VMware vRealize Network Insight 6.5.1 Release Notes

VMware vRealize Network Insight 6.5.1 | 03 FEB 2022 | Build 1645037705

Check for additions and updates to these release notes.

What's New

This release of vRealize Network Insight contains critical security updates and fixes affecting underlying operating system upgrade.

Note: VMware recommends you upgrade to vRealize Network Insight 6.5.1 to mitigate security vulnerabilities and upgrade issues. vRealize Network Insight 6.5.0 will no longer be available for download. For any support issues, contact VMware Global support.

Here are other key features and capabilities of vRealize Network Insight 6.5.1:

VMware NSX-T Monitoring and Troubleshooting

Supports VMware NSX Advanced Load Balancer for VMs in the vRealize Network Insight on-premises and VMware Cloud deployments.
Introduces built-in and enforced protection mechanism to disable NetFlow collection on Distributed Virtual Port groups where VMware NSX-T edges are connected.

Network Assurance and Verification

vRealize Network Insight supports Cisco ACI.
vRealize Network Insight supports Check Point Firewall.

Platform Enhancements

Introduces streaming mechanism to receive problem events, application changes, metrics, and flow records.
vRealize Network Insight displays newly raised alerts as real-time toast message notifications.
vRealize Network Insight is now Federal Information Processing Standards (FIPS) compliant. If your data sources support FIPS, you can Enable FIPS based collection to use FIPS approved ciphers.
Introduces the functionality to set login banners.

Others

Introduces a new tab structure for all the entity pages to display a consistent view. The new structure includes the following updates:
- Category selection is moved from the header to the tabs
- Sub-categories are now tabs
- Provides a consistent header view across all the entity pages
- Page controls like Modify and Troubleshoot are moved on the right for all the pages
vRealize Network Insight Settings is moved to the left navigation pane.

Left navigation pane sub-categories are displayed as tabs within the left panel.
Fixed the following recently reported Log4j vulnerabilities:
vRealize Network Insight 6.5.1 uses Log4j 2.17.0.

For third-party components where a fix is not within the control of VMware, we have removed the JndiLookup class to mitigate the reported vulnerabilities. Also, the flag log4j2.formatMsgNoLookups = true has been set.

Note: The vulnerability https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832 with CVSS3 score of 6.6 is exploitable if JDBC appender is used. vRealize Network Insight is not affected by this vulnerability because JDBC appender is not used.

To resolve the Log4j vulnerabilities for previous releases, see KB-87135.
vRealize Suite Lifecycle Manager 8.6.2 Product Support Pack 2 supports the installation of vRealize Network Insight 6.5.1. See VMware vRealize Suite Lifecycle Manager 8.6.2 PSPAK 2 Release Notes. To install and upgrade vRealize Network Insight by using vRealize Suite Lifecycle Manager, see the vRealize Suite Lifecycle Manager Installation, Upgrade, and Management Guide.

Product Upgrade

The supported upgrade path is available at https://interopmatrix.vmware.com/#/Upgrade?productId=285.

Refer to the Upgrading vRealize Network Insight section for more information on the upgrade procedure.

Documentation

For additional information about new features, see the vRealize Network Insight documentation.

Note: As you use the vRealize Network Insight documentation, we want you to know that we value inclusion at VMware. To foster this principle within our customers, partners, and internal communities, we have updated some terminology in our documentation.

VMware Product Compatibility

The VMware Product Interoperability Matrix provides details about the compatibility of vRealize Network Insight with other VMware products.

VMware MIB Files

For MIB information, see Determining the MIB module listing, name, and type of an SNMP OID. You can download the SNMP MIB module file from the VMware Knowledge Base Article: 1013445.

Resolved Issues

While planning for micro segmentation, flow data is intermittently missing for some applications.
vRealize Network Insight is unable to collect data from the VMware NSX-T Manager and shows the 'No Data being received' alert.
VMware vCenter and VMware NSX-T data sources data collections fail due to the CollectorState looping issue.
When latency collection is enabled, vRealize Network Insight shows the 'Could not get response for /api/v1/transport-zones/62f9eac3-1a82-4e38-aeed-493a5c87dd00, status 400' error while collecting data from the data sources.
Kubernetes clusters managed by Tanzu Kubernetes Grid Integrated Edition are unreachable from the collector VM.
Unable to login to vRealize Network Insight as the login credentials are not accepted.
vRealize Network Insight shows the 'Realtime stream processing has failed' error while navigating the interface.
vRealize Network Insight does not show a VM-VM path for Check Point data source due to the 'unknown path' error.
Unable to login using LDAP after configuring LDAP in vRealize Network Insight 6.2.
Data collection from Tanzu Kubernetes Grid Integrated Edition data sources shows a false 'Invalid data source config' error.
Unable to receive email notifications after configuring alerts and notifications.
When HSRP/VRRP interface on the Active device goes down or is administratively down, the HSRP/VRRP Configuration Error intent does not raise an alert for the violation.
False Loop Detection Intent alerts are triggered when a link is incorrectly inferred between two interfaces where MAC address table entries associated with them contain the same MAC address but are associated with different VLANs.
Under the Status column of the Application dashboard, some applications saved from the Flows application discovery tab show the error 'Unable to update application'. This is due to an issue in the data processing layer and this error does not affect the applications. You can use applications showing this error for planning, micro-segmentation, and troubleshooting without any issues.
If a data source is incorrectly shut down or restarted, then the corresponding thread pool is discarded, and this does not schedule new processes like collection of metrics.

