NSX Manager deployment fails with "connection refused" during Workload Domain import in VMware Cloud Foundation

Products

• VMware Cloud Foundation
• VMware NSX

Issue/Introduction

During the VMware NSX Manager deployment task within a VMware Cloud Foundation Workload Domain import workflow, the deployment fails. The NSX Manager nodes may enter a hung state in the CLI, and the SDDC Manager UI displays a continuous spinning status.

Symptoms:

• NSX Manager appliances appear unresponsive via console/CLI.
• SDDC Manager tasks fail during the "NSX Manager deployment task" or "Import Existing vCenter" workflow.

Error Messages:

• Error in configuring VLAN backed transport node collections
• Remediation Message: Reference Token: 3G65A6
• Connection Refused (when SDDC Manager attempts to reach the NSX Manager API).

Environment

VMware Cloud Foundation 9.0.x

Cause

The deployment failure occurs due to missing core appliance credentials, specifically the root and audit passwords, in the input parameters during the initial Workload Domain creation wizard.

During the workload domain import, the root, admin, and audit passwords were left empty. Omitting these mandatory security parameters causes the OVF deployment of the NSX Manager appliance to fail when provisioning its guest operating system. As a result, critical internal local daemons (such as the SSH daemon and the NSX Reverse Proxy for port 443 handling) cannot initialize, resulting in the appliance rejecting inbound configuration requests from SDDC Manager.

Resolution

To resolve this issue, perform a clean redeployment ensuring all mandatory credential fields are populated.

1. Log into the management or workload vCenter Server associated with the deployment.
2. Locate the partially deployed or unresponsive NSX Manager VMs.
3. Power off and Delete from Disk these VMs to prevent IP address or FQDN conflicts during the retry.
4. Return to the SDDC Manager UI and initiate a new Import Workload Domain workflow.
5. On the NSX Configuration screen, ensure that the following password fields are fully populated:
   • Root
   • Admin
   • Audit
   • Note: Ensure passwords meet the minimum complexity requirements.
6. Proceed through the UI validation phase to confirm all parameters are correct before starting the automated deployment task.

Additional Information

• Populating these passwords ensures the NSX Manager's first-boot script can successfully configure local authentication accounts and start core management services.
• Once services are active, the appliance will correctly listen on port 443, allowing SDDC Manager to establish the necessary sessions to finalize the integration.