vSAN File Service Health alert: "Both DNS forward and reverse lookup are not working or incorrect" on NSX segments
search cancel

vSAN File Service Health alert: "Both DNS forward and reverse lookup are not working or incorrect" on NSX segments

book

Article ID: 454388

calendar_today

Updated On:

Products

VMware vSAN

Issue/Introduction

  • An alarm is triggered in vSAN Skyline Health: "Both DNS forward and reverse lookup are not working or incorrect".

  • vSAN File Service is non-functional.

  • When tested directly from the ESXi host command line interface, the DNS server is reachable, and both forward and reverse DNS resolutions for the FSVM are correct.

  • The vSAN File Service is deployed on an NSX-backed network segment.

Environment

  • VMware vSAN with File Service enabled

  • VMware NSX

  • vSAN File Service VMs (FSVMs) deployed on an NSX segment

Cause

vSAN File Service utilizes File Service VMs (FSVMs) that require dynamic MAC address movement and IP floating across nodes to maintain high availability. When deployed on an NSX segment, default NSX network security profiles restrict MAC address modifications. Consequently, dynamic MAC alterations are intercepted and blocked at the logical switch level, preventing outgoing DNS queries from leaving the FSVMs.

Resolution

To restore network connectivity for the FSVMs, verify the current MAC Discovery profile assigned to the NSX segment. If MAC modifications are not permitted, a custom profile must be created and applied.

Follow the instructions below to verify and configure the NSX segment:

  1. Log in to the NSX Manager UI.

  2. Navigate to Networking > Segments and locate the segment assigned to the vSAN File Service.

  3. Edit the segment and check the currently assigned MAC Discovery profile in the segment profiles section.

  4. Verify if MAC Learning and MAC Change are enabled in this profile. If any of the two options is disabled, proceed to the next step.

  5. Navigate to Networking > Segments > Segment Profiles.

  6. Select the MAC Discovery tab and create a new profile.

  7. Configure the following parameters within the new profile:

    • MAC Learning: Enabled

    • MAC Change: Enabled

  8. Save the newly created MAC Discovery profile.

  9. Return to Networking > Segments and edit the segment assigned to the vSAN File Service.

  10. Replace the existing MAC Discovery profile with the newly created custom profile.

  11. Save the segment configuration.

Network policies will apply immediately, allowing DNS traffic to pass and clearing the vSAN File Service alarm.

Powered by Wolken Software