Restart the collector service to free the unused threads and reallocate them.
Updates in the organization name done using the VMware Cloud Services Portal are not reflected in Fractal API response, as there is no data synchronization mechanism between the VMware Cloud Services Portal and the Fractal API. Fractal API returns the old organization name causing an inconsistency between the vRealize Network Insight and the VMware Cloud Services Portal organization name.
If UAA as OpenID Connect (OIDC) provider is enabled in VMware Tanzu Kubernetes Grid Integrated Edition, an 'Invalid data source config' error is shown in the VMware Tanzu Kubernetes Grid Integrated Edition data source.
In vRealize Network Insight 6.5, Cisco UCS FEX elements are incorrectly displayed in the Network Map and the Intent definitions that involve Cisco UCS FEX may generate false positives. Support for Cisco UCS FEX for Network Map and Intents is planned for a future vRealize Network Insight release. To view the list of intents that may generate false alerts, see KB 87409.

Contact VMware support to disable Cisco UCS FEX device processing for Network Map. You can continue to use Cisco UCS FEX for other vRealize Network Insight functionalities.
vRealize Network Insight interface lags when using queries pre-set values for VeloCloud Edges and unable to navigate to any VeloCloud Edges entity pages.

Known Issues

New -
If the VLAN interfaces of Cisco ACI switches are used as source or destination, the path search in Network Map does not show any results.
New -
Path search in Network Map does not return any results if Check Point VRRP virtual IP is used as the source address.
New -
Incorrect MTU is shown in UCS vEthernet interfaces.
New -
Unable to draw the network path as the Branch to Branch VPN configuration is disabled for the HUB VMware SD-WAN edge in VeloCloud Orchestrator.
New -
Cisco ACI switches do not supported Port Channel Member Mismatch intent.
New -
vRealize Network Insight recommends configuring unique FQDN hostnames on host entities (like UCS Blades or servers) for proper interpretation of underlying host entities. Absence of unique FQDN hostnames may lead to incorrect association of VMs to underlying similar hostnames.
New -
VMware NSX-T data source shows the 'Data collection failed due to an error' message if there are any entities with Japanese characters in them.
New -
After a Federation peer instance is paired with the primary instance, you see the following behaviors:
- The newly added instance state is shown as 'Disconnected' in the primary instance
- The Federation page widgets show the status of this instance as “Instance Unreachable”
- After the Federation data synchronization completes, the peer instance state changes to 'Connected' and the data is shown in the widgets
New -
Unable to change the IP address of a Federation instance after it is configured in Federation.

Unpair the instance and reconfigure it with the required IP address.
New -
If a Federation instance is in the disconnected state, the Unpair option is disabled.
New -
For some time the values of the Federation page Key Performance Indicators (KPI) are inconsistent when compared to the values in the entity details page or the actual instance. This is because the polling frequencies of Federation page KPIs are different.
New -
vRealize Network Insight does not support Federation as a search query and the time range selection for this query. Federation page always shows the present data.
New -
In the Federation page, the deployment widget shows new changes after one minute as the response time for the Deployments widget is cached for one minute.
New -
Any Federation instance that is unreachable for more than 24 hours, is not shown in the Environment widget of the Federation page.
New -
After pairing a Federation instance, it takes up to 2 hours for the data to appear in the Summary widget of the Federation page due to the current metricStore behavior for aggregation of metrics.
New -
If a peer instance is disconnected with the primary instance, the system takes one hour for its status to reflect on the primary instance. If this peer instance is unpaired before the status is reflected on the primary instance, then the primary instance removes that peer instance. But the peer instance configuration page shows that it is still connected to the primary instance.

Contact VMware support to unpair this peer instance.
New -
In the Federation page, Other Problems in Physical Devices tab of the Enviroments widget does not include the Palo Alto VMs.
New -
In the Federation page, the Platform Capacity section includes unknown flows with internet flows and east-west flows for the deployed instances.