NSX Federation LM-LM sync issue due to SSL/TLS connection failure.
search cancel

NSX Federation LM-LM sync issue due to SSL/TLS connection failure.

book

Article ID: 452762

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

  • Dynamic group members fail to synchronize across Local Managers (LMs).
  • LM-LM synchronization over port 1236 is broken. When checking the synchronization status, it remains stuck in a handshake state.
  • Running >get site-replicator remote-sites shows the status as handshake in progress

>get site-replicator remote-sites
Site ID                                Site Name                      Status    
d26f3########bba6                      LM-2                     handshake in progress

  • Packet captures reveal a TLS Client Hello packet sent from LM-1 that is never received by LM-2, indicating a drop by an intermediary network device followed by a TCP_RST.
  • NSX Manager logs (/var/log/vmware/appl-proxy-rpc.logs) show SSL connection failures and resets:
    YYYY-MM-DD HH:MM:SS.ms Local-Manager NSX 1945 - [nsx@6876 comp="nsx-manager" subcomp="appl-proxy" s2comp="nsx-net" tid="1990" level="ERROR" errorCode="NET4"] NetTransport[1] Accept on endpoint 'ssl://0.0.0.0:1236' failed with error 104-Connection reset by peer from remote endpoint 'ssl-tcp://10.8#.##.16:52#08'
    YYYY-MM-DD HH:MM:SS.ms Local-Manager NSX 1945 - [nsx@6876 comp="nsx-manager" subcomp="appl-proxy" s2comp="nsx-net" tid="1990" level="INFO"] StreamSocket[8273 Closing f:78 i:11507572 ssl://0.0.0.0:1236 <- 10.8#.##.16:52#08] DoClose
    YYYY-MM-DD HH:MM:SS.ms Local-Manager NSX 2011 - [nsx@6876 comp="nsx-manager" subcomp="appl-proxy" s2comp="nsx-net" tid="2044" level="INFO"] StreamConnection[9852808 Closing on ssl://0.0.0.0:1236 sid:9852808] Closing (reason: network error)

Environment

VMware NSX

Cause

The LM-LM synchronization issue is caused by an intermediate network device dropping the TLS Client Hello packet. This prevents the SSL handshake from completing on port 1236.

Resolution

Follow these steps to diagnose and resolve the connection failure:

  1. Verify Synchronization Status
    Run the following command on the Local Manager to check the current state: > get site-replicator remote-sites
    Note: The status should ideally be data synced.

  2. Test Port Connectivity
    Verify that port 1236 is open across the LMs by running:
    # nc -zv <lm-manager-ip> 1236

  3. Check TCP Connection State
    Run the following command to check if the connection is established:
    # netstat -nap | grep 1236
    If the state is SYN_SENT, it indicates the packets are being dropped. Proceed to packet captures to identify the drop point.

  4. Perform Packet Captures
    Run captures on the NSX Manager switchport and uplink to identify where the packet is lost: 

   pktcap-uw --switchport ######## -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/pcaps/LM-1.switchport.########.pcapng & pktcap-uw --uplink vmnic# -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/pcaps/LM-1.uplink.vmnic#.pcapng

     pktcap-uw --switchport ######## -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/pcaps/LM-2.switchport.########.pcapng & pktcap-uw --uplink vmnic# -o /vmfs/volumes/FULL_PATH_TO_DATASTORE/pcaps/LM-2.uplink.vmnic#.pcapng

 5. If the packet capture confirm the drops at physical network, engage the physical network team accordingly.

Additional Information

Sample packet capture results:

Captures from the ESXi host uplink show the TLS Client Hello packet being sent from LM-1 but failing to reach the LM-2 uplink. This confirms a physical network issue or an intermediary security device dropping the TLS handshake client Hello packet. 

LM-1-uplink.pcapng :
37872    2026-08-13 11:26:32.203069   10.8#.#.16  10.7#.#.15  TCP    66        0.000081    0x7436 (29750)    52808 → 1236 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 WS=128
37899    2026-08-13 11:26:32.218409   10.7#.#.15  10.8#.#.16  TCP    66        0.000734    0x0000 (0)        1236 → 52808 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1380 SACK_PERM=1 WS=128
37900    2026-08-13 11:26:32.218507   10.8#.#.16  10.7#.#.15  TCP    60        0.000098    0x7437 (29751)    52808 → 1236 [ACK] Seq=1 Ack=1 Win=64256 Len=0
37912    2026-08-13 11:26:32.222834   10.8#.#.16  10.7#.#.15  TLSv1  378       0.000074    0x7438 (29752)    Client Hello <---------Client Hello
37916    2026-08-13 11:26:32.223194   10.7#.#.15  10.8#.#.16  TCP    60        0.000008    0xd07e (53374)    1236 → 52808 [RST, ACK] Seq=1 Ack=325 Win=64256 Len=0

LM-2-uplink.pcapng:
982  2026-08-13 11:26:32.203429 10.8#.#.16  10.7#.#.15 TCP 66 0.000034 0x7436 (29750)    52808 → 1236 [SYN] Seq=0 Win=64240 Len=0 MSS=1380 SACK_PERM=1 WS=128
983  2026-08-13 11:26:32.203545 10.7#.#.15  10.8#.#.16  TCP 66 0.000116 0x0000 (0)        1236 → 52808 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM=1 WS=128
1010 2026-08-13 11:26:32.218249 10.8#.#.16  10.7#.#.15 TCP 60 0.006121 0x7437 (29751)    52808 → 1236 [ACK] Seq=1 Ack=1 Win=64256 Len=0
1020 2026-08-13 11:26:32.223557 10.8#.#.16  10.7#.#.15 TCP 60 0.001743 0xed7d (60797)    52808 → 1236 [RST, ACK] Seq=1 Ack=1 Win=64256 Len=0

Powered by Wolken Software