To complete the NSX-v downgrade I deployed a new 6.1.4 appliance and connected it back up to vCenter, configured the hosts, setup VXLAN, transport components and tested NSX Edge deployments through the vCenter Web Client. However, when it came time to test Edge deployments from vCloud Director I kept on getting the following error shown below.
Checking through the NSX Manager logs there was no reference to any API call hitting the endpoint as is suggested by the error detail above. Moving over to the vCloud Director Cells I was able to trace the error message in the log folder…eventually seeing the error generated below in the vcloud-container-info.log file.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
# ==> vcloud-container-info.log <== 2016-09-19 13:55:21,553 | WARN | pool-jetty-71 | LoggingRestTemplate | GET request for "https://per02-nsx-001.zettagrid.local:443/api/2.0/global/config" resulted in 403 (Forbidden); invoking error handler | requestId=50c4037c-b67d-4f8e-bcd3-919a8a7e2e01 2016-09-19 13:55:21,553 | INFO | pool-jetty-71 | ShieldSessionManager | Test connection with vsm:172.17.0.221 failed to establish. | requestId=50c4037c-b67d-4f8e-bcd3-919a8a7e2e01 org.springframework.web.client.RestClientException: Unrecognized vShield Manager response. vShield Manager is unable to process the request or some other error occurred at vShield Manager, please check vShield Manager logs for details. at com.vmware.vcloud.fabric.nsm.error.NetworkSecurityErrorHandler.processException(NetworkSecurityErrorHandler.java:104) at com.vmware.vcloud.fabric.nsm.error.NetworkSecurityErrorHandler.handleError(NetworkSecurityErrorHandler.java:70) at org.springframework.web.client.RestTemplate.handleResponseError(RestTemplate.java:494) at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:451) at com.vmware.vcloud.fabric.net.utils.impl.LoggingRestTemplate.doExecute(LoggingRestTemplate.java:64) at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:409) at org.springframework.web.client.RestTemplate.getForObject(RestTemplate.java:207) at com.vmware.vcloud.fabric.net.utils.impl.RestClient.get(RestClient.java:79) at com.vmware.vcloud.fabric.nsm.niobe.ShieldConfigurationManagerImpl.getVCenterIP(ShieldConfigurationManagerImpl.java:126) at com.vmware.vcloud.net.services.vshield.impl.ShieldSessionManager.testShieldManagerConnection(ShieldSessionManager.java:279) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) |
As a test I hit the API endpoint referenced in the error message from a browser and got the same result.
This got me thinking that the error was either DNS related or permission related. After confirming that the vCloud Cells where resolving the NSX Manager host name correctly, as suggested by the error I looked at permissions as the cause of the 403 error. vCloud Director was configured to use the service.vcloud service account to connect to the previous NSX/vShield Manager and it dawned on me that I hadn’t setup user rights in the Web Client under Networking & Security. Under the Users section of the Manage Tab the service account used by vCloud Director wasn’t configured and needed to be added. After adding the user I retried the vCD job and the Edge deployed successfully.
While I was in this menu I thought I’d test what level of NSX User was required to for that service account to have in order to execute operations against vCloud Director and NSX. As shown below anything but NSX or Enterprise Administrator triggered a “VSM response error (254). User is not authorized to access object” error.
At the very least to deploy edges, you require the service account to be NSX Administrator…The Auditor and Security Administrator levels are not enough to perform the operations required. More importantly don’t forget to add the service account as configured in vCloud Director to the NSX Manager instance otherwise you won’t be able to have vCloud Director deploy edges using NSX-v.
