NSX Upgrade Pre-Check Fails with Repository Sync Error due to internal DNS misconfiguration.
Article ID: 445484
Updated On:
Products
Issue/Introduction
When running an upgrade pre-check , the task fails during the repository synchronization phase.
The upgrade coordinator reports that the system is unable to fetch necessary upgrade binaries between the NSX Manager nodes.
Reviewing the NSX appliances shows Repo_sync is in failed state.
Log lines similar to the below are encountered in /var/log/nsxapi.log
INFO RepoSyncThread-1746706374224 RepoSyncFileHelper 5414 SYSTEM [nsx@6876 comp="nsx-manager" level="INFO" subcomp="manager"] Command to get server info for https://####:443/repository/<nsx version>/Manager/dry-run/dry_run.py returned result CommandResultImpl [commandName=null, pid=0, status=FAILED, errorCode=51, errorMessage=curl_wrapper: (51) SSL: no alternative certificate subject name matches target host name '####'
Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.
Environment
VMware NSX
Cause
The root cause is an internal DNS misconfiguration involving a duplicate or stale pointer (PTR/A) record in the environment for teh NSX appliances.
During the repository sync process, NSX Manager nodes securely communicate with each other using the curl_wrapper utility. The local node queries the DNS server to resolve the target manager node's IP address.
In this scenario, a stale or duplicate DNS entry exists where the target NSX node's IP address is also associated with an obsolete server's FQDN.
Resolution
This behavior is not an issue with the product. It represents an environmental DNS routing and resolution discrepancy.
To resolve the issue and pass the upgrade pre-check, you must correct the internal DNS environment:
Validation Steps:
Perform forward and reverse DNS lookups for the impacted NSX Manager nodes from within the NSX Manager CLI or a network utility:
nslookup <NSX-Manager-IP>nslookup <NSX-Manager-FQDN>
Ensure that the IP address resolves exclusively to the correct NSX Manager FQDN and does not return multiple hostnames or point to stale inventory.
If duplicate or incorrect PTR/A records are found, have the customer's network/system admin remove the conflicting DNS entries and re-run the upgrade precheck. No certificate replacement is necessary in this scenario.
Additional Information
Please check the KB provided below for the same issue triggered due to malformed NSX appliance certificates.
NSX Upgrade Precheck fails due to a repo_sync issue on the NSX Managers
If you are contacting Broadcom support about this issue, please provide the following:
NSX Manager support bundles.
Specific error details present in the NSX Manager UI.
Handling Log Bundles for offline review with Broadcom support:
Feedback
