Error occurred during operation on cluster Error: NSX cannot be enabled on vLCM enabled cluster as required configurations are not created during host prep.

Products

• VMware NSX

Issue/Introduction

• While attempting to configure or prepare NSX on a vSphere Lifecycle Manager (vLCM) enabled cluster or while converting a cluster to vLCM managed / image based the configuration fails
• In the NSX user interface, the cluster status displays as Preparation Failed. Clicking this status presents an error message stating that NSX cannot be enabled because the required configurations are not created on the Compute Manager, and indicates that the cluster is not in sync.
• Error observed in GUI :

Error occurred during operation on cluster: <Cluster-ID> Error: NSX cannot be enabled on vLCM enabled cluster as required configurations are not created on Compute Manager. Please perform edit action on Compute Manager [<Compute-Manager-ID>] to enable trust and create service account .. The cluster <Cluster-Name> is not in sync. Click 'Resolve' to initiate sync between the NSX Manager and vLCM on vCenter.

• Checking Trust and Service account on NSX shows it is configured and healthy.
• Review of the NSX syslog (var/log/syslog) shows a timeout to the compute manager on port 9087, the port required for NSX to connect to vLCM.

Pushing NSX depot(s) on Compute Manager: <Compute-Manager-ID> failed with error: Error while logging into VCorg.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://<vCenter-IP>:9087/vum-fileupload/login": Connect to <vCenter-IP>:9087 failed: Connection timed out; nested exception is org.apache.http.conn.ConnectTimeoutException: Connect to <vCenter-IP>:9087 failed: Connection timed out. Retry Transport Node Collection at cluster.

 Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX

Cause

Network firewall rules are blocking traffic on TCP port 9087 between the NSX Managers and the vCenter Server. This block prevents the NSX Manager from connecting to the vLCM depot endpoint (/vum-fileupload/login) on vCenter to push required depot configurations. The timeout causes the synchronization routine between the Compute Manager and vLCM to fail. Due to an issue relating to the error handling, if the service account / trust had previously failed the incorrect error message will display on the GUI.  In this circumstance, the logs will be the source of truth for the current blocking issue.

Resolution

The error message mishandling is a known issue impacting VMware NSX. Subscribe to this KB article to be updated if a fix version becomes available. 

To resolve the timeout issue, you must open the required network pathways and force a manual synchronization:

1. Coordinate with your network security team to modify your network firewall policies.

2. Open TCP port 9087 to allow unrestricted traffic from all three individual NSX Managers to the vCenter Server.

3. Validate port connectivity from the NSX Manager command-line interface (CLI) to the vCenter Server using network testing utilities (such as curl or nc).

4. Open the NSX Manager UI, locate the failed cluster, and click Resolve to trigger a manual synchronization between the NSX Manager and vLCM on vCenter.