ESXi host client login attempt throws error "Unknown" when accessed with IP address.

Products

• VMware vSphere ESXi

Issue/Introduction

ESXi host client login attempt throws error "Unknown" when accessed with IP address. However, the same credentials would work when accessed using the Host FQDN.

 

hostd will have the below warnings:

YYYY-MM-DDThh:mm:ss.zzzZ In(166) Hostd[2275372]: [Originator@6876 sub=Vimsvc.ha-eventmgr opID=esxui-xxxx-xxxx sid=52d926ac user=root] Event 1784 : User cannot logon since the user is already logged on

YYYY-MM-DDThh:mm:ss.zzzZ Db(167) Hostd[2275379]: [Originator@6876 sub=Solo.Vmomi] Arg userName:
YYYY-MM-DDThh:mm:ss.zzzZ Db(167) Hostd[2275079]: --> "Test"
YYYY-MM-DDThh:mm:ss.zzzZ Db(167) Hostd[2275379]: [Originator@6876 sub=Solo.Vmomi] Arg password:
YYYY-MM-DDThh:mm:ss.zzzZ Db(167) Hostd[2275079]: --> (not shown)
YYYY-MM-DDThh:mm:ss.zzzZ Db(167) Hostd[2275079]: -->
YYYY-MM-DDThh:mm:ss.zzzZ Db(167) Hostd[2275379]: [Originator@6876 sub=Solo.Vmomi] Arg locale:
YYYY-MM-DDThh:mm:ss.zzzZ Db(167) Hostd[2275079]: --> "en-US"
YYYY-MM-DDThh:mm:ss.zzzZ In(166) Hostd[2275379]: [Originator@6876 sub=Solo.Vmomi] Throw vim.fault.InvalidLogin
YYYY-MM-DDThh:mm:ss.zzzZ In(166) Hostd[2275379]: [Originator@6876 sub=Solo.Vmomi] Result:
YYYY-MM-DDThh:mm:ss.zzzZ In(166) Hostd[2275079]: --> (vim.fault.InvalidLogin) {
YYYY-MM-DDThh:mm:ss.zzzZ In(166) Hostd[2275079]: -->    msg = "",
YYYY-MM-DDThh:mm:ss.zzzZ In(166) Hostd[2275079]: --> }

Environment

VMware vSphere ESXi 7.x

VMware vSphere ESXi 8.x 

Cause

This is caused by the firewall SSL inspection rules. This can be identified by validating the SSL certificate of the host client.

On your browser click the padlock icon and view the SSL certificate of the ESXi host that is presented. Compare it with the FQDN based login page and verify for the issuer.

If there is any difference found between the FQDN and IP based pages, the SSL certs are being replaced in the middle.

Resolution

Involve the firewall team to amend the rules accordingly to present the original SSL certificate.