NSX Manager reports false password expiration alarms due to inconsistent cluster synchronization

Products

• VMware NSX

Issue/Introduction

This article addresses an issue where an NSX Manager node reports a false password expiration alarm for a local service account, even though the expiration date is correctly configured on other cluster nodes.

This mismatch occurs due to an inconsistent synchronization of password expiration configuration across the NSX Manager cluster nodes.

• NSX Manager triggers alarms indicating a password will expire shortly (e.g., 29 days).
• Configured password expiration is set to a much higher value (e.g., 9990 days).
• The alarm is reported only by specific nodes in the cluster, while others report the correct expiration date.

Environment

VMware NSX

Cause

The password expiration configuration is not consistently synchronized between NSX Manager nodes, leading to an alarm being triggered by a node with outdated configuration data.

Resolution

To resolve this issue, reset the cluster credentials to force the manager nodes to re-align their configuration states. Perform the following steps:

1. Access the affected NSX Manager node via SSH with root mode.
2. Stop the NSX Management Plane API service: /etc/init.d/nsx-mp-api-server stop
3. Create the reset flag file by running the following command: touch /var/vmware/nsx/reset_cluster_credentials
4. Start the NSX Management Plane API service: /etc/init.d/nsx-mp-api-server start
5. Switch to admin mode :su admin 
6. Re-apply the correct password expiration policy using the set command: set user 'user-name' password-expiration
7. Verify that the alarm is cleared and the expiration date is consistent across all nodes.