vCDNI warning message

[jd3nn1s]

Hello,

Does anyone know what these messages from vmkernel.log mean exactly? We have 1000s of them.

2013-03-17T03:45:27.939Z cpu23:8215)vsla-fence: Fence_Decapsulate:297: port:41001cb49420:OPI:{02,000015} Drop unicast packet with hostKeyMac as dest mac
2013-03-17T03:45:27.939Z cpu23:8215)vsla-fence: Fence_Decapsulate:297: port:41001cb55ad0:OPI:{02,000036} Drop unicast packet with hostKeyMac as dest mac
2013-03-17T03:45:27.939Z cpu23:8215)vsla-fence: Fence_Decapsulate:297: port:41001cb56e00:OPI:{02,00001d} Drop unicast packet with hostKeyMac as dest mac
2013-03-17T03:45:27.939Z cpu23:8215)vsla-fence: Fence_Decapsulate:297: port:41001cb43f60:OPI:{02,00001a} Drop unicast packet with hostKeyMac as dest mac
2013-03-17T03:45:27.939Z cpu23:8215)vsla-fence: Fence_Decapsulate:297: port:41001cb596d0:OPI:{02,000004} Drop unicast packet with hostKeyMac as dest mac

Thanks.

[IamTHEvilONE]

I have seen these before, but do not know if they can be disabled somehow.

When I see these messages is typically because Promiscuous mode has been enabled and the Isolated network is getting packets taht it shouldn't get.  the amount of entries is directly related to the amount of packets the port group gets but shouldn't get (so dropped).

[jd3nn1s]

That was my theory too as we do use promiscuous mode on the fenced port group. Glad someone has the same theory.

[hennish]

Hi. Did you manage to solve this? We're getting between 10 and 100 messages per host per second (which Log Insight gracefully shows me graphically).

The error messages are for the nested ESXi hosts that we are running in the lab environment. If I vMotion them to different underlying hosts, those hosts start spewing these messages instead (again displayed by Log Insight in the "over time grouped by hostname" view).

Snippet:

---

2013-12-18T12:34:14.694Z esxi-03.rtsvl.local vmkernel: cpu14:135515)vsla-fence: Fence_Decapsulate:297: port:41000c4b1550:OPI:{01,00003e} Drop unicast packet with hostKeyMac as dest mac

2013-12-18T12:34:14.694Z esxi-03.rtsvl.local vmkernel: cpu14:135515)vsla-fence: Fence_Decapsulate:297: port:41000c4b27e0:OPI:{01,000044} Drop unicast packet with hostKeyMac as dest mac

2013-12-18T12:34:14.694Z esxi-03.rtsvl.local vmkernel: cpu14:135515)vsla-fence: Fence_Decapsulate:297: port:41000c4b3a70:OPI:{01,00003e} Drop unicast packet with hostKeyMac as dest mac

2013-12-18T12:34:14.694Z esxi-03.rtsvl.local vmkernel: cpu14:135515)vsla-fence: Fence_Decapsulate:297: port:41000c4b4d00:OPI:{01,00003f} Drop unicast packet with hostKeyMac as dest mac

2013-12-18T12:34:14.694Z esxi-03.rtsvl.local vmkernel: cpu14:135515)vsla-fence: Fence_Decapsulate:297: port:41000c4a6d80:OPI:{01,00004b} Drop unicast packet with hostKeyMac as dest mac

---

/Anders

[IamTHEvilONE]

The only workaround is to use a different network pool type completely.  e.g. Switch to VXLAN.

This is a known issue when using Promiscuous Mode with VCNI, and why one of the reasons Prom Mode isn't enabled by default (prom mode isn't needed for a lot of use cases, except a few like Nested hypervisors or network appliance testing).

[cfor]

Like IamTHEEvilONE has said - PROM networking will cause this.  If you have lots of traiffic it can crash the syslog process on the ESXi system and stop all logging.  If you get into that type of issue contact support, they have addressed this in the past and may be able to look into workarounds for the logging issues.

A side note, ask yourself why you are using PROM networking, many times (unless it is a network packet scanner) you can solve the issue a different way, promiscuous networking is VERY slow vs non-promiscuous.  The large use case we see is around nested esxi, there are ways to use nested esx (depending on what the real need is) without prom networking.

[hennish]

Thanks for the info!

Yes, the reason why we are running Prom Mode is because we are running nested ESXi hosts, which are part of the lab kits for the official VMware courses. I wasn't involved in setting it up, but I assume that was the best design choice back then.

Could you point me in the right direction on where to find more information on how to run nested ESXi hosts without using Prom Mode port groups? Would upgrading vSphere and vCD to 5.5 help us get more alternatives on how to achieve this?

(Ping magander )

[magander]

Hi,

don't think an upgrade to 5.5 will help. See the Promiscous mode section in the following blog, http://www.virtuallyghetto.com/2013/11/why-is-promiscuous-mode-forged.html

Haven't tested to set to reject though so i'm not certain.

[IamTHEvilONE]

Prom Mode is required for Nested ESXi hosts for some networking features to function, same with Forged Transmits (since nested VM MACs will be on the network traffic).

The logging of the vsla-fence message can become a burden on the physical ESXi host producing it.  Specifically Syslog cannot handle the amount of messages.  If that happens then you might see the ESXi host briefly disconnect from vCenter because other items (hostd) cannot write log entries fast enough.

the message is a side affect of the vCNI networking module.  If you use VXLAN, it won't produce this error state ... this is my strong suggestion if possible.  there are blogs on how to do the Forged Transmits and Prom mode with ESXi in a more automated sense since you can't do it like vCNI pools.