Using Active Directory accounts to login to the vCenter Server is slow

Products

• VMware vCenter Server

Issue/Introduction

If you have configured an Active Directory (AD) identity source using Integrated Windows Authentication (IWA) and the primary DNS server is offline, you experience these symptoms:

• Logging in with the vSphere Web Client may take longer than expected.
• Logging in using the vSphere Client may fail with the error:
  The vSphere Client could not connect to vCenter FQDN or IP Address. The server vCenter FQDN or IP Address took too long to respond. (The command has timed out as the remote server is taking too long to respond.)
•  ESXi hosts get disconnected from the vCenter Server

Note - Integrated Windows Authentication is deprecated from vSphere 7.

Environment

VMware vCenter Server 6.0

VMware vCenter Server 7.0

 

Cause

This issue occurs if the primary DNS server is unavailable. Due to this, the default timeout & retry values used by vCenter Server Appliance to switch the secondary DNS server cause an excessive delay.

Resolution

For vCenter 6.0:

To reduce the timeout value and allow the appliance to fail over to the next available DNS server, modify the /etc/resolv.conf file.

 

Note: If you are using a dispersed vSphere topology with one or more external PSCs, vCenter Management nodes, and Single Single On node, you must perform these steps on all appliances. If you modify the DNS settings through the VAMI or the virtual machine console, these values are lost and need to be reapplied.

Note: Take a snapshot of vCenter Appliance before proceeding.

1. Take an SSH session to vCenter Server Appliance.
2. Take a backup of the /etc/resolv.conf file.
3. Open the /etc/resolv.conf file using a suitable text editor.
4. Add these values to the end of the file:
   
   options timeout:1 attempts:1 rotate
   
   Notes:
   • The timeout value controls the time in seconds before moving on to the next DNS server.
   • The attempts value controls the number of retries before moving to the next DNS server.
   • The rotate value adds a round robin behavior.
5. Save and close the file.
6. Reboot the appliance.

 

For vCenter 7.0:

Validate that the correct and reachable DNS servers are configured. 

You can follow the procedure in Configure the DNS, IP Address, and Proxy Settings.

Additional Information