcpa stops running on an ESXi host that runs a Bridging DLR VM (2147181)
• DFW rules change order unexpectedly when published (2146471)

For additional information, see the NSX for vSphere 6.2.6 and NSX for vSphere 6.3.0 Release Notes.

Top issues and What to Do

VMware NSX for vSphere 6.3.0

Issue #1:

Symptom: What is the minimum supported version of vSphere 6.5 with NSX for vSphere 6.3.0?

Resolution: The minimum supported version of vSphere 6.5 with NSX for vSphere 6.3.0 is vSphere 6.5a. For more information, see For sites running VMware vSphere 6.5, vSphere update 6.5a is the minimum supported version with NSX for vSphere 6.3.0 (2148841).

Issue #2:

Symptom: During an upgrade to VMware NSX for vSphere 6.3.0 where an HW VTEP is used in the environment, you may experience these symptoms:

• Upgrade is halted.

• You see an error similar to:
  Cannot continue upgrade due to errors: “(1)” Hardware Gateway(s) found in the system. Unable to proceed with the upgrade. Please contact VMWare Support to continue. Please correct before proceeding.

Workaround: Contact VMware Support. To contact VMware support, see Filing a Support Request in My VMware (2006985) or How to Submit a Support Request. VMware can assist in verifying your Hardware Gateway is TLS 1.2 compliant which allows the upgrade to move forward. For more information, see Upgrading to NSX for vSphere 6.3.0 fails when using Hardware Gateway (2148511).

VMware NSX for vSphere 6.1.x,6.2.0,6.2.1

Issue #1:

Symptom: If there is a cipher chain listed that is separated by commas (“,”), then upgrade from NSX for vSphere 6.1.x, 6.2.0, and 6.2.1 to NSX for vSphere 6.2.5 fails

Resolution: Starting with NSX for vSphere 6.2.6, you can separate the ciphers with colons (“:”) instead of commas (“,”) before the upgrade.

VMware NSX for vSphere 6.2.4

Issue #1:

Symptom: Relating to CVE-2016-2107, the NSX Edge OpenSSL package is not updated with 1.0.2j.

Resolution: Starting with NSX for vSphere 6.2.6, NSX Edge OpenSSL package has been updated to 1.0.2j.

VMware NSX for vSphere 6.2.4/6.2.5

Issue #1:

Symptom: After upgrading your environment to NSX for vSphere 6.2.5 with vSphere High Availability (HA) enabled on a cluster having insufficient resources, you experience this symptom:
Upgrading the NSX Edge fails.

Workaround: This is as per the design. Refer the table below for the resource reservations used by the NSX Manager if you have not explicitly set values at the time of install or upgrade.

NSX Edge

Note: Always ensure that your installation follows the best practices laid out for vSphere High Availability (HA). For more information, see Best practices and advanced features for VMware High Availability (1002080)

VMware NSX for vSphere 6.2.1

Issue #1:

Symptom: When configuring DHCP relay agents on distributed logical router in NSX for vSphere, you experience these symptoms:

• Virtual machines configured on Logical Switches where a DHCP relay agent is configured do not obtain IP addresses.
• The DHCP server does not receive any initial DHCP discovery packets from the relay agent.
• DHCP discovery packets are dropped in transit due to TTL expiry.

Resolution: This issue is resolved in NSX for vSphere 6.2.5. For more information, see DHCP relay agents do not function in NSX (2147322).

NSX for vSphere 6.2.2 is still the “bare minimum” recommended release. For more information, see Minimum recommended version for NSX for vSphere with GID, ESXi, and vCenter Server (2144295).

Note: The Guest Introspection section has been recently updated. The recommended VMware Tools version is 10.1.0 and later.

Partners interested in receiving more information on NSX updates can find them on the Support Insider Blog or by self-nominating to receive regular NSX communications.