Upgrading a single NSX Manager in a vCenter Linked Mode Environment

Products

VMware NSX for vSphere

Issue/Introduction

Symptoms:
In an environment with multiple vCenter Servers with multiple NSX managers, you experience these symptoms:

When selecting one or more NSX Manager from the vSphere Web Client > Networking and Security > Installation > Host Preparation, you see this error:

Could not establish communication with NSX Manager. Please contact administrator.

Environment

VMware NSX for vSphere 6.1.x
VMware NSX for vSphere 6.0.x
VMware NSX for vSphere 6.3.x
VMware NSX for vSphere 6.2.x

Cause

In an environment with multiple vCenters and multiple NSX Managers, it is possible to get a single-pane-of-glass view by using vCenter Linked Mode or registering both vCenter Servers with the same SSO server.

This issue occurs when the associated NSX Managers are running different versions of VMware NSX for vSphere 6.x or when NSX lookup service is not configured in the NSX environment.

Resolution

For a mixed linked-mode setup of NSX 6.3.x with at least one NSX-v 6.4.0, This issue is resolved in VMware NSX for vSphere 6.4.0

You would not hit the interop plugin issue. You will NOT need to have all environments on NSX-v 6.4.x levels. The NSX-v 6.4.0 will have the logic to deal with NSX 6.3.x compatibility issues with linked mode.

For a mixed linked-mode setup of NSX 6.2.x with at least one NSX-v 6.4.0: issue is NOT resolved.

You will continue to hit the interop plugin issue. The NSX-v 6.4.0 will NOT have the logic to deal with NSX 6.2.x compatibility issues with linked mode.

For a linked-mode setup where all the NSX Managers are at NSX-v 6.4.0: issue is resolved.

Workaround:
To work around this issue if you do not want to upgrade, create an additional vCenter Server (VC) user (an Active Directory user or vCenter Server local user with NSX privileges) for each VC-NSX pair in Linked Mode.

Log in to the vCenter Server using the vSphere Web Client.
Navigate to Administration > Single Sign On > Users and Groups > Users.
Create the additional vCenter Server user for each VC-NSX pair in Linked Mode.

Notes:

This workaround requires each NSX Manager in a multi-VC setup to register to its own unique VC, Web Client and can be part of same SSO server. Each user must only log in to their assigned VC-NSX pair so that same Web Client / NGC Plug-in is used for that user. Each user should not have permissions for both VC-NSX pairs.

For example:

user1—ngc1—vc1—nsx1
user2—ngc2—vc2—nsx2
user3—ngc3—vc3—nsx3
To use same the user ID on all NSX-VC pairs, you should have separate SSO server, vCenter Server, vSphere Web Client, NSX Manager for each VC-NSX pair in the Linked mode. For more information on Linked mode, see the Using Enhanced Linked Mode section of the ESXi and vCenter Server 6.0 Documentation.
In Cross-vCenter environment, you can temporarily upgrade all NSX managers first before bringing up all NSX components in the Cross-vCenter setup. For more information on Cross-vCenter, see the Cross-vCenter NSX Installation Guide.