Troubleshooting TPM Attestation Alarms May Be Caused by NTP Synchronization Issues

Products

• VMware vSphere ESXi

Issue/Introduction

Users may experience Host TPM attestation alarms on their ESXi hosts. These alarms can be triggered due to Network Time Protocol (NTP) synchronization problems, which can affect the TPM attestation process. This article provides guidance on troubleshooting and resolving these issues.

Environment

- VMware vSphere 7.0 and later
- ESXi hosts with TPM 2.0 enabled

Cause

TPM attestation alarms can be triggered by poor network communication between ESXi hosts and NTP servers, leading to NTP synchronization problems. This can be caused by:
1. Outdated network interface card (NIC) drivers or driver/firmware mismatch
2. Suboptimal network configuration
3. Insufficient MTU size for certain traffic types

Resolution

Follow these steps to troubleshoot and resolve TPM attestation alarms caused by NTP synchronization issues:

1. Check NTP synchronization:
   a. SSH into the affected ESXi host.
   b. Run the command: ntpq -p
   c. Verify that the "reach" value is 377 (octal) and there's a "*" or "+" before the IP/hostname of your NTP servers.

2. Update NIC drivers:
   a. Identify your current NIC driver version using the command: esxcli software vib list | grep nenic
   b. Download the latest supported driver from the VMware Compatibility Guide.
   c. Install the updated driver using: esxcli software vib install -v /path/to/driver.vib

3. Optimize network configuration:
   a. Review your vSwitch or Distributed Switch configuration.
   b. Separate different traffic types (Management, vMotion, iSCSI) across available NICs.
   c. Adjust the MTU size to 9000 for iSCSI and vMotion traffic:
      - Ensure all intervening hardware ports, switches, and so forth related to vMotion, iSCSI are set up to accept MTU 9000
     - In the vSphere Client, navigate to Networking > Virtual Switches.
      - Edit the properties of the relevant port groups and set the MTU to 9000.

4. Update server BIOS:
   a. Check your current BIOS version.
   b. Download and install the latest BIOS version from your server manufacturer's website.

5. Test with additional NTP servers:
   a. Edit the NTP configuration file: /etc/ntp.conf
   b. Add public NTP servers, e.g., pool.ntp.org
   c. Restart the NTP service: /etc/init.d/ntpd restart

6. Monitor and verify:
   a. Clear existing TPM attestation alarms.
   b. Monitor the system for 24-48 hours to ensure the alarms do not recur.
   c. Check NTP synchronization periodically using the ntpq -p command.

Additional Information

Configuring Network Time Protocol (NTP) on an ESXi host using the vSphere Client
 
VMware Compatibility Guide for checking supported NIC drivers