Banner on NSX UI: The following VC(s) are not entitled for NSX usage: <VC-FQDN> Please verify license validity

Products

• VMware NSX
• VMware Cloud Foundation
• VMware Telco Cloud Platform

Issue/Introduction

• vCenter is already imported to VCF Ops and using the existing NSX instance
• vCenter is being upgraded from 8.0 to 9.0.
• vCenter registered to NSX as a compute manager and is also visible in VCF Ops and has a valid VCF license applied to it, but even then this banner appeared on the NSX UI: 

 The following VC(s) are not entitled for NSX usage: <vCenter-FQDN>. Please verify license validity.

 

Environment

VCF 9.0

NSX 9.0

TCP 5.1

Cause

• NSX queries for VCF License every 60 minutes
  • In the VCF 9.0 / NSX 9.0 architecture, that delay is almost always caused by the multi-step synchronization chain required for the new subscription model. Unlike older versions where a key was entered directly, the license has to "travel" through several layers.:
    • The VCF Operations Polling Cycle VCF Operations acts as the central license authority. It doesn't push the license to vCenter the millisecond you upload it. It typically runs a collection cycle every 5 to 10 minutes to evaluate entitlements and then update the managed assets.
    • vCenter Inventory SyncOnce vCenter receives the entitlement from VCF Ops, it must update its own internal License Service database. This metadata change then has to be made available to the Compute Manager service that NSX talks to.
    • NSX "Heartbeat" RefreshNSX does not constantly query vCenter for license status to avoid unnecessary API overhead. It uses a periodic heartbeat (often 30 minutes or longer by default) to verify that the registered Compute Manager is still entitled to use NSX features. Even if you click "Refresh," it can sometimes take a moment for the back-end services to handshake.
    • Cache TTL (Time to Live)The UI banner itself often hangs onto a cached state. Even after the back-end database shows "Licensed," the web browser or the NSX Manager's UI service may continue to display the notification until the specific Solution License token is fully validated and the cache expires.
    • Token ValidationVCF 9.0 uses OAuth-style tokens for licensing. If your NTP/Time Sync was slightly off between VCF Ops and NSX, the initial tokens might have been rejected as "not yet valid" until the clocks aligned or the token window shifted.
• The "not entitled" banner on NSX persists because NSX 9 requires a valid Solution License file to be pushed from VCF Operations to that specific vCenter instance.
• NSX Manager cannot obtain its entitlements when any of the following situations occur: (reference)
• Solution License for VCF has expired or has become invalid.
• Solution License for VCF is removed from the vCenter server that is registered to NSX Manager
• Solution License for VCF is replaced with Solution License for VVF on the vCenter server.
• vCenter server gets disconnected from NSX Manager
• vCenter server registration is deleted from NSX Manager

Resolution

 

• The message will not affect an upgrade of vcenter to 9.0 and will go away post upgrade.
•  API functionality is supported only from NSX-T version 4.2 onwards to manually trigger the license sync if needed: POST https://<NSX-Manager-IP>/api/v1/licenses/vcf/action/sync (Ensure that the newly imported "vSphere 8 Enterprise Plus for VCF" is explicitly assigned to the “vCenter Server Systems” assets under the Assets tab)
• Note: For earlier versions, the license synchronization may take up to 60 minutes. (Reference KB: The Solution License for VMware Cloud Foundation (VCF) is not synchronizing with NSX)

Additional Information

Reference KBs: The Solution License for VMware Cloud Foundation (VCF) is not synchronizing with NSX.

NSX 9.0.x license not synced with vCenter

Unable to license vCenter after upgrading to 9.0