VMC Data Source Addition Fails in VCF Operations for Networks

Products

• VCF Operations for Networks

Issue/Introduction

Aria Operations for Networks (vRNI). Attempts to add VMC on AWS data sources (such as NSX Manager) fail when the Platform node is deployed on-premise and the Collector node is deployed in VMC on AWS.

The CSP token has the correct roles (ie. 'Administrator' and 'NSX Cloud Admin' for NSX Managers on VMC)

The UI displays one of the following errors:

• "NSX Manager: Collector VM is not responding."

• "NSX Manager: Hostname/IP is unreachable"

• "NSX Manager: Insufficient privileges"

Adding a VMC Data source might succeed intermittently, but enabling IPFIX on the data source will fail with error "Failed to get ipfix info." and there will be no IPFIX/Collector profiles created in the NSX UI. 

Environment

VCF Operations for Networks

Cause

An intermediate network firewall between the VMC Collector and the on-premise Platform node prematurely terminates the required 20-minute long-polling TCP connection due to strict idle timeout limits.

Resolution

• Identify the intermediate firewalls routing traffic between the VMC Collector and the on-premise Platform node.

• Modify the TCP idle timeout setting for this specific Collector-to-Platform traffic flow to a minimum of 20 minutes (1200 seconds).

• Alternatively, if organizational security policies prohibit extending the firewall TCP timeout, deploy the Platform node, Collector node, and all targeted data sources entirely within VMC on AWS to bypass the restrictive upstream firewalls.