NSX Manager FQDN Missing DNS Entry Alarm
search cancel

NSX Manager FQDN Missing DNS Entry Alarm

book

Article ID: 345845

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • The following alarm is triggered in the NSX Manager UI:
    Event ID: manager_health.missing_dns_entry_for_manager_fqdn
  • The DNS configuration for a specific NSX Manager node is flagged as incorrect.
  • The IP address(es) of the Manager node either do not resolve to a Fully Qualified Domain Name (FQDN) or resolve to mismatched FQDNs.

Environment

  • VMware NSX (Version 4.1.0 and later)
  • NSX Manager utilizing a dual-stack (IPv4/IPv6) configuration, AND/OR
  • NSX Manager utilizing a CA-signed API certificate.

Cause

This issue occurs when the NSX Manager node's DNS configuration fails a bidirectional lookup validation check. When a manager uses CA-signed certificates or a dual-stack configuration, it must be able to successfully resolve:

  1. Its FQDN to its IP address (via an A/AAAA record).

  2. Its IP address back to its exact FQDN (via a PTR record).

If either the forward or reverse DNS lookup fails, the alarm is triggered.

Resolution

To resolve this alarm, verify and correct your DNS configuration or revert to a self-signed certificate if dual-stack is not required.

Option 1: Correct the DNS Configuration:

  1. Verify NSX Manager DNS settings: Ensure proper DNS servers and necessary Search Domains are configured directly on the Manager node.
  2. Test DNS server responsiveness: Ensure the configured DNS servers are actively responding to queries.
  3. Validate A and PTR records: Check your DNS server to ensure:
    a. A reverse lookup of the NSX Manager's IP addresses returns the same FQDN.
    b. A forward lookup of the FQDN returns all IP addresses associated with the Manager node.
    c. Hostname ("shortname") lookups resolve correctly. 

Note: NSX uses the dig utility (dig -x for reverse lookup) rather than nslookup to resolve hostnames and IPs. Ensure your DNS server properly returns answers to dig queries. See Unable to register with Compute Manager while installing VCF.

Option 2: Use a Self-Signed Certificate:
If the Manager node is not using a dual-stack configuration, you can bypass this DNS validation requirement by replacing the CA-signed certificate for the API service type with a self-signed certificate.

If the "Missing DNS entry for manager FQDN" alarm persists after replacing the CA-signed certificate with a self-signed certificate (and the Manager node is strictly single-stack), restart the Proton service to clear the state.
/etc/init.d/proton restart

If the issue persists, contact support for further investigation: Contact Broadcom support

Additional Information

Maintenance window required for remediation? No

Related KBs:  Missing DNS Entry For Manager FQDN alarm when RFC 2317 DNS in use

Powered by Wolken Software