"Failed to restore PF state : Limit exceeded" error after NSX upgrade

Products

VMware NSX Networking

Issue/Introduction

Upgrading to VMware NSX for vSphere 6.2.5 resolves the issue.

Symptoms:
Virtual machines lose network connectivity after vMotion under the following conditions:

Distributed Firewall (DFW) is enabled in the environment and;
NSX for vSphere setup upgraded from NSX-V 6.1.x release to NSX-V 6.2.3 releases and 6.2.4 release and virtual machines are later migrated between upgraded ESXi hosts.
When a virtual machine is migrated from an upgraded host to a non-upgraded host.

Notes:

This only affects virtual machines that are created in NSX for vSphere 6.1.x and migrated to 6.2.3 releases or 6.2.4 as part of an upgrade.
In addition to the above, you may also experience this issue for virtual machines created in 6.1.x and if you upgrade from 6.1.x to 6.2.2 and then upgrade to 6.2.3 releases or 6.2.4.
Customers that are upgrading from vCloud Networking and Security (vCNS) 5.5.x to NSX for vSphere 6.2.4 are not impacted.
For additional symptoms and log entries, see the Additional Information section in this KB.

Environment

VMware NSX for vSphere 6.2.x
VMware NSX for vSphere 6.1.x

Cause

This issue occurs when the VSIP module at the kernel level does not handle the export_version deployed in NSX for vSphere 6.1.x correctly during the upgrade process.

Resolution

This issue is resolved in VMware NSX for vSphere 6.2.5, available at VMware Downloads.

To work around this issue if you do not want to upgrade, run a script that modifies the virtual machine export_version. To acquire the script and procedure, file a support request with VMware Support and note this KB Article 2146171 in the problem description. For more information, see How to Submit a Support Request.

Additional Information

You experience these additional symptoms:

In the /var/log/vmkernel.log file on the ESXi host, you see entries similar to:

2016-07-01T07:02:37.357Z cpu7:223405)WARNING: NetDVS: 547: portAlias is NULL
2016-07-01T07:02:37.357Z cpu7:223405)Net: 2312: connected VM eth0 to VM Network, portID 0x200000c
2016-07-01T07:02:37.362Z cpu7:223405)PFImportState: unsupported version: 0
2016-07-01T07:02:37.363Z cpu7:223405)vsip VSIPDVFRestoreState:1912: Failed to restore PF state : Limit exceeded
2016-07-01T07:02:37.363Z cpu7:223405)WARNING: NetPort: 1431: failed to enable port 0x200000c: Failure
2016-07-01T07:02:37.363Z cpu7:223405)NetPort: 1632: disabled port 0x200000c
2016-07-01T07:02:37.363Z cpu7:223405)WARNING: Net: vm 223391: 5353: cannot enable port 0x200000c: Failure
2016-07-01T07:02:37.383Z cpu7:223405)Net: 3354: disconnected client from port 0x200000c

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

To be alerted when this document is updated, click the Subscribe to Article link in the Actions box
in the Actions box.

NSX 升级后显示“无法还原 PF 状态: 已超出限制 (Failed to restore PF state: Limit exceeded)”错误
「状態の復旧に失敗しました：制限を超えました (Failed to restore PF state :Limit exceeded)」エラーが NSX のアップグレード後に発生する