vSAN File Service Health alert " DNS Forward and Reverse lookup are not working".

Products

• VMware vSAN

Issue/Introduction

• From vSAN Skyline health :
  

 

 

• Validated via /var/run/log/vsanfs.mgmt.log :
• vsanfs.mgmt[2102384]: [2123230] [VDFSEndpointMonitorContainer::_CheckContainerHealthItem] CONT: Error running DnsLookupTest on container ##.##.###.23: dnsbothlookuperror, Forward lookup output:;; communications error to ##.#.#.##53: timed out
  vsanfs.mgmt[2102384]: ;; no servers could be reached
• vsanfs.mgmt[2102384]: Reverse lookup output:;; communications error to ##.#.#.##53: timed out

           vsanfs.mgmt[2102384]: ;; no servers could be reached.

• Also from  /scratch/log/vdfs_support/containers/fs_vm_logs/ :

       #failed to query DNS server: 10.#.#.#:53, query: ;_nfsv4idmapdomain.####.########.###.tw.\tIN\t TXT" error="read udp 10.##.###.##:#####->10.#.#.#:##: i/o timeout".

 

Environment

VMware VSAN 8.x

VMware vSAN File Service

Cause

This behavior is commonly caused by latent DNS resolution failures or incorrect network security policies on the Distributed Port Group (DPG). These issues are often masked by cached configuration within the File Server Virtual Machines (FSVMs) and are only exposed when the FSVMs restart during host maintenance.

Resolution

Follow these steps to remediate the issue:

• Verify DNS Configuration Ensure all FSVMs can successfully perform forward and reverse (PTR) lookups for all required DNS records. Confirm that the DNS server is reachable from the VMkernel interface used for vSAN File Service.
• Validate Distributed Port Group Security Policies Navigate to the Distributed Port Group settings in vCenter. Ensure the following security policies ( Forged Transmits  and  MAC Address Changes are set to Accept and  Promiscuous Mode is set to Reject.

         Networking Considerations for vSAN File Service

• Reinitialize vSAN File Service If DNS and network policies are correct, force a container reinitialization to clear stale cached data:
• • In the vSphere Client, navigate to the vSAN cluster.
  • Select Configure > vSAN > File Service.
  • Disable the vSAN File Service.
  • Wait for the process to complete, then re-enable the vSAN File Service.