VM failed to migrate to host after host reboot when lockdown is enabled

Products

• VMware NSX
• VMware vSphere ESXi

Issue/Introduction

• The issue will happen when below criteria is met at the same time:
  • VM's network is configured to NSX segment
  • ESXi is lockdown enable before reboot
    
    
• After ESXi reboot, VM failed to migrate to the ESXi. On NSX manager, the host state is "DOWN"
• The host is upgraded from ESXi 6.7. In ESXi 6.7, there is a bug that lldpVim-user is removed:
  
  2022-10-17T03:56:05Z opslldpvim: [ 2102220 ] INFO User lldpVim-user deleted^@
  
  
• After ESXi is upgraded to 7.0, when rebooting with lockdown mode enable, hostd is to query users in exception list, but lldpVim-user is missing.
• In nsxdavim.log
  
  2024-01-26T09:09:28Z nsxaVim: [2102437]: WARNING User lldpVim-user does not exist retrying updating exception list^@
  
  
• In hostd.log:
  
  2024-01-26T09:09:28.040Z info hostd[2100916] [Originator@6876 sub=Solo.Vmomi opID=a56a6265 user=dcui] Throw vim.fault.UserNotFound
2024-01-26T09:09:28.040Z info hostd[2100916] [Originator@6876 sub=Solo.Vmomi opID=a56a6265 user=dcui] Result:
--> (vim.fault.UserNotFound) {
--> principal = "lldpVim-user",
--> unresolved = false,
--> msg = "",
--> }

Environment

VMware NSX-T

Cause

On ESXi, nsxaVim failed to start because user "lldpVim-user" is missing.

Resolution

The issue is fixed in ESXi 7.0.

Workaround:
Set host to "lockdown disable" before reboot.