VMware High Availability cluster reports the error: "vSphere HA agent on this host could not reach isolation address <IP Address>"

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

In the VMware vCenter Server user interface, when navigating to the Hosts and Clusters view with an ESXi host selected, the following error message is displayed:

vSphere HA agent on this host could not reach isolation address <IP Address>

Environment

• VMware ESXi 7.x
• VMware ESXi 8.x
• VMware vCenter Server 7.x
• VMware vCenter Server 8.x
  
  

Cause

VMware vSphere High Availability (HA) regularly contacts its isolation response address using ICMP ping to ensure cluster health and network functionality. By default, this isolation response address is the management network's default gateway, though alternative reliable IP addresses can be configured. This issue occurs when the vSphere HA agent fails to receive an ICMP echo reply from at least one of its configured isolation response addresses, indicating a network communication breakdown.

Resolution

Verify the isolation address connectivity:

• Connect to the affected ESXi host command-line interface (CLI) via SSH or the ESXi Shell.

• Verify network connectivity from the management VMkernel interface to the isolation address using the vmkping utility: vmkping -I vmk<#> <Isolation_IP>

• If the ping fails, perform a packet capture to confirm whether ICMP packets are successfully egressing the host management uplink: pktcap-uw --uplink vmnic<#> --capture UplinkSndKernel,UplinkRcvKernel -o /vmfs/volumes/<datastore>/esxi-uplink.pcapng

• Review the generated packet capture. If the ESXi host is transmitting ICMP echo requests but receiving no echo replies, engage your physical networking team to investigate and resolve potential upstream packet drops, routing issues, or ICMP filtering on the network switch or gateway.

Note:

• If the isolation response address was manually added using the advanced setting das.isolationaddress remove the non-pingable isolation address from your advanced settings and specify a new pingable isolation address.
• When the listed ip address is the currently configured default gateway, add an additional isolation address using das.isolationaddress and disable the use of the default gateway for isolation verification using the advanced setting das.usedefaultisolationaddress set to false.
  • vSphere HA Advanced Settings can be set by selecting a cluster > Configure > vSphere Availability > Edit > Advanced Options. 
  • Changing das.isolationaddress or das.usedefaultisolationaddress will require disabling and re-enabling HA on the cluster to take effect. See vSphere HA Advanced Options

Additional Information

Packet capture: performing-rolling-packet-captures-on-esxi

Similar symptoms: vSphere HA agent on this host could not reach isolation address '#.#.#.#', reported on ESXi host