SSP : vSphere Content Library related to SSP gets deleted or enters an unknown state

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Firewall

Issue/Introduction

The vSphere Content Library associated with SSP (Security Services Platform) is accidentally deleted.

The Content Library storage backing is reported as unavailable or in an unknown state in vCenter.

 

 

Cause

Due to an underlying vCenter or storage backing issue, the Content Library becomes unavailable or enters an unknown state. Alternatively, the Content Library may have been deleted manually by mistake.

Resolution

Follow the steps below to re-establish the Content Library in vCenter and re-upload the required SSP node OVA template via the SSPI Platform API.

Step 1: Re-create or Rename the Content Library in vCenter

Log in to the vSphere Client.

Evaluate the state of the SSP Content Library:

If the Content Library exists but is in an unknown/unavailable state: Rename the existing library (e.g., content-lib.old).

If the Content Library was deleted: Proceed directly to creating a new one.

Create a new Content Library with exact same name as the original SSP Content Library.

Note : Keep all settings at default, ensuring the datastore backing selected is the original storage location where the Content Library was previously provisioned.

Step 2: Identify the Correct SSP Node OVA File

Log in to the SSPI appliance via SSH (sysadmin).

Identify the active installed version of SSPI:

cat /etc/vsx_issue

Example Output:

Plaintext
version: 5.1.1.1.0.25541324
node-type: ssp-installer
build-type: release

cd /depot

example output : 

root@n2sspi:/depot# ls
5.1.1.0.0.25224330  5.1.1.1.0.25541324  lost+found
root@n2sspi:/depot#

Locate the corresponding ssp-node*.ova file inside the /depot directory:

find . -name "ssp-node*.ova"

Example Output:

root@n2sspi:/depot# find . -name "ssp-node*.ova"
./5.1.1.1.0.25541324/ssp-node/ova/ssp-node-5.1.1.1.0.25541329.ova
./5.1.1.0.0.25224330/ssp-node/ova/ssp-node-5.1.1.0.0.25224334.ova
root@n2sspi:/depot#

versionTag: 5.1.1.1.0.25541324

fileParentDir: ssp-node/ova

filename: ssp-node-5.1.1.1.0.25541329.ova

Step 3: Trigger the API Call to Create the Template in the same content library.

Switch to root privileges:

sudo -i

Execute the API request to register the OVA template back into the newly created Content Library.


curl -i -X POST "http://localhost:8080/sspi/platform/1/ova/create-template" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -H "x-nsx-roles: ZW50ZXJwcmlzZV9hZG1pbg==" \
  -H "x-ssp-roles: ZW50ZXJwcmlzZV9hZG1pbg==" \
  -d '{
    "mount": "/depot",
    "versionTag": "5.1.1.1.0.25541324",
    "fileParentDir": "ssp-node/ova",
    "filename": "ssp-node-5.1.1.1.0.25541329.ova"
  }'



Important Note: You must include the custom headers x-nsx-roles: ZW50ZXJwcmlzZV9hZG1pbg== and x-ssp-roles: ZW50ZXJwcmlzZV9hZG1pbg== (enterprise_admin in base64). Omitting these headers will cause the API call to fail due to insufficient permissions.

Step : Verify If template has been uploaded to content library. ( Example output after uploading the template)