NSX Manager Alarm: Missing DNS entry for manager FQDN

Products

• VMware NSX

Issue/Introduction

• The following alarm is triggered in the NSX Manager UI:
  
  
• Event ID: manager_health.missing_dns_entry_for_manager_fqdn
  
  
• The DNS configuration for a specific NSX Manager node is flagged as incorrect.
  
  
• The IP address(es) of the Manager node either do not resolve to a Fully Qualified Domain Name (FQDN) or resolve to mismatched FQDNs.

Environment

• VMware NSX (Version 4.1.0 and later)
• NSX Manager utilizing a dual-stack (IPv4/IPv6) configuration, AND/OR
• NSX Manager utilizing a CA-signed API certificate.

Cause

This issue occurs when the NSX Manager node's DNS configuration fails a bidirectional lookup validation check. When a manager uses CA-signed certificates or a dual-stack configuration, it must be able to successfully resolve:

1. Its FQDN to its IP address (via an A/AAAA record).
   
   
2. Its IP address back to its exact FQDN (via a PTR record).

If either the forward or reverse DNS lookup fails, the alarm is triggered.

Resolution

To resolve this alarm, verify and correct your DNS configuration or revert to a self-signed certificate if dual-stack is not required.

Option 1: Correct the DNS Configuration

1. Verify NSX Manager DNS settings: Ensure proper DNS servers and necessary Search Domains are configured directly on the Manager node.
   
   
2. Test DNS server responsiveness: Ensure the configured DNS servers are actively responding to queries.
   
   
3. Validate A and PTR records: Check your DNS server to ensure:
   
   
• A reverse lookup of the NSX Manager's IP addresses returns the same FQDN.
  
  
• A forward lookup of the FQDN returns all IP addresses associated with the Manager node.
  
  
• Hostname ("shortname") lookups resolve correctly. 

Note: NSX uses the dig utility (dig -x for reverse lookup) rather than nslookup to resolve hostnames and IPs. Ensure your DNS server properly returns answers to dig queries. (Reference: KB 367266).

Option 2: Use a Self-Signed Certificate If the Manager node is not using a dual-stack configuration, you can bypass this DNS validation requirement by replacing the CA-signed certificate for the API service type with a self-signed certificate.

 

Additional Information

Maintenance window required for remediation? No

Related KBs:  Missing DNS Entry For Manager FQDN alarm when RFC 2317 DNS in use