Enhanced replication mappings are in error state with the error 'Login request is denied'
search cancel

Enhanced replication mappings are in error state with the error 'Login request is denied'

book

Article ID: 402268

calendar_today

Updated On:

Products

VMware Live Recovery

Issue/Introduction

Symptoms

  • Enhanced replication mappings for few ESXi host pairs are in error state with the error message 'Login request is denied'

    For instance, if there are 3 ESXi hosts in the source site and 3 ESXi hosts in the destination site, there will be a total of 9 ESXi host pairs. Out of the 9 pairs, you will notice that 1 or 2 connections are in error state.

  • All the ESXi hosts both from source and target are on version 8.0.2 which is the minimum requirement for enhanced replication

  • Restarting the hbrsrv services does not help

Environment

VMware vSphere Replication 9.x

Cause

The enhanced replication mapping failures are caused by a time mismatch between the ESXi hosts. This leads to token validation errors where login requests are denied with the message "Token too new".

Cause Validation

From the source ESXi host hbr-agent.log we can see the below errors

2025-06-24T06:22:33.542Z In(166) hbr-agent-bin[2099670]: [0x0000004811c15700] error: [Proxy [Group: PING-GID-9#######-####-####-####-############] -> [10.#.#.#:32032]] [2######-####-####-####-#########-HMS-365424] Failed to login to brokered server: (18) Login denied.
2025-06-24T06:22:33.542Z In(166) hbr-agent-bin[2099670]: [0x0000004811c15700] error: [Proxy [Group: PING-GID-9#######-####-####-####-############] -> [10.#.#.#:32032]] [2######-####-####-####-#########-HMS-365424] Failed to login to brokered server additional error info: Login request is denied.; ClientConnection (client=[10.#.#.#]:57494) failed login attempt
2025-06-24T06:22:33.542Z In(166) hbr-agent-bin[2099670]: [0x0000004811c15700] error: [Proxy [Group: PING-GID-9#######-####-####-####-############] -> [10.#.#.#:32032]] [2######-####-####-####-#########-HMS-365424] Exhausted all server endpoints reported by broker.

From the DR site ESXi host hbrsrv.log file we can see that the login attempts are failing due to invalid token

2025-06-24T06:20:02.699Z Db(167) hbrsrv[3876958]: [Originator@6876 sub=Asio] SSL handshake succeeded for <TCP '10.#.#.# : 32032'> -> <TCP '10.#.#.# : 57494'> (encrypted)
2025-06-24T06:20:02.739Z Er(163) hbrsrv[3876948]: [Originator@6876 sub=Main opID=hsl-0] HbrError stack:
2025-06-24T06:20:02.739Z Er(163) hbrsrv[3876948]: [Originator@6876 sub=Main opID=hsl-0]    [0] Exec format error
2025-06-24T06:20:02.739Z Er(163) hbrsrv[3876948]: [Originator@6876 sub=Main opID=hsl-0]    [1] Unverified token with ID '5#######-####-####-####-############'is not valid: TOO_NEW (8)
2025-06-24T06:20:02.739Z Er(163) hbrsrv[3876948]: [Originator@6876 sub=Main opID=hsl-0]    [2] Hiding full error from client.
2025-06-24T06:20:02.739Z Er(163) hbrsrv[3876948]: [Originator@6876 sub=Main opID=hsl-0] HbrError stack:
2025-06-24T06:20:02.739Z Er(163) hbrsrv[3876948]: [Originator@6876 sub=Main opID=hsl-0]    [0] Login request is denied.
2025-06-24T06:20:02.739Z Er(163) hbrsrv[3876948]: [Originator@6876 sub=Main opID=hsl-0]    [1] ClientConnection (client=[10.#.#.#]:57494) failed login attempt
2025-06-24T06:20:02.739Z Er(163) hbrsrv[3876948]: [Originator@6876 sub=Main opID=hsl-0]    [2] Converting error to wire failure
2025-06-24T06:20:02.739Z In(166) hbrsrv[3876958]: [Originator@6876 sub=Delta] ClientConnection (ClientCnx '[10.#.#.#]:57494' id=0 <shut> <uninit>) is stopping ...

Resolution

Ensure that the NTP services are running on both the source and the target ESXi hosts and time is in sync

To verify the time and NTP configurations, navigate to Host > Configure > System > Time Configuration

Powered by Wolken Software