VCF Operations for Networks Collector Pairing Fails with Shared Secret Error on GCVE

Products

• VCF Operations for Networks

Issue/Introduction

When deploying an VCF Operations for Networks collector node within a Google Cloud VMware Engine (GCVE) environment, the pairing process fails at the "Shared Secret" stage.

You may observe:

• An error message stating "Shared Secret - Failed. Try again" or "Failed to parse provided shared secret" during the OVA deployment wizard or initial configuration.
• The collector appliance powers on but does not appear in the Platform node's Infrastructure and Support dashboard.
• Port connectivity tests for TCP 443 appear successful via basic ping/telnet, but the pairing handshake consistently fails.

NOTE:  VCF Operations for Networks was formerly named Aria Operations for Networks (AON), and prior to that was named vRealize Network Insight (vRNI).

Environment

• VCF Operations for Networks 6.13
• VCF Operations for Networks 6.14.x

Cause

While basic connectivity may exist, specific physical or software firewalls between the GCVE private cloud and the Platform node are blocking or intermittently dropping HTTPS (TCP 443) traffic.

Resolution

1. Verify Mandatory Port Connectivity
   Ensure the following ports are open bidirectionally between the Collector and Platform nodes:
   • TCP 443: Mandatory for HTTPS pairing and management.
   • UDP 123: Required for NTP synchronization (pairing will fail if time drift exceeds 30 seconds).
   • UDP/TCP 53: Required for DNS resolution.
2. Perform Manual Pairing via CLI
   If the pairing fails during the OVA deployment or via the Platform GUI, use the Collector's Command Line Interface (CLI) to manually apply the secret:
   1. Access the Platform node GUI and navigate to Settings > Infrastructure and Support > Add Collector VM
   2. Generate and copy a new Shared Secret.
   3. Log into the Collector appliance via SSH or the VM console using the consoleuser account.
   4. Execute the command: set-proxy-shared-secret
   5. Paste the shared secret when prompted. Note: The secret is only valid for 15 minutes.
   6. Verify pairing status by running: show-connectivity-status

Impact/Risks

• Using the CLI to set the shared secret will overwrite any previous pairing attempts.
• Ensure the Collector has a static IP address assigned; pairing failures can occur if the IP changes during the handshake.

For further assistance, see the Contact Broadcom Support article.

Additional Information

• VCF Operations for Networks Port Requirements
• VCF Operations for Networks 6.14.x Release Notes