Unable to report the security usage to License Hub
Article ID: 414009
Updated On:
Products
Issue/Introduction
Usage could not be reported to License Hub.
Environment
vDefend SSP >= 5.2
Cause
Security Services platform is not able to connect to License Hub to report SSP usage.
For more details, please refer to logs using following steps.
Execute these on SSPI
#check the licensing-client-service pod
k -n nsxi-platform get pods | grep "licensing-client-service"
#see the logs for licensing-client-service pod
k -n nsxi-platform logs -f deployment/licensing-client-service | grep -i "endpoint_usage_reporting_impl.go"
Sample error message:
#Error handler triggered
INFO Usage reporting error handler called - raising alarm
#Alarm sent successfully
INFO Successfully sent usage reporting alarm message to metrics-manager status=DISCONNECTED
Resolution
Please review and restore the connectivity between License Hub and Avi Cloud Console.
Step 1: Identify the License Hub FQDN
licensing-client-service does not use a hardcoded hostname — it reads the target License Hub endpoint from the SspInfo custom resource on the SSP cluster.
Log in to the SSP-Installer using sysadmin credentials, then run:
k get sspinfo -n nsxi-platform -o yaml
Note the spec.ingressHostname value — this is the FQDN licensing-client-service uses to reach License Hub.
Step 2: Identify the licensing-client-service Pod and Node
Find the pod and the worker node it's scheduled on:
k get pods -n nsxi-platform -l app.kubernetes.io/name=licensing-client-service -o wide
Note the NODE column (Internal-IP can be cross-referenced with k get nodes -o wide).
Step 3: Validate Connectivity to License Hub
Preferably, test directly from the pod itself (this reflects actual pod egress/DNS/proxy behavior):
k exec -n nsxi-platform -it <licensing-client-service-pod> -- curl -v https://<License-Hub-FQDN>:443
If the pod image lacks curl/nc, SSH to the worker node identified in Step 2 instead:
ssh capv@<Worker-Node-IP>
Option A: Using Netcat (Quick Port Check)
nc -zv <License-Hub-FQDN> 443
Expected Result: Connection to <License-Hub-FQDN> 443 port [tcp/https] succeeded!
Option B: Using cURL (Verify SSL/mTLS Handshake)
curl -v https://<License-Hub-FQDN>
Expected Result: You should see a Connected to... message and the SSL certificate exchange. Since licensing-client-service uses mutual TLS, a 403 Forbidden, 401 Unauthorized, or certificate-related rejection from the server is actually a SUCCESS — it proves the traffic reached License Hub. A connection timeout or Could not resolve host indicates the actual network/DNS problem.
Once connectivity is restore, the consolidated usage reporting will be reattempted in the next automated reporting cycle (default 1 hour). When this operation is successful, the alarm will be resolved.
Feedback
