vCenter import pre-validation fails with "dvpg has an association with non management traffic type"
Article ID: 449685
Updated On:
Products
Issue/Introduction
When importing an existing vCenter Server to create a Workload Domain in VMware Cloud Foundation (VCF) 9.x, the precheck fails with the following error:
The vCenter Server virtual machine is not connected to a distributed virtual port group or the dvpg has an association with non management traffic type for vcenter_fqdn. Please ensure the vCenter Server virtual machine is connected to a distributed virtual port group (dvpg) and the dvpg is not associated with non-management traffic type.
Environment
Cause
The vCenter being imported is not attached to the same port group as the Management vCenter VM.
When a vCenter being imported is not collocated—meaning its VM runs inside the Management vCenter (rather than inside the vCenter instance it manages itself)—the import guardrails require that VM to be attached to a distributed virtual port group (dvpg) already listed in SDDC Manager's inventory and tagged for MANAGEMENT or VM_MANAGEMENT traffic.
SDDC Manager's inventory only contains the port group that the Management vCenter's own VM is attached to. If the vCenter being imported sits on a different port group, that port group is not in the inventory, so the precheck cannot find it and fails.
The primary architectural reason for this restriction is to ensure that NSX and the vCenter can communicate. During a brownfield import, if the vCenter VM is located in the same vCenter, the port group it is connected to is designated as VM_MANAGEMENT and will be used while deploying NSX. The precheck is designed to ensure that the NSX FQDN/IP falls within the same subnet as the vCenter.
Resolution
The validation can be skipped if a port group tagged VM_MANAGEMENT or MANAGEMENT already exists in the inventory this is the port group NSX will be deployed to.
Before proceeding, confirm in SDDC Manager's inventory that a port group tagged MANAGEMENT or VM_MANAGEMENT already exists, has sufficient free IPs, and has network connectivity to the vCenter VM being imported. If no such port group exists, or if the networking team cannot confirm connectivity requirements are met, do not skip the guardrail treat the scenario as unsupported.
Note: Before proceeding, ensure the networking team confirms that the customer environment has sufficient VLAN/IP capacity for future NSX deployment, as skipping this guardrail may lead to downstream configuration issues.
Steps for VCF 9.0.1 and later
1. Take a snapshot of the SDDC Manager VM.
2. SSH into the SDDC Manager VM as the vcf user and switch to root.
3. Execute the following command to disable the DVPG guardrail echo vcf.import.guardrails.vcenter.vm.dvpg.skip=true >> /etc/vmware/vcf/operationsmanager/application-prod.properties
4. Restart the operations manager service systemctl restart operationsmanager
5. Monitor till service is up watch curl localhost/operationsmanager/about
6. Retry the Workload Domain import process from the VCF Operations UI.
Steps for VCF 9.0.0
1. Take a snapshot of the SDDC Manager VM.
2. SSH into the SDDC Manager VM.
3. Open the import guardrails definition file
vi /opt/vmware/vcf/operationsmanager/scripts/assessment/guardrails/operations/import/import.json
4. Locate the vc-vm-attached-to-dvpg-validator section.
5. Add "runCondition": "false" to the definition to disable it.
6. Save the file and restart the import process.
Feedback
