Dell Automation Platform: Deployment Fails as Host Firewall Blocks Pod Network Traffic

Summary: During a software bundle deployment, a host firewall may be configured to block traffic on Kubernetes pod network interfaces. This prevents the Container Network Interface (CNI) plugin from communicating. This issue is observed with McAfee Endpoint Security firewall but may occur with any host firewall solution. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

  • Software deployment output shows
    • "FAILED ChartKey: PORTAL"
    • "Deployment is not ready: NAMESPACE/POD 0 out of 1 expected pods are ready"
  • Multiple pods in the application namespace remain stuck in Init state
  • Pods events show a failure to mount volumes
  • Storage volumes show as NOT READY for workloads:
AttachVolume.Attach failed for volume "pvc-8b562b80-0987-4aca-8c50-01471ef005c4" : rpc error: code = Aborted desc = volume pvc-8b562b80-0987-4aca-8c50-01471ef005c4 is not ready for workloads
  • Host's journalctl logs contain firewall deny messages on CNI interfaces:
May 11 19:31:52 ORCHESTRATOR1 kernel: MFE_O_A_Deny_AllIN= OUT=cali38e8bc45c94 SRC=10.24.125.7 DST=161.200.187.74 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=1724 DF PROTO=TCP SPT=39566 DPT=9501 WINDOW=64800 RES=0x00 SYN URGP=0 MARK=0x11e
  • Longhorn Container Storage Interface (CSI) plugin communication fails
  • Vault Bootstrap pod runs but fails to create the required secrets
  • All application pods fail to initialize after Calico network plugin deployment

Cause

The host firewall may be configured to block traffic on interfaces used by the CNI plugin. When Calico or other CNI plugins create virtual network interfaces for pod communication, the host firewall treats these as untrusted and blocks traffic. This prevents:

  • Longhorn CSI plugin communication with the storage manager on port 9501
  • Pod-to-host communication required for volume attachment operations
  • Kubernetes API server to pod communication
  • DNS resolution for pods

 

Note: If failure analysis is unclear, follow the article Dell Automated Platform: How to Retrieve a Log Bundle for Troubleshooting to gather the log bundle when raising a case with support.

Resolution

  1. Configure the host firewall to allow Kubernetes traffic:
    1. Add firewall exceptions for CNI interface patterns (veth*, cali*, flannel*, weave*)
    2. Add exceptions for the pod network CIDR range
    3. Allow traffic on required ports:
      • Port 9501 for Longhorn CSI
      • Ports 8080 and 8443 for API servers
      • Port 6443 for Kubernetes API
    1. Allow Kubernetes API server communication
  1. Test the firewall configuration:
    1. Temporarily disable the host firewall to confirm it resolves the issue
    2. Monitor pod startup and volume attachment after firewall changes
    3. Check system logs for successful pod communication
  1. After firewall fix, restart the deployment process:
    1. Delete the Portal an Orchestrator namespaces
    2. Restart the deployment script.
  1. Confirm that all application pods reach Running state.

Affected Products

Dell Automation Platform, Dell Distributed Private Cloud, Dell Automation Platform Components, NativeEdge
Article Properties
Article Number: 000466331
Article Type: Solution
Last Modified: 03 يوليو 2026
Version:  4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.