Error: shim_lock protocol not found during NSX Bare Metal Edge installation

Products

• VMware NSX

Issue/Introduction

• When installing NSX Bare Metal Edge using an ISO image on servers with UEFI enabled, the installation fails during the initial boot sequence.
• • The installer fails to load the kernel.
  • The console displays the following errors:
    • error: shim_lock protocol not found
    • error: you need to load the kernel first
  • Issue is observed on hardware such as Lenovo SR630 V4.

Cause

The NSX Bare Metal Edge bootloader supports UEFI mode but does not currently support Secure Boot signature validation. The server's UEFI firmware blocks the execution of the bootloader because it lacks a valid Secure Boot signature.

Resolution

To complete the installation, Secure Boot must be disabled while maintaining UEFI mode.

1. Enter the server BIOS/UEFI setup (e.g., press F1 during boot on Lenovo SR630 V4).
2. Navigate to the Security or Boot menu.
3. Locate the Secure Boot setting.
4. Set Secure Boot to Disabled.
5. Save the settings and restart the server.
6. Proceed with the NSX Bare Metal Edge installation using the ISO image.

Additional Information

• UEFI mode is supported for bare metal edges but not for virtual appliances (manager or edge VMs).
• For virtual appliances, use Legacy BIOS mode.