BugZero | VMware NSX BugID 3003919 - The DFW rules matching CNAMES having different act...

VMware NSX - Defect ID: 3003919

The DFW rules matching CNAMES having different actions than the DFW rule matching original domain name will lead to inconsistent rule enforcement.

VMware NSX - Defect ID: 3003919

The DFW rules matching CNAMES having different actions than the DFW rule matching original domain name will lead to inconsistent rule enforcement.

Last updated on March 31st, 2026

BugZero Risk Score
0.0 Coming soon

Overall: N/A

Severity: N/A

Community: N/A

Lifecycle: N/A

What is the BugZero Risk Score?

VMware NSX Integration

Learn more about where this data comes from

VMware NSX Integration

Learn more

Bug Scrub Advisor

Streamline upgrades with automated vendor bug scrubs

Bug Scrub Advisor

Learn more

BugZero Enterprise

Wish you caught this bug sooner? Get proactive today.

BugZero Enterprise

Learn more

Bug Details

Status: Known
Impact Category: Unspecified
Workaround Available:

Description

Overview

In the unlikely case of an application/user accessing CNAME instead of original DOMAIN name may seem to bypass or get dropped incorrectly by the DFW rules. Configure the DFW rules only for original domain name, not the CNAME. Configure the rules with domain name and CNAMES with the same action.

Workaround

Perform one of the steps: Configure the DFW rules only for original domain name, not the CNAME

Bug URLs

https://techdocs.broadcom.com/us/en/vmware-cis/nsx/vmware-nsx/4-0/release-notes/vmware-nsx-4011-release-notes.html https://techdocs.broadcom.com/us/en/vmware-cis/nsx/vmware-nsx/4-1/release-notes/vmware-nsx-410-release-notes.html

Change history

2026-01-08 changed to Known

Top VMware NSX Defects

Defect ID: 44dfad529729
Flood protection, DNS security, Firewall session timer, and other security profiles fail to realize when applied to groups through binding maps with the same sequence number.
Defect ID: 3018596
Virtual Function (VF) is released from if you set VM virtual NIC (vnic) MTU on Guest VM to be greater than physical NIC MTU.
Defect ID: 3531825
Recursive ECMP path shows as inactive.
Defect ID: 3003762
Uninstallation of NSX Malware Prevention Service fails if you do not delete Mlware Prevention Service rules from policy and also does not display any error message that uninstallation fails because rules are still present in policy.
Defect ID: 3003919
The DFW rules matching CNAMES having different actions than the DFW rule matching original domain name will lead to inconsistent rule enforcement.

Ready to prevent the next vendor outage?

Get a demo

VMware NSX - Defect ID: 3003919

The DFW rules matching CNAMES having different actions than the DFW rule matching original domain name will lead to inconsistent rule enforcement.

VMware NSX - Defect ID: 3003919

The DFW rules matching CNAMES having different actions than the DFW rule matching original domain name will lead to inconsistent rule enforcement.

Last updated on March 31st, 2026

BugZero Risk Score0.0 Coming soon

Bug Details

Overview

Workaround

Bug URLs

Links

Top VMware NSX Defects

Ready to prevent the next vendor outage?

BugZero Risk Score
0.0 Coming soon