NSX 9.0.x license not synced with vCenter

Products

• VMware NSX

Issue/Introduction

• VCF license has been expanded to a higher core capacity. The new license capacity is updated to VCF operations and vCenter, but the NSX still shows the legacy license info.

• nsxapi.log may show log lines similar to the below, even though a change has been made.

  INFO pool-###-thread-1 VCSyncServiceImpl #### SYSTEM [nsx@####   comp="nsx-manager" level="INFO" subcomp="manager"] Update VCF license, 0 to create, 0 to delete

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX 9.x

Cause

The license synchronization request has been sent from NSX to vCenter, but due to a code defect, NSX doesn't find there is any license change.

To check the license info  in NSX and  vCenter:

• Get license info from NSX Manager with API
   GET https://{{nsx-ip}}/api/v1/licenses


• Get license info from vCenter Server: 
   GET https://{{vCenterHost}}:443/api/cis/license/subscription/entitlement/vcenter-assignments

Resolution

This is a known issue impacting VMware NSX.

Workaround

Breaking the connection between vCenter and NSX temporarily will force a resync of the license.

Precaution: When performing this workaround, please make sure this not been performed during upgrade or heavy traffic time.  Do not perform NSX configuration changes during the operation.

In 9.0, when vCenter is removed or disconnected from NSX, NSX will remove the existing VCF license from VC due to license sync failure. So we can break the connection between vCenter and NSX and trigger the license sync. After the exiting stale VCF license is removed, restore the connection and do license sync again.

For the following step, please select one NSX Manager node and use the IP address of this node, do not use the virtual IP.

1. Login NSX Manager node by SSH and add iptable rule to block traffic to VC from NSX Manager.

 

root@nsxmanager:/tool# iptables -t raw -A OUTPUT -d {vcIP} -j DROP

2. Login this NSX Manager by browser and node IP and click "REFRESH" link button to trigger license sync. It will spend about 5 minutes in this step.

3. After "Refresh" operation finishes, reload this license page to confirm whether the existing VCF license is removed.

4. Login this NSX Manager node by SSH, if the existing VCF license is removed, remove iptable rule to restore the connection.

 

root@nsxmanager:/tool# iptables -t raw -D OUTPUT -d {vcIP} -j DROP

5. Login this NSX Manager by browser and node IP and click "REFRESH" link button to trigger license sync.

6. After "Refresh" operation finishes, reload this license page to confirm whether the new VCF license is retrieved.

 

If you believe you have encountered this issue and the above workaround does not help, please open a support case with Broadcom Support and refer to this KB article.

For more information, see Creating and managing Broadcom support cases.