HCX Authentication failure with the error "Auth Failure: Time desync. Check NTP health. HCX time:"

Products

• VMware HCX

Issue/Introduction

If you attempt to log in to HCX, you may encounter the following errors depending on how you are accessing the HCX Manager.

• HCX 443 UI hybridity page:

Error: Auth Failure: Time desync. Check NTP health. HCX time: 20##-##-##T##:##:##.###Z

• vCenter UI HCX plugin shows below error :

Error: Http failure response for https://vcsa.com/plugins/com.vmware.hcx.plugin-4.##.##.######## -- 8#######8/10.##.##.##-443/vsphere-client/ui/hcx/hcx-ui/rest/hybridity/api/sessions: 401 OK

Environment

VMware HCX

Cause

This issue is caused by a time synchronization mismatch between the HCX Manager and the target vCenter/SSO domain, where the time drift exceeds 60 seconds (60,000 ms).

• The time sync messaging will be displayed in the app.log when the vCenter time does not fall within 60 seconds (60000ms).

Resolution

HCX requires accurate time synchronization using a valid NTP server for proper integrated system operations. NTP settings can be configured through the appliance management interface as shown below:

1. Navigate to the appliance management interface: https://hcx-ip-or-fqdn:9443.
2. Navigate to the Administration tab.
3. Select Time Settings on the side menu, click Edit (or Unconfigure NTP Servers).
4. Enter the NTP server, Multiple servers can be specified using a separated comma-separated list.
5. Navigate to the Appliance Summary tab in the dashboard, locate the Appliance Management Service, and click Restart.

For more details, refer to the following document: HCX NTP Server settings

Below are some troubleshooting commands you can use to verify the NTP configuration and update it if required. It is recommended to use an NTP server within the local subnet where possible, and to ensure all components such as vCenter, HCX, and NSX are synchronized to the same NTP server.

• #Edit and Add timeservers under [Time]
  • Time servers can be added or modified under the [Time] section via the command line using the command below; however, it is recommended to perform these changes through the HCX appliance management interface as outlined above.

root@HCX-MGR [ ~ ]# vi /etc/systemd/timesyncd.conf

• #Check if the NTP service is up and running

root@HCX-MGR [ ~ ]# systemctl status systemd-timesyncd
root@HCX-MGR [ ~ ]# systemctl start systemd-timesyncd -l
root@HCX-MGR [ ~ ]# systemctl stop systemd-timesyncd -l

• #Query NTP server

root@HCX-MGR [ ~ ]# ntpdate -q ntpserver.ntp.org

• #Update time from the defined ntp server

root@HCX-MGR [ ~ ]# ntpdate ntpserver.ntp.org

• #Check system clock synchronized

root@HCX-MGR [ ~ ]# timedatectl

• #Check time synchronization info

root@HCX-MGR [ ~ ]# timedatectl timesync-status

Additional Information

• How to configure Network Time Protocol (NTP) on vCenter Server Appliance (VCSA)
• HCX - Error updating Time Settings: "Error occurred during action set for system config NTP_SETTINGS. Error message: no server suitable for synchronization found"
• HCX plugin not working in vCenter UI, Error "Http failure response <url> 401 OK"