Adding or Updating DNS server configuration on SDDC Manager fails with "Failed to validate NTP configuration. Validate input specification as new NtpConfiguration to VMware Cloud Foundations."

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• DNS server configuration through SDDC Manager fails with the error:  "Failed to validate NTP configuration. Validate input specification as new NtpConfiguration to VMware Cloud Foundations."

  
  
• /var/log/vmware/vcf/operartionsmanager/operationsmanager.log
YYYY-MM-DDTHH:MM:SSZ ERROR [vcf_om, 69#########################62, ####] [c.v.v.s.s.v. SystemConfiguratorEntitiystatevalidator, om-exec-30] Error ocurred while testing DNS servers for <SDDC Manager-FQDN>: [DNSTestMessage (result=success, message='<DNS_Server_1_IP>' is reachable.) , DNSTestMessage (result=failure, message=Failed to reach 'DNS_Server_2_IP'.) ]
YYYY-MM-DDTHH:MM:SSZ ERROR [vcf_om, 69#########################62, ####] [c.v.v.s.s.v.SystemConfiguratorEntitiystateValidator, om-exec-30] Exception occured while validating DNS servers [<DNS1-IP>, <DNS2-IP>] on <SDDC Manager-FQDN>
com. vmware. vcf.systemconfigurator.error. SystemConfiguratorException: Error occurred while testing DNS servers for <SDDC Manager-FQDN>: [DNSTest message (result=success, message='<DNS_Server_1_IP>' is reachable.), DNSTestMessage (result=failure, message Failed to reach '<DNS_Server_2_IP>'.) ]
  
  

• /var/log/vmware/vcf/operationsmanager/operationsmanager.log contains reachability errors similar to the following:

  
  ####-##-##T##:##:##.###+0000 DEBUG [vcf_om,####,####] [c.v.v.s.u.SystemConfigErrorLocalizationUtil,om-exec-7] Localized message: locale:en_US, key:ENTITY_NOT_REACHABLE, args:["####.int.dfs.de"], msg:####.int.dfs.de is not reachable.
  ####-##-##T##:##:##.###+0000 ERROR [vcf_om,####,####] [c.v.v.s.s.v.SystemConfiguratorEntitiyStateValidator,om-exec-20] Entity reachability check failed for ####.int.dfs.de

• Diagnostics, confirmed by the traceroute utility, show the DNS server is unreachable due to a blocked or broken network path.

Environment

• SDDC Manager 5.x
• SDDC Manager 5.2.x

Cause

• The SDDC Manager's inability to reach the DNS server is a network layer issue. The traceroute results confirm that the communication path is blocked or disrupted, most often due to firewall rule (ACL) preventing traffic on UDP/TCP port 53 (DNS) and also rule preventing ICMP traffic between the SDDC Manager and the DNS server, or an improper routing configuration within the network infrastructure.

Resolution

Since the traceroute utility confirms the DNS server is unreachable due to a blocked network path, the issue lies outside of the Broadcom VCF team. 

• (Recommended): Please engage your internal Network and Security teams to investigate and resolve the communication path failure. They must ensure that the necessary firewall rules (ACLs) and routing configurations permit bi-directional traffic on UDP/TCP port 53 and ICMP protocol between the SDDC Manager's IP and the DNS server's IP.
  
  
• (Alternative): Alternatively, reconfigure the SDDC Manager to use a different, confirmed-reachable DNS server located within a network segment that does not have these communication restrictions.
  
  
• The issue also arises when ICMP ping is disabled by the firewall between the vCenter and the SDDC appliance.
  
  
• Validate you can normally ping DNS servers, NTP servers and vCenter servers from SDDC Manager SSH session.