Failed to retrieve pairs from Site Recovery Manager Server: The tolerance is 30000 milliseconds.

Products

• VMware Live Recovery
• VMware vSphere ESXi

Issue/Introduction

This article provides aids in diagnosing and resolving a time synchronization issue between vCenter and the Site Recovery Manager.

Symptoms:

• Pairing an SRM server from vCenter results with the following error message:
  • Failed to retrieve pairs from Site Recovery Manager Server at https://<srm_server_ip_or _hostname>:9086/vcdr/vmomi/sdk. The received single sign-on token is valid from ‘<YYYY-MM-DD HH:MM:SS.MSS>’ to ‘<YYYY-MM-DD HH:MM:SS.MSS>’. it is currently ‘<YYYY-MM-DD HH:MM:SS.MSS>’. The tolerance is 30000 milliseconds. 
• When you compare the time on vCenter and Site Recovery Manager, you see a difference of greater than 30 seconds. See the three methods for checking the precise time below:
  • vCenter or Site Recovery Manager VAMI | Check current time:
    • Browse to the VAMIs of the vCenter and/or SRM servers:
      • vCenter Server: https://<vcenter_ip_or_hostname>:5480
      • SRM Server: https://<srm_ip_or_hostname>:5480
    • Browse to the Time section. If comparing two VAMIs, try to refresh each VAMI as close to the same time as possible. 
  • Photon Linux command line | Check current time:
    • # date

Environment

VMware vSphere Replication 6.x

Cause

Time drift is a normal occurrence on all operating systems. Embedded services within the operatings systems are generally designed to synchronize, on a regular schedule, to an external authoritative time source. If synchronization is not occurring regularly or effectively, drift can occur between two or more systems causing any number of issues including authentication failures and network session disconnects. 

If vCenter Server and Site Recovery Manager have time drifted to more than a 30 second difference, vCenter will not authenticate to Site Recovery Manager.

Resolution

Synchronize the time on either (or both) the vCenter and Site Recovery Manager servers to their respective NTP time server sources to bring them to +/- 30 seconds of each other.

Example Procedure:

• Compare the NTP or time sources for both vCenter and Site Recovery Manager to validate proper configuration and to help determine which system is out of sync. Ideally, both servers should have the same source, synchronized to the ESXI hosts that each are hosted on.
  • vCenter 6.7 or higher Photon Linux deployment
    • Access the vCenter Server Appliance Web Console (VAMI) through a web browser:
      • https://<vcenter_ip_or_hostname>:5480
    • Login as root
    • Select Time
    • Note the ip address(es) and/or hostname(s) under Time Synchronization / Time Servers
  • Site Recovery Manager 8.4 and higher Appliance (Photon deployment)
    • Access the SRM Server Appliance Web Console (VAMI) through a web browser:
      • https://<srm_ip_or_hostname>:5480
    • Login as root
    • Select Time
    • Note the ip address(es) and/or hostname(s) under Time Synchronization / Time Servers
• Compare the time on the vCenter and Site Recovery Manager servers to the NTP source for each.
• Synchronize the out-of-sync server to its source.
  • Photon Linux (vCenter or SRM Photon Linux deployment)
    • Run the following commands to stop the ntpd service, synchronize it with an NTP server, and restart the service.
      • # service ntpd stop
      • # ntpd -gq
      • # service ntpd start