VCF NSXT SSH Error After Out of Band NSXT Ip/FQDN Update.

Products

• VMware Cloud Foundation

Issue/Introduction

This article helps users to resolve any issue while they change their NSXT ip/fqdn out of band.
 

Symptoms:
VCF NSXT has ssh errors after an out of band change of NSXT IP and/or FQDN due to ssh or certificate issue.
Examples: NSXT Audit fails, VCF unable to connect to NSXT, extra.

Environment

VMware Cloud Foundation 4.4.1
VMware Cloud Foundation 3.9.x
Vmware Cloud Foundation 4.5.1

Cause

NSXT ip/fqdn is changed out of band (that is outside of VCF SDDC), the VCF SDDC is not aware of the changes. The SDDC inventory will not be updated, causing this issue. Users need to update the SDDC inventory, certs, extra to correct the issue.

Resolution

Currently there is no resolution.

Workaround:

Follow the below steps:

1. In SDDC Mgr, log in via admin/root password and run the following to create an inventory backup

curl localhost/inventory/nsxt | jq --indent 3 .[0] > inventory_backup1.json

2. Create an updated_nsx_cluster.json using the above curl command to get the current state of the inventory and update:

• clusterIpAddress to the VIP
• Each of the ipAddress and/or FQDN fields under nsxtClusterDetails with the correct ip and/or FQDN for each node. Make sure to match the ip addresses to the correct FQDN.
• See attached screenshot

Note: Use a find and replace to replace the ip's and/or fqdn as the "configuration" blob also has entries that require change.

Finally take a note of the outermost "id" field and record it for the step.

3) Update VCF inventory with the below curl command where entity id, is the id recorded in step 2.

curl -X PUT http://localhost/inventory/nsxt/{entity-id} -H "Content-Type: application/json" -d @updated_nsxt_cluster.json | json_pp

4) Verify the updated inventory with

curl http://localhost/inventory/nsxt

5) Wait 5-15 minutes for the LCM auditor to pick up changes

6) Once inventory is corrected, update the NSXT node certificates