Unable to report the usage to Avi Cloud Console

Products

VMware vDefend Firewall VMware vDefend Firewall with Advanced Threat Prevention VMware Avi Load Balancer

Issue/Introduction

The License Hub could not report the consolidated usage report to Avi Cloud Console when registered in connected mode.

Environment

Security Services Platform - License Hub = 5.1.2 or License Hub >= 2.0

NSX >= 9.1

Cause

The License Hub is not able to connect to Avi Cloud Console to report the consolidated usage.

For more details, please refer to logs using following steps.

Execute these on:

SSPI if License Hub version is 5.1.2
License Hub if version is >= 2.0 (please use kubectl instead of k)

ssh sysadmin@SSPI-IP

# check the licensing-service pod
k -n nsxi-platform get pods | grep "licensing-service"

# see the logs for licensing-service pod
k -n nsxi-platform logs -f deployment/licensing-service

Sample error message:

<179>1 2026-04-03T08:53:03Z licensing-service-56979bc9d4-m5gzf SSP 1 SSP [ssp@4413 comp="SSP" level="ERROR" s2comp="service/pulse_usage_upload_task.go:193" subcomp="SSP"] Failed to upload usage data {"error":"<...ERROR TEXT GOES HERE....>"}
:
<182>1 2026-04-03T08:53:03Z licensing-service-56979bc9d4-m5gzf SSP 1 SSP [ssp@4413 comp="SSP" level="INFO" s2comp="service/metrics_util.go:80" subcomp="SSP"] Successfully sent alarm message to metrics-manager {"status":"FAILED"}

Resolution

For Security Services Platform - License Hub 5.1.2:

Please review and restore the connectivity between License Hub and Avi Cloud Console.

Step 1: Identify the Worker Node IP

First, locate the specific worker node where the License Hub service is running.

Log in to the SSP-Installer using sysadmin credentials.
Run the following command to list all nodes and their internal IPs:
```
k get nodes -o wide
```
Note the Internal-IP of the worker node.

Step 2: Access the Worker Node

Since License Hub typically runs on a single worker, you must jump to that node to perform the network test.

Establish an SSH session to the worker node using the IP identified in Step 1:
```
ssh capv@<Worker-Node-IP>
```

Step 3: Validate Connectivity to Avi Cloud

From the worker node, test the connection to the Avi Cloud endpoint.

Option A: Using Netcat (Quick Port Check) Run this to see if the port is open:

nc -zv cloud.domain-name.com 443

Expected Result: Connection to cloud.domain-name.com 443 port [tcp/https] succeeded!

Option B: Using cURL (Verify SSL Handshake) If nc is unavailable, use curl to ensure the worker can perform a handshake:

curl -v https://cloud.domain-name.com

Expected Result: You should see a Connected to... message and the SSL certificate exchange. A 403 Forbidden or 302 Redirect from the server is actually a success, as it proves the traffic reached the Avi Cloud Console.

Once connectivity is restored, the consolidated usage reporting will be reattempted in the next automated reporting cycle (default once a day). When this operation is successful, the alarm will be resolved.

For License Hub 2.0:

Validate Connectivity to Avi Cloud

From the License Hub single OVA 2.0 VM, test the connection to the Avi Cloud endpoint.

Option A: Using Netcat (Quick Port Check) Run this to see if the port is open:

nc -zv cloud.domain-name.com 443

Expected Result: Connection to cloud.domain-name.com 443 port [tcp/https] succeeded!

Option B: Using cURL (Verify SSL Handshake) If nc is unavailable, use curl to ensure the worker can perform a handshake:

curl -v https://cloud.domain-name.com

Expected Result: You should see a Connected to... message and the SSL certificate exchange. A 403 Forbidden or 302 Redirect from the server is actually a success, as it proves the traffic reached the Avi Cloud Console.

Once connectivity is restored, the consolidated usage reporting will be reattempted in the next automated reporting cycle (default once a day). When this operation is successful, the alarm will be resolved.