Node User Account HTTP Status Locked alert - NSX

Products

• VMware NSX

Issue/Introduction

• Recently, the credentials for NSX were rotated through SDDC.
• You observe an alarm in the NSX UI for the VIP node with Event type Node User Account HTTP Status Locked and the following description:
  "Node local user account with username admin is temporarily locked for VCF Networking web access due to # failed authentication attempts were made over this account in last ### seconds."
• You are able to log in to the NSX UI and SSH to NSX Managers with the admin account.
• The following log line identifies the source IP of the service or appliance causing the lockout on the NSX Manager in /var/log/syslog:

  [TIMESTAMP] WARNING NSX 3921 [nsx@4413 comp="nsx-manager" level="WARNING" logger="AuthenticationBlacklistService" subcomp="http" threadName="Processing request [UUID]"] Account admin@<IP> has been temporarily locked for ### seconds after ## consecutive failed login attempts.

• In /var/log/proxy/reverse_proxy.log:

  [TIMESTAMP] ERROR NSX 135546 [nsx@4413 comp="nsx-manager" errorCode="MP403" level="ERROR" logger="NsxRestAuthenticationEntryPoint" subcomp="http" threadName="Processing request [UUID]"] The credentials were incorrect or the account specified has been locked.

Environment

VMware NSX 9.1.x
VCF 9.1.x

Cause

A service is continuously attempting to authenticate to the NSX Manager using an outdated password. Because the password was manually rotated in SDDC Manager but not updated on the connecting appliance, the rapid succession of failed logins triggers the NSX Manager's security lockout policy. This results in a temporary 900-second lockout for the admin account.

Note: The lockout period might be different depending on the password policy configured in VCF Operations.

Resolution

• Identify the specific appliance or service assigned to that IP address.
• Update the configured NSX admin password on that source appliance to match the newly rotated credentials from SDDC Manager.
• Once the failed attempts stop, the lockout timer will expire and clear the alarm in NSX.

Additional Information

Access Control: Password Policy
Error: 403 Forbidden: The credentials were incorrect or the account specified has been locked - when performing a password update or remediate task for SDDC/NSX-T in SDDC Manager.

For more information on Authentication Policy Settings