VSAN Health Check "All hosts contributing stats" is failing on ESA clusters.
VMware vSAN 8.0
Prior to vSAN version 8.0 U2 the vSAN master host retrieves remote host stats via port 80 and from vSAN 8.0 U2 and later builds, port 443 is used.
If ESXi host firewall has blocked port 443 port (ruleset vSphereClient) for vSAN network. It does not populate the vSAN IPs under allowed IP list.
The below output shows the vSAN vmkernel ports are not added under vSphere client allowed IP list.
[root@EX2:~] esxcli network firewall ruleset allowedip list
Ruleset Allowed IP Addresses
--------------------------- --------------------
sshServer All
updateManager All
faultTolerance All
webAccess All
vMotion All
vSphereClient 19#.16#.#.###,
19#.16#.#.###
,19#.16#.#.###
,19#.16#.#.###
,19#.16#.#.### >>>>>>>>> Missing vSAN vmk IPs <<<<<
Manually update the vSAN IP into the vSphereClient allowed IP list. You can use the below command to update IPs.
esxcli network firewall ruleset allowedip add
Check the Allowed IP list again using the command below.
esxcli network firewall ruleset allowedip list
Output should be as below.
[root@EX2:~] esxcli network firewall ruleset allowedip list
Ruleset Allowed IP Addresses
--------------------------- --------------------
sshServer All
webAccess All
vMotion All
vSphereClient 19#.16#.#.###, 19#.16#.#.###, 19#.16#.#.###, 19#.16#.#.###, 19#.16#.#.###, 10.2#.##.1, 10.2#.##.2, 10.2#.##.3
By default, the IPs of all hosts in one cluster are in the allow list.