Unable to convert cluster from baseline to vLCM image due to NSX-T validation error: "Cannot determine whether NSX-T Data Center is enabled on this cluster"

Products

• VMware vSphere ESXi

Issue/Introduction

When attempting to convert a vSphere cluster's lifecycle management method from baselines to a single image using vSphere Lifecycle Manager (vLCM), the operation fails. 
The vSphere Client displays the following error message:     Cannot determine whether NSX-T Data Center is enabled on this cluster. Go to NSX-T Data Center system and enable bidirectional trust.

Additionally, vCenter logs may show a 403 Forbidden error during an API call to an NSX Manager. An example log snippet is as follows:

vum-server.log:
YYYY-MM-DDTXX:XX:XX.XXXZ info vmware-vum-server[191225] [Originator@6876 sub=JsonUtils] [JsonUtils 67] JsonApiGet called. apiPath: /api/v1/transport-node-collections?vc_instance_uuid=xxxxxxxxxxxxx&cluster_moid=domain-cxxxx&check_vlcm_eligibility=true
YYYY-MM-DDTXX:XX:XX.XXXZ error vmware-vum-server[191225] [Originator@6876 sub=JsonUtils] [JsonUtils 98] Response code: HTTP Status:403 'Forbidden' server: xxxnsxmgr.domain.name apiPath: /api/v1/transport-node-collections?vc_instance_uuid=xxxxxxxxxxxxx&cluster_moid=domain-cxxxx&check_vlcm_eligibility=true
YYYY-MM-DDTXX:XX:XX.XXXZ  error vmware-vum-server[191225] [Originator@6876 sub=ImageManager::EnablementManager] [EnablementManager 876] Error invoking nsx-t api: /api/v1/transport-node-collections?vc_instance_uuid=xxxxxxxxxxxxx&cluster_moid=domain-cxxxx&check_vlcm_eligibility=true. Response message: Forbidden. Unable to determine whether nsx-t is enable for 'domain-cxxxxx' cluster. Bidirectional trust is not set.
YYYY-MM-DDTXX:XX:XX.XXXZ  error vmware-vum-server[191225] [Originator@6876 sub=com.vmware.vcIntegrity.lifecycle.CheckFeatureApplicabilityTask] [Task, 524] Task:com.vmware.vcIntegrity.lifecycle.CheckFeatureApplicabilityTask ID:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. Failed to check whether nsx-t is enabled on 'domain-cxxxxx' cluster because bidirectional trust is not set. Error: Bidirectional trust not set.
YYYY-MM-DDTXX:XX:XX.XXXZ  info vmware-vum-server[191225] [Originator@6876 sub=com.vmware.vcIntegrity.lifecycle.CheckFeatureApplicabilityTask] [Task, 524] Task:com.vmware.vcIntegrity.lifecycle.CheckFeatureApplicabilityTask IDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. Finalizing Task
YYYY-MM-DDTXX:XX:XX.XXXZ  error vmware-vum-server[191225] [Originator@6876 sub=com.vmware.vcIntegrity.lifecycle.CheckFeatureApplicabilityTask] [Task, 524] Task:com.vmware.vcIntegrity.lifecycle.CheckFeatureApplicabilityTask ID:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. Task Failed. Error

Environment

vSphere vCenter Server 8.x

Cause

This issue occurs because a stale or orphaned NSX-T extension remains registered in the vCenter Server's database.
During the baseline-to-image conversion process, vLCM performs strict prerequisite checks. Because the stale extension is present in the vCenter Managed Object Browser (MOB), vCenter falsely assumes NSX-T is integrated and active. It then attempts to verify transport node eligibility by querying the designated NSX Manager API. Since the NSX Manager is either decommissioned or not configured, the API call returns an HTTP 403 'Forbidden' error, which halts the entire conversion process.

Resolution

To resolve this issue, you must manually unregister the stale NSX extension from the vCenter Managed Object Browser (MOB) to clean up the vCenter database.

 

Warning: Proceed with caution when making changes in the MOB. Unregistering active or required extensions can cause disruptions. 

Note: Do not proceed without a snapshot of vCenter server.

1. Open a web browser and navigate to the vCenter Managed Object Browser (MOB):

https://<vcenter_fqdn_or_ip>/mob

2. When prompted, log in using an administrator account (e.g., [e-mail]).

3. Click on the Content link.

4. Locate and click on ExtensionManager.

5. Under Properties, review the extensionList values to verify the presence of the nsx or nsxt extension. Make a note of the nsx or nsxt extension.

6. Go back to the home page, then Methods section and click on UnregisterExtension.

7. A new dialog or window will appear. In the extensionKey parameter field, enter the following string noted from step 5:

nsx or nsxt extension

8. Click Invoke Method. A successful execution will return void.

9. Close the prompt window and refresh the ExtensionManager page. Confirm that the extension has been successfully removed from the extensionList.

 

Return to the vSphere Client and retry the cluster conversion from baselines to a vLCM image. The prerequisite check will now bypass the NSX validation and complete successfully.