NSX Host Upgrade Fails in 2-Node Clusters Due to HA Admission Control

Products

• VMware NSX

Issue/Introduction

• When upgrading NSX-T on ESXi hosts that reside within a 2-node cluster, the upgrade may fail during the host remediation/maintenance mode phase.
• The NSX Manager UI or vCenter Server displays an error indicating that the host cannot enter maintenance mode.
• Error in vCenter:

`Upgrade failed: Failed getting hosts recommendation from DRS to enter maintenance mode for cluster <cluster-name>. Reason: There are insufficient memory resources on standby hosts`

• The ESXi host remains in a 'Maintenance Mode Pending' state or fails to enter maintenance mode entirely.
• This issue is specific to small clusters (typically 2 nodes) where resource redundancy is strictly enforced.

Environment

VMware NSX

Cause

In a 2-node cluster, Admission Control typically requires enough free resources on the remaining host to support the failure of one host (50% redundancy). When one node attempts to enter maintenance mode, the vSphere environment treats it as if that node's resources are unavailable. If the remaining single node cannot satisfy the HA redundancy policy requirements, Admission Control blocks the host from entering maintenance mode to prevent a potential violation of the availability policy.

Resolution

To allow the upgrade to proceed, vSphere HA  Admission Control must be temporarily relaxed or disabled.

Review this process before proceeding:

1. Log in to the vCenter Server.
2. Navigate to the Cluster settings for the affected 2-node cluster.
3. Go to Configure > vSphere Availability > Edit.
4. Select Admission Control.
5. Change the setting to Disabled or temporarily reduce the reserved capacity percentage to allow the host to enter maintenance mode.
6. Retry the NSX host upgrade from the NSX Manager UI.
7. Once the upgrade is complete for all hosts in the cluster, re-enable Admission Control to restore high availability protection

 

Additional Information

vSphere HA Admission Control

NOTE: As per VMware by Broadcom documentation to use vSphere HA admission control you must have at least 3 hosts in the cluster.