VxRail: Node Health-checks Fail with Message 'firewall'
Summary: Dell VxRail node health-checks query that the ESXI fire wall rules meets the requirements for the upgrade.
Symptoms
VxVerify runs several tests on each node by uploading a 'minion' heath-check program, which detects issues that may cause upgrades to fail. Node health-checks such as 'firewall'.
If one of the checks that the SSH Client/DHCP Client rules have ALL or 169.254.0.* and that DHCP Client is set to True.
Test Result
|
Result code
|
Result Interpretation
|
Pass
|
0
|
No problems found with SSH/DHCP Ruleset |
Warning
|
1
|
This test has no warning result. |
Failure |
2 |
SSH/DHCP Client missing 169.254.0.* / DHCP false |
Critical |
3 |
This test has no critical result.
|
An example of the health-check output, when ESXI is not responding, is shown below:
#========================#======#=========#====================================================================#==============# | Hostname / Category |Status Dell_KB | Warnings or Failures, unless tests Passed ; Product S.N. | #========================#======#=========#====================================================================#==============# | Node1 | Failure 219836| TBC: TBC .|
Cause
The health-checks issue commands on the ESXi fire wall rules with commands such as the following:
This command checks if the dhcp client is enabled.
esxcli network firewall ruleset list --ruleset-id dhcp
This command check allowed ip list for dhcp (the customer may have their own ips there as well).
esxcli network firewall ruleset allowedip list --ruleset-id dhcp
This command check for the allowed ip list for sshClient (the customer may have their own ips there as well).
esxcli network firewall ruleset allowedip list --ruleset-id sshClient
Resolution
The firewall rules can be checked in the VC UI Under firewall.
One method to correct this would be to add the 169.254.0.0/16 to the sshClient dhcp Client in the UI and check that the DHCP Client is set to TRUE.
You can also run the below commands from the ESXI CLI.
esxcli network firewall ruleset set --ruleset-id dhcp --enabled true
esxcli network firewall ruleset allowedip add -i 169.254.0.0/16 -r sshClient
esxcli network firewall ruleset allowedip add -i 169.254.0.0/16 -r dhcp
esxcli network firewall load
esxcli network firewall refresh