Error: 'MPA config file does not exist' during NSX Edge Host Certificate Push with NSX

Products

• VMware NSX

Issue/Introduction

• NSX Edge shows all Managers in standby when you issue the nsxcli command get managers:

  <NSX Manager IP> Standby (NSX-RPC) *

• Controllers show status as disconnected when you issue the nsxcli command get controllers:

  Status: disconnected
  Failure Reason: CONTROLLER_REJECTED_HOST_CERT

• During a transport node certificate push, running the push host-certificate command as admin from the NSX Edge CLI results in an error:

  push host-certificate <Manager hostname-or-IP> username admin thumbprint <thumbprint>
  % Push certificate failed: 'MPA config file does not exist'

Environment

VMware NSX

Cause

• If the file mpaconfig.json in /etc/vmware/nsx-mpa does not exist or does not have the right permissions, the error is expected.

Resolution

1. Verify the permissions of the /etc/vmware/nsx-mpa/mpaconfig.json file as the root user on the affected Edge with the command:

   ls -lrt /etc/vmware/nsx-mpa/mpaconfig.json
   -rw------- mpa mpa 1.3K mpaconfig.json

2. Correct the file permissions on the affected Edge using the command below:

   chmod 660 /etc/vmware/nsx-mpa/mpaconfig.json

3. Verify the correct permissions were set with the command from step 1:

   ls -lrt /etc/vmware/nsx-mpa/mpaconfig.json
   -rw-rw---- mpa mpa 1.3K mpaconfig.json

4. Push the host-certificate again:
   As admin:

   push host-certificate <Manager hostname-or-IP> username admin thumbprint <thumbprint>

   As root:

   su admin -c push host-certificate <Manager hostname-or-IP> username admin thumbprint <thumbprint>
   Host certificate was pushed to management plane successfully

5. Verify the Edge is in a connected state with the NSX Manager(s) with the admin user:

   get managers
   - <NSX Manager IP> Connected (NSX-RPC) *
   - <NSX Manager IP> Connected (NSX-RPC) 
   - <NSX Manager IP> Connected (NSX-RPC)

Additional Information

"MPA Disconnected" Alarm For Transport Node causing Transport Node state to be "Disconnected"