Failed to change the encryption state of the virtual machine because vSphere Replication is enabled, preventing the assignment of a KMS-based encryption storage policy

Products

• VMware vCenter Server
• VMware Site Recovery Manager 8.x

Issue/Introduction

On trying to encrypt a virtual machine, the vSphere Web Client will return the following error:

"Failed to change encryption state for the virtual machine with vSphere Replication enabled."

 

To verify if replication is enabled you can check for HBR filters in vmx file of target VM.

If you see hbr filters listed there that means that VM have or had replication enabled.

 

In example

 

grep -i hbr virtual_machine.vmx

 

 

hbr_filter.configGen = "2"

hbr_filter.destination = "##.###.##.##"

hbr_filter.gid = "VRID-c####9-5##4-4##5-b##a-3#######5"

hbr_filter.port = "31031"

hbr_filter.rpo = "120"

hbr_filter.pause = "TRUE"

Environment

vSphere 8.x

Cause

Since the virtual machine has a replica made by vSphere Replication, it is not possible to encrypt the original virtual machine.

 

In some cases replication isn't cleaned up properly so there are still references to replication in vmx file.

Resolution

Option 1

Destroy the replication of the virtual machine, then encrypt the source VM and create the replication again.

 

Option 2

In case that VM is not covered with replication anymore but you encounter this behavior you can clean hbr filters manually 

Before you proceed with below action plan make sure that yo have taken snapshot of VM and backup of vmx file as changing vmx manually can cause unwanted effects.

 

 

Connect to the ESXi host the virtual machine resides on using a SSH session. For more information, see Using ESXi Shell in ESXi.
Navigate to the location of the virtual machines .vmx file:

/vmfs/volumes/virtual_machine_datastore/virtual_machine_folder/

Create backup of vmx file 

cp virtual_machine.vmx  virtual_machine.vmx.bak

Edit the virtual machine using a text editor:

vi virtual_machine.vmx

Remove all the entries containing hbr_filter.

For example:

hbr_filter.configGen = ""
scsi0:0.filters = ""
hbr_filter.rpo = ""
hbr_filter.destination = ""
hbr_filter.port = ""
hbr_filter.gid = ""
hbr_filter.protocol = ""
hbr_filter.quiesce = ""
hbr_filter.opp = ""
hbr_filter.pause = ""
scsi0:0.hbr_filter.rdid = ""
scsi0:0.hbr_filter.persistent = ""

Note: You may also comment out each line by preceding each line with a #.

Save the changes and exit the text editor.
To find the vmid, run this command:

vim-cmd vmsvc/getallvms | grep -i VM_Name

To reload the virtual machine into inventory, run this command:

vim-cmd vmsvc/reload vmid