Cisco Virtual Security Gateway for Microsoft Hyper-V Troubleshooting Guide, Release 5.2(1)VSG2(1.1a)

Policies Configured on the Cisco VSG that Are Not Effective

Sometimes, when policies are configured on Cisco VSG and the data traffic is sent from the VMs, traffic flows through the Cisco Nexus 1000V Series Switch as if the firewall service is not enabled on the port.

Possible reason:

• VMs are not bound to the proper port profiles.

Verifications:

Go to the prompt to execute the vemcmd commands, for example, cd \\Program File(x86)\Cisco\Nexus1000V and do the following:

• Check if the VMs to be protected are bound to proper port profiles. The port profiles are expected to have the org/vn-service identified.
• On the VEM, enter the vemcmd show vsn binding command to check if the VM is protected by the firewall.
• To get the lower threshold limit (LTL) of the VM on the VEM, enter the vemcmd show port command as follows:

Verify if the LTL is found as follows:

The VSG Licenses Available message should display a nonzero value in the output.

Note All vemcmd commands can be executed by logging into the Hyper-V.

Traffic Fails to Reach Destination with a Permit Policy Configured on Cisco VSG

When policies are configured on the Cisco VSG to permit a certain type of traffic, but the traffic does not reach the destination, a complete failure can result.

Possible reason:

The Virtual Ethernet Modules (VEMs) have not learned the MAC address of the Cisco VSG.

Verifications:

Check if the Cisco VSG MAC address is learned on all the VEMs that host the protected VMs involved in the communication by entering the vemcmd show L2 all command on the VEM.

This example shows how to display the Cisco VSG MAC configuration:

To troubleshoot, you should manually check if the VSG service (data 0) interface is bound to the correct port profile and VLAN configured.

You can check the Cisco VSG service interface assignment on the VEM by entering the vemcmd show command.

This example shows how to check the Cisco VSG service interface assignment on the VEM:

You can display the port profile that is associated with the Cisco VSG service interface by entering the show port-profile name pp-name command on the VSM.

If the Cisco VSG is bound to the proper port profile and has the correct service VLAN, check the upstream switches. Ensure that this service VLAN is configured across all ports in all upstream switches to which all the VEMs (those talking to Cisco VSG) are connected.

You can ensure that the service VLAN is configured and enabled (active) on the VSM by entering the show vlan command.

This example shows how to display the VLAN configurations:

Policy Decision Inconsistent with Port Profile Changes

When policy decisions are inconsistent with port-profile changes, either of these conditions can exist:

• A user changed the port profile of the traffic VM from one Cisco VSG port profile to another (having a different security profile).
• A policy is modified and the newer policy does not take immediate effect.

Reason:

Because of the existing flows, the old policy decision is continued.

Action:

Administrators must clear the flows in the vPath and Cisco VSG when the policy is modified.

Using vPath Ping to Determine Connectivity

You can use the vPath ping command on VSM to determine the connectivity between the Cisco VSG and the VEM.

This example shows how to ping the Cisco VSG connections and determine if they are reachable:

This example shows how to display VSN ping options:

This example shows how to display VSN ping options for all source modules:

This example shows how to set up a ping for all source modules from a specified IP address:

This example shows to set up a ping for all vPath source modules for a specified IP address:

This example shows how to set up a ping for all source modules of a specified IP address with a time-out and a count: