Error: unable to onboard remote host due to incorrect thumbprint. (Error code: 500340) when viewing DFW Rule Statistics

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

- Checking DFW Rule Statistics on the Global Manager fails with the following error. Error: unable to onboard remote host due to incorrect thumbprint. (Error code: 500340)

- In some versions it may display "NSX version found is not compatible with the global manager" instead of the thumbprint errror.

Environment

• NSX all versions

Cause

This error can occur in the following situations

• After a NSX upgrade in NSX 4.2.x.
• After Certificate Update/Renewal in the Local Managers.
• Stale entry remains after a Local Manager has been offloaded from the Global Manager.

 

If the Local Manager is still connected to a Global Manager

•  This situation is caused by the Local Sites thumbprint not matching with the Global manager and the thumbprint needs to be updated.

 

If the Local Manager has been offloaded from the Global Manager

• This situation is caused by a stale enforcement point in the Local Manager.
• The error will show in /var/log/proton/nsxapi.log and will have an enforcement point that begins with "global-infra"  instead of just "infra"

https://<local-manager>/policy/api/v1/infra/domains/default/security-policies/<policy-name>/rules/<rule-name>/statistics?enforcement_point_path=/global-infra/sites/<site-name>/enforcement-points/default

Resolution

If the Local Manager is still connected to a Global Manager:

• First, verify the thumbprint on the local manager CLI
  • One you've logged into any of the local managers via SSH, run the command 'get certificate cluster thumbprint'.
    
• Now log into the Global Manager UI and go to GM > Location Manager > Edit Settings.
  
  • If the thumbprint is different, then update the thumbprint, click the 'Check version compatibility" button,  and save.

 

 

Local Manager has been offloaded from the Global Manager or not using a NSX Federation:

• Find the name of the stale enforcement point by using one of the following methods:
  • Locate the error message in /var/log/proton/nsxapi.log  It will contain a URL with the enforcement point 
    • https://<local-manager>/policy/api/v1/infra/domains/default/security-policies/<policy-name>/rules/<rule-name>/statistics?enforcement_point_path=/global-infra/sites/<site-name>/enforcement-points/default
  • Dump the enforcement point corfu table and find the enforcement point 

/opt/vmware/bin/corfu_tool_runner.py -o showTable -n nsx -t EnforcementPoint > EnforcementPoint.txt

grep "stringId" EnforcementPoint.txt 
  "stringId": "/global-infra/sites/<site-name>/enforcement-points/default"

• Run the following API to clean up the stale enforcement point

POST  https://<local-manager>/policy/api/v1/troubleshooting/infra/tree/realization?action=cleanup 

Payload:
{
 "paths": [
    "/global-infra/sites/<NSX-site-name|Default>/enforcement-points/default"
  ]
}