NSX UI Blank Display and Search Service AccessControlException Access Denied

Products

• VMware NSX

Issue/Introduction

After upgrading to NSX 9.1, the network centralized Search service displays a running status via the Command Line Interface (CLI) but fails to function. This causes the NSX Manager user interface (UI) to render completely blank grids when attempting to view Compute Managers or ESXi host cluster lists.

When attempting to interact with the lists, the user interface displays the following error:

“Search service is currently unavailable, please restart using NSX CLI command 'restart service search'”

Additionally, the internal search log located at /var/log/search/opensearch.log captures an unhandled runtime thread crash during cryptographic provider instantiation:

[ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [nsx_node] uncaught exception in thread [opensearch[nsx_node][clusterManagerService#updateTask][T#1]] java.security.AccessControlException: access denied ("java.security.SecurityPermission" "getProperty.org.bouncycastle.drbg.entropy_256_effective_bits")

Environment

VMware NSX 9.1.0.0

Cause

The internal OpenSearch cryptography provider (BouncyCastle FIPS) is completely unable to harvest compliant 256-bit hardware entropy vectors required for secure Deterministic Random Bit Generator (DRBG) seed initialization. This occurs because the virtual machine is running on a legacy physical ESXi host CPU or within a cluster restricted by an older Enhanced vMotion Compatibility (EVC) baseline, which actively masks hardware random number generation instructions (RDSEED/RDRAND).

 

Resolution

 

• Log into the managing vCenter Server vSphere client.

• Gracefully power off the affected NSX Manager virtual machine nodes.

• Navigate to the virtual machine action grid and select Edit Settings -> VM Options -> Advanced -> Edit Configuration.

• Locate the configuration key parameter isolation.tools.getEntropy.disable and completely remove it from the attributes list (this purges non-default software restrictions and returns the virtual machine pipeline to native defaults).

• Execute a Cold Migration to relocate the powered-off NSX Manager appliances to an ESXi host cluster featuring a modern CPU architecture baseline that natively supports and passes through unmasked hardware random number instruction sets (RDSEED/RDRAND).

• Power on the migrated NSX Manager nodes.

• Validate that no entropy error is found from /var/log/search/opensearch.log

• Refresh the web browser cache and confirm the Compute Managers and host clusters display data correctly in the UI.