Layer 7 Virtual server status is down

Products

• VMware NSX

Issue/Introduction

• Newly deployed Layer 7 Virtual server status is down, or virtual server status changes to down after adding the client certificate.
• The SNI certificate configured in the client SSL configuration of L7 virtual server have Common Names (CN) or Subject Alternative Names (SAN) exceeding 110 characters.
•  From /var/log/syslog of the NSX-T Edge, you will see the following error message:

w###s####.##.###a.####d.#e NSX 2023043 LOAD-BALANCER [nsx@6876 comp="nsx-edge" subcomp="lb" s2comp="lb" level="FATAL"] [7######9-e###-###5-###2-c########892] could not build server_names_hash, you should increase server_names_hash_bucket_size: 128"

Environment

VMware NSX 4.x
VMware NSX-T Data Center 3.x

Cause

The Default Server name hash bucket is unable to process the long Common Name of the certificate. Because of this, the nginx load balancer service fails to start.

Resolution

Bucket size is being increased to 256 this can handle SNI CN/SAN length up to 238 characters

Important Notes:

• If the Load Balancer is detached and re-attached, the value in nginx.conf will revert to the default 128.

• When restarting the LB container, a failover to the standby edge occurs. Therefore, this workaround must be applied on both active and standby edges to ensure continuity.

Workaround steps:

1. Access the LB container:

   1. Find the container ID:

      docker ps | grep lb

      Look for the container running nsx-edge-lb:current.

   2. Enter the container:

      docker exec -it <container_id> bash

2. Back up the original template:

   cp /opt/vmware/nsx-edge/bin/lbconf.template /tmp/lbconf.template.bak

3. Modify the template:

   1. Copy the backup for editing:

      cp /tmp/lbconf.template.bak /tmp/lbconf.template

   2. Make the file writable (if not already):

      chmod +w /tmp/lbconf.template

   3. Edit the file:

      vim /tmp/lbconf.template

      Locate and change:

      server_names_hash_bucket_size 128;

      to:

      server_names_hash_bucket_size 256;

   4. Replace the original template:

      cp /tmp/lbconf.template /opt/vmware/nsx-edge/bin/lbconf.template

4. Exit the LB container

5. Restart the LB container:

   docker restart <container_id>

6. Verify:

   • Check the generated nginx.conf to confirm the updated value.

   • Ensure the nginx process restarted without errors.