VMware Live Site Recovery (VLR/Protection & Recovery) stops working after vCenter Upgrade

Products

• VMware Live Recovery
• VMware vCenter Server

Issue/Introduction

After upgrading the vCenter Server, VMware Site Recovery Manager (SRM) (VMware Live Site Recovery / now VCF Protection and Recovery) may fail to communicate with vCenter. As a result, one or more of the following symptoms may be observed:

1. SRM is unable to connect to vCenter.

2. Site pairing fails or becomes disconnected.

3. The SRM plug-in is unavailable in the vSphere Client.

4. Protection Groups and Recovery Plans cannot be validated or executed.

5. Inventory synchronization and replication status updates fail.

6. The srm-server service fails to start or repeatedly disconnects from vCenter.

Environment

Protection and Recovery 9.x

VMware Live Site Recovery (All versions)

VMware Site Recovery Manager (All versions)

Cause

SRM is tightly integrated with the vCenter infrastructure and relies on the Lookup Service, Solution Users, SSL certificates, and SSO authentication rather than a simple username/password connection. During a vCenter upgrade, these components may be modified, causing the trust relationship between SRM and vCenter to become invalid.

The primary causes include:

SSL Trust and Certificate Changes

1. During the upgrade, VMware Certificate Authority (VMCA) may generate new root and endpoint certificates.
   
   
2. SRM stores the original vCenter SSL certificate thumbprint in its local configuration. After the upgrade, the certificate thumbprint no longer matches, causing SSL validation failures and preventing SRM from establishing a secure connection.

Lookup Service Registration Changes

1. SRM registers itself as a vCenter extension through the Lookup Service.
   
   
2. During the vCenter upgrade, the Lookup Service and its component registrations may be recreated, causing SRM endpoint registrations to become stale, overwritten, or removed.

Solution User and SSO Token Invalidations

1. SRM authenticates using a dedicated Solution User and SAML security tokens.
   
   
2. The vCenter upgrade may invalidate or desynchronize these authentication tokens and Solution User permissions, preventing SRM from successfully authenticating with the upgraded vCenter.

Version Compatibility

1. If the installed SRM version is not supported with the upgraded vCenter version, API incompatibilities may prevent normal communication until SRM is upgraded to a compatible release.
   
   
2. Collectively, these changes disrupt the secure communication channel between SRM and vCenter, resulting in authentication, registration, and connectivity failures.

Resolution

Restore the communication and trust relationship between SRM and the upgraded vCenter by performing the following steps:

1. Run the SRM Appliance Reconfigure Wizard from the SRM Virtual Appliance Management Interface (VAMI) on both protected and recovery sites.

During the reconfiguration, SRM automatically:

• • Downloads and trusts the new vCenter/VMCA certificates.
    
    
  • Updates the SRM certificate trust store.
    
    
  • Re-registers the SRM (vcDr) extension with the vCenter Lookup Service.
    
    
  • Re-establishes secure communication between SRM and the vCenter inventory.
    
    
  • Re-authenticates the SRM Solution User and refreshes SSO security tokens.

2. Verify that the installed SRM version is compatible with the upgraded vCenter Server and upgrade SRM (and vSphere Replication, if applicable) if required.

Best Practice: VMware recommends running the SRM VAMI Reconfigure workflow on both SRM appliances immediately after upgrading each vCenter Server, even if no issues are immediately observed. This ensures that certificate trust, Lookup Service registrations, and SSO authentication are synchronized with the upgraded vCenter environment and helps prevent post-upgrade connectivity issues.