Ansible WinRM Connection Times Out with "kerberos: HTTPConnectionPool(...): Read timed out"

Products

• VMware NSX

Issue/Introduction

When using Ansible to establish a WinRM connection to a Windows virtual machine, the connection fails with the following error:

kerberos: HTTPConnectionPool(host='<hostname>', port=5985): Read timed out. (read timeout=30)

The error occurs during Ansible communication with the Windows host over WinRM using Kerberos authentication. Basic network is confirmed with ICMP pings and the TCP three-way handshake completes successfully; however, the WinRM session does not establish and the connection eventually times out. 

Environment

NSX 4.x

Cause

The MTU configuration is inconsistent across the end-to-end communication path, resulting in incomplete delivery of the WinRM HTTP request and causing the Kerberos HTTP connection pool read timeout.  

Resolution

1. Verify that the MTU is configured consistently across the complete end-to-end communication path between the Ansible host and the Windows virtual machine, including all intermediate network devices.
2. Follow the Troubleshooting NSX Network Connectivity Issues to validate end-to-end connectivity and identify any network components contributing to the issue.
3. Collect and review packet captures as described in the Troubleshooting Packet Captures for VMware NSX to determine whether the complete WinRM HTTP request is successfully delivered across the network path.