LLM credentials expired

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention
• VMware Avi Load Balancer

Issue/Introduction

AI Assistant is unable to reach LLM provider.

Environment

vDefend SSP Version: 5.2 and later

Avi Operations: 5.2 and later

Cause

• If you are using Broadcom account: The vTIS token used to communicate with LLM Gateway is expired. The token might expire if:
  
  • SSP has expired or invalid license
  • SSP has valid licenses but are from different Broadcom Customer Support siteIds.
  • SSP is unable to reach vTIS.
    
    
• If you are using your cloud provider in AI Assistant platform config: The llm key is either expired or invalid.

Resolution

Broadcom Account Resolution Steps:

1. Validate your SSP license: Ensure that your Security Services Platform (SSP) license is currently active, valid, and has not expired. Use licensing GET API (e.g. https://<FQDN of SSP>/ssp/licensing-client/licensed-features ) to check.
2. Verify your Site ID: Ensure all of your SSP licenses are grouped together and belong to the exact same Site ID. If there are errors on reputation-service for invalid or multiple siteIds.
   
   

   ESC[1;31mERROR ESC[m[ESC[1;34mscs-plugin-com.vmware.vdefend.ia.llm.tokenESC[m] ESC[1;33mc.v.n.r.u.ReputationRestClientESC[m: SECURITY [nsx@4413 comp="nsx-manager" errorCode="XXX500114" level="ERROR" subcomp="manager"] 400 Bad Request: "{"error_code":10026,"error_message":"Mismatching siteIds. Please ensure the licenses belong to the same site."}"org.springframework.web.client.HttpClientErrorException$BadRequest: 400 Bad Request: "{"error_code":10026,"error_message":"Mismatching siteIds. Please ensure the licenses belong to the same site."}"
   

   • On NSX Manager (4.2.x and 9.0.x): Login using administrator credentials. Go to System > Licenses under settings. Check License keys and compare its siteId on Broadcom Support Portal at My Entitlements > My Sites.
   • On NSX Manager (9.1.x): Login to license hub and check license keys and its siteId from Broadcom Support Portal at My Entitlements > My Sites.
3. Check for connectivity alarms: Review SSP system dashboard in UI > Home > Open Alarms to make sure there are no active vTIS (Threat Intelligence Service) connectivity alarms blocking the service.
4. Faster Recovery: The system should recover after 50 mins if above cases are not an issue. In order to recover faster than 50 mins, use POST SSP API - POST /ai-assistants/platform/reconcile?force_bundle_import=false API to recover any transient errors.

Google Account Resolution Steps:

1. Verify your LLM Key:
   
   
   • If you are using your cloud provider for the integration, check the LLM API key that was imported into the system.
   • You must ensure that this key is valid, fully active, and has not reached its expiration date.
2. Generate new google service account key and upload to AI Assistant page: Login to SSP, goto System > Platform & Services > AI Assistant tile, Click on "Customer Account" to upload new key. Once llm key status is back to valid, bundle import will be re-attempted automatically.