I've been experiencing behavior with Deep Security which causes the vShield service to constantly "reconfigure" many VMs. When I say constantly, I mean approximately every 20 minutes. I understand that this is how Trend keeps the interfaces "in sync" but the process of reconfiguring seems to disconnect and reconnect the NIC on the VMs, which generates a 4201 TCPIP event on the Windows VMs: "The system detected that network adapter VMware Accelerated AMD PCNet Adapter was connected to the network, and has initiated normal operation over the network adapter."
In vShield Manager, it reports that the interface goes out of sync, which is what appears to trigger the reconfigure as vShield resyncs the interface. Deep Security reports that a VM "has reported that its interfaces are out of sync with the filter driver."
I am trying to find more information about what exactly these reconfiguration tasks are doing, in order to help troubleshoot the effect they are having with a few specific VMs that are abnormally sensitive to network disruption. Additionally, what would cause the interface to get out of sync, and what exactly does it mean to be out of sync? There appears to be a lack of solid technical information online regarding this. Any input is appreciated!
Deep Security v8.0
vShield 5.1.2
vSphere 5.0