License Hub 2.0 deployment fails when setting the IP pool

Products

• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

After the License Hub 2.0 appliance is deployed and powered on, the appliance starts but the setup does not complete. The following error is displayed:

Symptoms

• The OVA/OVF deployment itself completes without error.
• The appliance reports the failure at the IP pool configuration stage after first boot, on the virtual console.
• The appliance management IP does not respond to ping.
• The License Hub UI is not reachable, or reports that services have not started.

Environment

License Hub 2.0

 

Cause

License Hub 2.0 does not validate the IP pool values entered during OVA/OVF deployment. Because there is no verification step, a misconfigured IP pool is accepted at deploy time and only fails later, when the appliance tries to apply the configuration on first boot.

Common misconfigurations:

• The IP pool contains more than two addresses.
• The appliance's own management IP is inside the IP pool range.
• The Kafka node IP is not the second address in the pool.
• The appliance FQDN or Kafka FQDN does not resolve.

Example of a failing configuration

The Ready to complete page below shows both problems at once — the pool contains three addresses, and the appliance management IP is the first address in that pool:

Property	Value
Management Network IPv4 Address	10.#.#.231
IP Pool	10.#.#.231 – 10.#.#.233

Resolution

License Hub 2.0 requires three IP addresses in total: one for the appliance, and two for the IP pool.

#	Address	Requirement
1	Appliance management IP	Must have a fully resolvable FQDN (forward and reverse). Must be outside the IP pool range.
2	IP pool — first address	Must be the address immediately below the Kafka node IP (the pool is two consecutive addresses).
3	IP pool — second address	Must be the Kafka node IP, with a fully resolvable FQDN (forward and reverse).

 

Corrected example

Using the same addresses as the failing deployment above:

Role	Value
Appliance FQDN	lh20test.example.com
Management Network IPv4 Address	10.#.#.231
Kafka FQDN	lh20test1kafka.example.com
IP Pool	10.#.#.232 – 10.#.#.233
Kafka node IP (second address in pool)	10.#.#.233

Steps

1. Confirm that forward and reverse DNS records exist for both the appliance FQDN and the Kafka FQDN, and that they resolve from the appliance's network.
2. Confirm that all three addresses are free — not assigned elsewhere and not inside a DHCP scope.
3. Confirm that the management IP and the IP pool do not overlap the Internal Cluster Network Non-routable CIDR (default 10.#.#.#/16). If the management network uses addresses in that range, change the internal cluster CIDR to a range that does not conflict.
4. Redeploy the License Hub 2.0 OVA/OVF with the corrected values. These properties cannot be changed in place — the appliance must be redeployed.
5. After first boot, confirm on the virtual console that no IP pool error is reported, that the management IP responds to ping, and that the License Hub UI is reachable.