We have moved things forward (using various machine account reset procedures, including this one: VMware Knowledge Base ) and now Site B is able to browse Site A. However it seems the root problem was with Site B as site A still can not browse this.
Site A now reports:
2020-09-14T16:03:32.473567+00:00 err vmdird t@139750677653248: _VmDirFetchReplicationPage: error: 53 filter: 'uSNChanged>=90807' requested: 1000 received: 0 usn: 90806 utd: '765c1341-c05f-11e5-ae51-000c29865313:95793,'
Which isn't very interesting, however site B now says this:
2020-09-14T15:59:31.962756+00:00 err vmdird t@140568298514176: VmDirSendLdapResult: Request (Search), Error (53), Message (Server in not in normal mode, not allowing outward replication.), (0) socket (ip.ip.ip.ip)
A bit more googling around led us to this command and output:
# /usr/lib/vmware-vmafd/bin/dir-cli state get
Enter password for administrator@vsphere.local:
Directory Server State: Failure (5)
There are a couple of articles around this but just attempting to change the state but this CLI output implies this is no longer available with the 6.7 VCSA:
# /usr/lib/vmware-vmafd/bin/dir-cli state set --state NORMAL
Enter password for administrator@vsphere.local:
dir-cli failed. Error 9001: Possible errors:
LDAP error: Operations error
Win Error: Operation failed with error ERROR_INVALID_FUNCTION (1)
and trying to follow other options to reset the password doesn't seem to work either:
# vcenter-restore -u administrator
Please enter SSO Admin Password:
Restore of embedded node is not supported via this script. Exiting.
This seemed to work as a script but didn't resolve the problem:
/usr/lib/vmware-vmafd/bin/dir-cli computer password-reset --login administrator --live-dc-hostname fbsshefvc.fletchers.corp --password XXXXXXX
It feels like we are at the root cause now though, there is a problem with the PSC or 'Directory Server' on Site B.
