VCF license is not updated in NSX Manager 9.0.x

Products

• VMware NSX

Issue/Introduction

• VCF license has been expanded to a higher core capacity. The new license capacity is updated to VCF operations and vCenter, but the NSX still shows the legacy license info.

• Logs on NSX Manager may show log lines similar to the below, even though a change has been made:

  /var/log/proton/nsxapi.log
INFO pool-###-thread-1 VCSyncServiceImpl #### SYSTEM [nsx@####   comp="nsx-manager" level="INFO" subcomp="manager"] Update VCF license, 0 to create, 0 to delete

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX 9.x

Cause

The license synchronization request has been sent from NSX to vCenter, but due to a code defect, NSX doesn't find there is any license change.

To check the license info  in NSX and  vCenter:

• Get license info from NSX Manager with API
   GET https://{{nsx-ip}}/api/v1/licenses


• Get license info from vCenter Server: 
   GET https://{{vCenterHost}}:443/api/cis/license/subscription/entitlement/vcenter-assignments

Resolution

This issue is resolved in VCF 9.0.2, and VCF 9.1, available at Broadcom downloads.

If you are having difficulty finding and downloading software, review the Download Broadcom products and software KB.

 

Workaround

Breaking the connection between vCenter and NSX temporarily will force a resync of the license.

In NSX 9.0, when vCenter is removed or disconnected from NSX, NSX will remove the existing VCF license from VC due to license sync failure. So we can break the connection between vCenter and NSX and trigger the license sync. After the existing stale VCF license is removed, restore the connection and do license sync again.

Precaution: While performing this workaround, make sure this has not been performed during upgrade or heavy traffic time. Do not perform NSX configuration changes during the operation.

1. SSH to any NSX Manager in the cluster as admin. 
2. Identify UUIDs and hostnames of all NSX Managers in the cluster:
   > get nodes | find mgr
3. Find the node that is a leader for "Group Type: CM-INVENTORY":
   > get cluster status verbose
   
   Sample output:
   
   
   
4. SSH to the leader as root.
5. Add iptables rule to block traffic to VC from NSX Manager. Use the IP address of the vCenter instead of the FQDN:
   # iptables -t raw -A OUTPUT -d {vcIP} -j DROP
   Keep the SSH session active. 
6. Login this NSX Manager's UI (you can use any node, or the VIP), browse to System - Licenses, and click "REFRESH" button to trigger license sync.
   It will spend about 5 minutes in this step.
    
7. After the "Refresh" operation finishes, reload this license page to confirm that the existing VCF license is removed.
8. If the existing VCF license is removed, remove iptable rule to restore the connection:
9. Return to the SSH session used in step 5. 
   iptables -t raw -D OUTPUT -d {vcIP} -j DROP
10. Return to the UI, click "REFRESH" link button to trigger license sync.
    After "Refresh" operation finishes, you may need to reload the license page to confirm the new VCF license is retrieved.

If you believe you have encountered this issue and the above workaround does not help, please open a support case with Broadcom Support and refer to this KB article.

For more information, see Creating and managing Broadcom support cases.