2V0-41.24 Question 436
Single answerAn administrator is troubleshooting a connectivity issue in an NSX-T Data Center environment where communication between two VMs on different segments is failing. The administrator suspects a firewall rule issue but needs to confirm this using log files. Which log file or command should the administrator examine to verify if the traffic is being dropped by a Distributed Firewall (DFW) rule?
- A
The syslog file located at /var/log/syslog on the ESXi host running the affected VMs
- B
The nsx-proxy.log file located at /var/log/nsx/ on the NSX Manager
- C
The dfwpktlogs.log file located at /var/log/vmware/nsx/ on the ESXi host
- D
The NSX Manager CLI command: get logical-switches
Show answer and explanation
Correct answer: C
Explanation
The dfwpktlogs.log file is the correct log file to analyze when troubleshooting Distributed Firewall issues in NSX-T. This file contains details about packets that are dropped or processed by the DFW, helping administrators identify whether a specific firewall rule is blocking traffic. Other logs or commands mentioned do not provide the required level of detail for this scenario.
- A. Incorrect.
The syslog file captures general system logs but does not contain specific details about Distributed Firewall packet drops. It is not suitable for this analysis.
- B. Incorrect.
The nsx-proxy.log file logs communication between NSX components and NSX Manager, but it does not provide details about packet drops or firewall rules.
- C. Correct.
The dfwpktlogs.log file specifically records packet drops by the Distributed Firewall, making it the correct file to analyze when troubleshooting potential DFW issues.
- D. Incorrect.
The 'get logical-switches' command is used to list logical switches in the NSX environment, but it does not provide any information about packet-level issues or DFW logs.