Getting VSG to recognise VNMC policy

Question

Hello All,
I've installed the VSG and VNMC and it all looks good (everything's registered, everything sees everything else - VEM, VSM, etc.) however as soon as I try and apply a firewall policy to a port-profile from my VSM I get this logged in the VSM:
2012 Sep 26 14:52:48 N1000v %VNS_AGENT-3-CORE_INVALID_PROF_ID_ERR: VNMC failed to resolve service-profile for port, name:Veth10
This is the config for the port-profile:
port-profile type vethernet TestTenant
vmware port-group
switchport mode access
switchport access vlan 10
org root/TestTenant
vservice node VSG profile PolicyA
no shutdown
state enabled
I've attached screen grabs where you can see TestTenant is in the root and PolicyA does exist, belonging to TestTenant.
The only other error I get, which is obviously related is show vservice brief ends with:
#  - PA/VNMC is not connected to VSM yet or Org config error or PA/VNMC malfunctioning
We are connect to VNMC (show vn-pa status says so) so I assume it does't like my org or profile statements... but they match the screen grab...
All other tests are good:
N1000v# ping vsn all src-module all
ping vsn 10.1.50.12 vlan 50 from module 3, seq=0 timeout=1-sec
module(usec)   :  3(431)
N1000v# show vservice node brief
Node Information
ID Name                     Type   IP-Address      Mode   State   Module
1 VSG                      vsg    10.1.50.12      v-50   Alive   3,
FW-TT# sh running-config rule
rule default/default-rule@root
action 10 drop
rule default/default-rule@root/TestTenant
action 10 drop
FW-TT# show run policy
Policy default-egress@root/TestTenant
Policy default@root
rule default/default-rule@root order 2
Policy default@root/TestTenant
rule default/default-rule@root/TestTenant order 2
It just can't seem to look up my policy! Any ideas why?
One thing I have noticed is there are no "Compute Security Profiles" under the TestTenant firewall, but I don't know if there should be or how to put some there? (Have  alook at the SecProfiles.png attachment)

Answer 1

Hi Jaso
Mi problem is related to a ASA 1000v installation: If I attach a VM to the ASA1000V Port-Profile I receive the following error:
2013 Mar 12 10:33:52 VSM-1110-01 %ETHPORT-5-IF_UP: Interface Vethernet13 is up in mode access
2013 Mar 12 10:33:52 VSM-1110-01 %VNS_AGENT-3-CORE_DEFAULT_PROF_ID_ERR: VNMC resolves default-service-profile for port, name:Veth13 profile-id:1
This is what show vservice brief says:
VSM-1110-01# sh vservice brief
                                   License Information
Type      In-Use-Lic-Count  UnLicensed-Mod
vsg                      4 
asa                      2 
                                   Node Information
ID Name                     Type   IP-Address      Mode   State   Module
  1 CFW-VSG1                 vsg    10.1.103.242    v-103  Alive   3,4,
  2 ASA                      asa    10.1.100.1      v-1101 Alive   3,
                                   Path Information
                                   Port Information
PortProfile:ASA-Bla-Test                   
Org:root/TenantASA
Node:ASA(10.1.100.1)                          Profile(Id):ASA-SEC(9)
Veth Mod VM-Name                              vNIC IP-Address
  13   3 ubuntuc1                                1 10.1.100.11
PortProfile:SECURE-VSG-C                   
Org:root/TenantA
Node:CFW-VSG1(10.1.103.242)                   Profile(Id):SEC-PROFILE-C(10)
Veth Mod VM-Name                              vNIC IP-Address
   7   3 ubuntub1                                1 10.1.101.21
PortProfile:SECURE-VSG-A                   
Org:root/TenantA
Node:CFW-VSG1(10.1.103.242)                   Profile(Id):SEC-PROFILE-A(5)
Veth Mod VM-Name                              vNIC IP-Address
   8   4 ubuntua2                                1 10.1.101.12
Please ignore the VSG - This is a lab and I'm also running a VSG setup (without problems by the way).
Thanks for your support
Marcel