NSX V2T Rollback Fails with error related to 'node_user_settings' and Root SSH Login

Products

• VMware NSX

Issue/Introduction

• During the v2t migration, rollback of the migration fails with the following error:
  Rollback failed. Check rollback.log file for more details
[Reason: Edge Transport Node failed with '400: [Fabric] Modification of some properties of an edge node is not allowed via NSX Manager. Kindly use CLI to modify these properties: node_user_settings and allow_ssh_root_login. Redeploy edge to modify form factor.
For URL: http://localhost:7440/nsxapi/api/v1/transport-nodes/####-####-####-####]
  
  
• Export the table from NSX manager (from root login) to verify if cliUsername is updated for the edge nodes.
  /opt/vmware/bin/corfu_tool_runner.py -o showTable -n nsx -t EdgeTransportNode > EdgeTransportNode.txt
• When the issue is present , "cliUsername": "admin" will not be present 
• Example of correct information:
   "nodeUserSettings": {
    "cliPassword": "############",
    "rootPassword": "############",
    "cliUsername": "admin",
    "auditUsername": "audit",
    "auditPassword": "############"
  },

Environment

VMware NSX-T Data Center
VMware NSX

 

Cause

Starting with NSX-T version 3.2.4, a validation mechanism was introduced to prevent modifications of read-only fields during edge node updates via the UI.
If the `cliUsername` is not stored in the database for certain edge nodes, the update call triggers this validation and fails.

Resolution

• To modify the restricted properties (`node_user_settings` and `allow_ssh_root_login`), use the NSX CLI instead of the UI.
  Used the script Fix_Error_16028_375618.sh  attached in KB 375618 to make necessary changes to the edge user settings 
• To manually update the cliUsername for individual edge nodes use the following API command.
  POST https://NSX-manager-IP/api/v1/transport-nodes/$node_id/action/update-node-user-settings
  Body to add -   local payload='{"cli_username":"admin"}'

Additional Information

Reference - KB 375618