MPS Phase 2 Installation Failure: Unexpected 500 Internal Server Error During OVF Deployment
search cancel

MPS Phase 2 Installation Failure: Unexpected 500 Internal Server Error During OVF Deployment

book

Article ID: 451481

calendar_today

Updated On:

Products

VMware vDefend Firewall VMware vDefend Firewall with Advanced Threat Prevention VMware vDefend Network Detection and Response

Issue/Introduction

During the Malware Protection Service (MPS) Phase 2 installation, the system attempts to deploy Virtual Machines (VMs) from OVF templates for the Gateway VM and Sandbox VM. The deployment process fails, resulting in an unexpected error.

When inspecting the logs for the malware-analysis-vc-fe3-pipeline* pod, you will see an error entry similar to the following:

fe3_pipeline - ERROR - FE3 pipeline failed : Error running the pipeline stage McLlamaVmMaintainerStage : Could not create new primary VM onprem-sandbox-win11-for-vDefend-5.2.0.0.0-r25400463-primary-vm1 from OVF onprem-sandbox-win11-for-vDefend-5.2.0.0.0-r25400463 : Error calling https://<vcenter-fqdn>/api/vcenter/ovf/library-item/<ITEM_ID>?action=deploy : 500 Server Error : Internal Server Error for url : https://<vcenter-fqdn>/api/vcenter/ovf/library-item/<ITEM_ID>?action=deploy

Environment

  • Security Services Platform (SSP) version 5.2.0.

  • Phase-1 of MPS is already installed.

  • VMware vCenter Content Library configured for OVF deployment.

 

Cause

During Phase-2, MPS invokes the vCenter API endpoint (/api/vcenter/ovf/library-item/<ITEM_ID>?action=deploy) to deploy the OVF templates for the Gateway and Sandbox VMs.

If there is a misconfiguration or policy conflict within the vCenter Content Library, this API call returns an unexpected 500 Internal Server Error.

Common Root Cause: Content Library Security Policy Mismatch

A common scenario causing this issue occurs when OVF templates for the Gateway VM and Sandbox VM are uploaded to a vCenter Content Library before a Security Policy is applied to that Content Library.

Because the library items were added prior to the policy enforcement, they do not comply with the security policy rules, causing the deployment API to fail with a RESOURCE_INACCESSIBLE response.

Resolution

Specific error cases observed:

NameDescriptionResolutionNotes
OVF Template and Content Library Security Policy mismatch.The OVF templates for the Gateway VM and Sandbox VM were uploaded to the content library before that content library had a security policy applied to it.Delete and re-upload the VM templates after the security policy has been added to the content library.

The response body of this API in this case (which is not displayed in logs) will state the error type as "RESOURCE_INACCESSIBLE", and will state the following "default_message": "The operation is not supported on the library item '<ITEM_ID>' because it does not comply with the library's security policy."

 

Example log:


fe3_pipeline - ERROR - FE3 pipeline failed : Error running the pipeline stage McLlamaVmMaintainerStage : Could not create new primary VM onprem-sandbox-win11-for-vDefend-5.2.0.0.0-r25400463-primary-vm1 from OVF onprem-sandbox-win11-for-vDefend-5.2.0.0.0-r25400463 : Error calling https://<vcenter-fqdn>/api/vcenter/ovf/library-item/<ITEM_ID>?action=deploy : 500 Server Error : Internal Server Error for url : https://<vcenter-fqdn>/api/vcenter/ovf/library-item/<ITEM_ID>?action=deploy

If these specific cases do not apply, then the API documentation for /api/vcenter/ovf/library-item/<ITEM_ID>?action=deploy should be referenced for further clues about what could have been misconfigured to cause this error.

This issue is internally tracked through #3714441.

Powered by Wolken Software