NSX Cloud Account Reporting 'Unauthorized' (403) in VCFA

Products

• VCF Automation

Issue/Introduction

A VM App Tenant is experiencing connection failures to the NSX Manager Cloud Account within VCF Automation (VCFA). The system throws a 403 Unauthorized error, explicitly stating: "The credentials were incorrect or the account specified has been locked."

Environment

VCF Automation 9.x|
VCF NSX 9.x

Cause

The failures are caused by an IP-enforced account lockout policy within NSX, which is being triggered by VCFA continuously attempting to authenticate using an outdated, stored password during automated background tasks (like data collection).By default, NSX locks out a source IP for 15 minutes (900 seconds) after five consecutive failed login attempts. The issue appeared intermittent and random because:

Resolution

Apply the below steps to bounce the tenant-manager pod. This clears any stale authentication states or hung processes, allowing VCFA to establish a fresh connection to NSX Manager.

1. Delete the pod: kubectl -n prelude delete pod tenant-manager-0

2. Monitor the pod until it comes back online: kubectl -n prelude get pods -w | grep tenant-manager-0 (Wait until it reports 1/1 Running).

3. Wait a few minutes, then retry the validation steps. If it still fails, wait a few more minutes and try again.

Additional Information

You can verify this specific lockout behavior in your environment by checking the NSX CLI syslog. Run get log-file syslog and look for the following entries that confirm the lockout and its expiration:

• Account admin@<vRA-node-IP> has been temporarily locked for 900 seconds after <x> consecutive failed login attempts.

• User admin@<vRA-node-IP> login lockout expired

To prevent similar lockouts in the future, you can allowlist the vRA node IPs in NSX by following Broadcom's documentation: Prevent Password Lockout on Local Manager Nodes (Note: While documented under Federation setups, this procedure also applies to standalone NSX Managers).