VCF 9.1 Install issue - NSX Backup failed during bringup

[Kenneth Petersen]

I'm stuck at the VCF installation at "Configure NSX Backup Schedule". I throws the error message "Failed to configure NSX Backup Schedule for NSX Managers - [nsx-machine-name] Reference Token: XXXXXX".

Looking at domainmanager.log, it see this message:
Error while fetching fingerprint of fileserver SDDC-MANAGER at port 22, httpStatus=BAD_REQUEST

However the VCF installer has not yet turned into the SDDC Manager, so of course it's failing.

VCF installer is placed on a host that is part of the management domain, however it have not yet turned into the SDDC manager, is this happens later in the process of the installation.

Any ideas on how to get past this?

[Andreas vonBulow]

In this step, a test SFTP connection is made from the NSX Manager to the SDDC/VCF-Installer as the backup user.
You might also want to have a look at the following kb article https://knowledge.broadcom.com/external/article/399414/vcf-deployment-fails-on-deploy-and-confi.html
to see if its not a login issue.

I had the same issue, checked the bakup user and it was not locked.
Then port 22 gave me the clue to check the ssh daemon on the vcf installer appliance.
My error was the /etc/ssh/sshd_config had a wrong ListenAddress IP, since I re-IPd the appliance network interface before the deployment, but forgot to change the sshd config.
So in my case the deployed NSX Manager could not reach the vcf-installer/soon-to-be-SDDC-Manager to login.
Once fixed, continued with a re-deploy which has no issues so far. 


 

[Allan Solomon Mejia]

Hi Kenneth, 

The error suggests that during the Configure NSX Backup Schedule task, NSX Manager is attempting to establish an SFTP (SSH) connection to the VCF Installer (which later becomes SDDC Manager) to validate the backup destination. Although the appliance has not yet transitioned to SDDC Manager, it should already be reachable over TCP 22 using the configured management IP. Since the domainmanager.log reports a fingerprint retrieval failure on port 22, I'd recommend verifying:

• SSH (sshd) is running and listening on the expected management interface (ss -tlnp | grep :22).
• /etc/ssh/sshd_config contains the correct ListenAddress, especially if the installer appliance was re-IP'd after deployment.
• DNS/FQDN resolution and forward/reverse lookups are correct between NSX Manager and the installer appliance.
• No firewall or ACL is blocking TCP 22 between the NSX Manager and the VCF Installer.
• The configured backup user can successfully authenticate via SFTP/SSH.

 

If all of these checks pass and the failure persists, I'd recommend collecting the domainmanager.log, bringup-debug.log, and NSX Manager logs, then opening a Broadcom Support case to determine whether this is a known issue in your specific VCF 9.1 build.