Error: "Client IP is blocked.", CLIENT_IP_BLOCKED, and 403 response code when signing into SDDC Manager

Products

• VMware Cloud Foundation
• VMware SDDC Manager / VCF Installer
• VCF Operations

Issue/Introduction

• Attempting to log into SDDC Manager displays the error "Client IP is blocked."
  
  
  
  
• For the failed login attempts, on SDDC Manager in /var/log/vmware/vcf/commonsvcs/vcf-commonsvcs.log, there are errors similar to the following:
  
  com.vmware.evo.sddc.identity.model.error.UnauthorizeException: User is not authorized
ERROR [common,################,####] [c.v.e.s.e.h.LocalizableRuntimeExceptionHandler,http-nio-127.0.0.1-####-exec-####] [#####] IDENTITY_UNAUTHORIZED_ENTITY User is not authorized


• On SDDC Manager at /var/log/vmware/vcf/commonsvcs/vcf-commonsvcs.log , you can see the user account login fail due to the client IP being blocked:

INFO  [common,################################,####] [c.v.e.s.i.r.a.c.v1.TokenController,http-nio-127.0.0.1-####-exec-####] Token creation request received from user : [email protected]
ERROR [common,################################,####] [c.v.e.s.e.h.LocalizableRuntimeExceptionHandler,http-nio-127.0.0.1-####-exec-####] [O75VSB] CLIENT_IP_BLOCKED Client IP is blocked.
com.vmware.evo.sddc.identity.model.error.BlockedException: Client IP is blocked. 


• Checking /var/log/nginx/access.log, logins are seen from example IP address 192.0.2.1 with a 403 response code, indicating the login was forbidden:
  
  192.0.2.1 - - [09/Dec/2024:14:01:19 +0000] "POST /v1/tokens HTTP/1.1" 403 ### "-" "okhttp/#.#.#" "-" #.### #.###
192.0.2.1 - - [09/Dec/2024:14:01:19 +0000] "POST /v1/tokens HTTP/1.1" 403 ### "-" "okhttp/#.#.#" "-" #.### #.###
192.0.2.1 - - [09/Dec/2024:14:01:19 +0000] "POST /v1/tokens HTTP/1.1" 403 ### "-" "okhttp/#.#.#" "-" #.### #.###
192.0.2.1 - - [09/Dec/2024:14:01:19 +0000] "POST /v1/tokens HTTP/1.1" 403 ### "-" "okhttp/#.#.#" "-" #.### #.###
192.0.2.1- - [09/Dec/2024:14:01:19 +0000] "POST /v1/tokens HTTP/1.1" 403 ### "-" "okhttp/#.#.#" "-" #.### #.###
  
  
• If using VCF Operations, after updating the password for the VCF integration adapter to a newly rotated password, the adapter cannot validate the connection. 
  
  
  • The VCF adapter logs on the VCF Operations collector at /storage/vcops/log/adapters/VcfAdapter/VcfAdapter_###.log show:
    
    WARN VcfAdapter #### [ops@#### threadId="####" threadName="Collector worker thread #" instanceId="####"] [(####) com.vmware.vrops.adapter.vcf.auth.AuthenticationManager.warn] - Exception
occurred while connecting to url https:/<FQDN_of_SDDC_Manager>/v1/tokens
com.vmware.vrops.adapter.vcf.exception.VcfException: Bad request please verify the request parameters or credentials

Environment

• VMware Cloud Foundation 4.x
• VMware Cloud Foundation 5.x
• VMware Cloud Foundation 9.x
• SDDC Manager 9.1.0.x
• VCF Operations 9.1.0.x

Cause

If a user or application tries to log in with invalid credentials 10 or more times, the client IP address will be blocked for 24 hours to prevent brute-force password attempts.

 

Resolution

Unlock the blocked client IP address and restore login access to SDDC Manager:

1. Identify the blocked client IP address in the nginx access log /var/log/nginx/access.log, as described in the Issue/Introduction section.
   
   
2. If the blocked IP belongs to an application or integration (such as VCF Operations), ensure the account password configured in that application is updated to the correct active password.
   
   
3. Restart the commonsvcs service on SDDC Manager to reset the lockout period:
   
   
   1. Log into SDDC Manager via SSH with the vcf user
      
      
   2. Run the following command and enter the root account password:
      
      su - 
      
      
   3. Run the following command:
      
      systemctl restart commonsvcs

 

 

Additional Information

For more information on HTTP response definitions, see the Hypertext Transfer Protocol (HTTP) Status Code Registry