1. Is the VASA Provider running?

• Try to access https://<VC-IP>/vsanHealth/vsanvp/version.xml
  If this page can be accessed and shows version information, see below, it means vsanvp is working correctly.
  <vasa-provider>
  <supported-versions>
  <version id="4" serviceLocation="/vsanHealth/" vmomiServerVersion="newest"/>
  </supported-versions>
  </vasa-provider>
• If the version page can't be accessed, please check vmware-vsan-health service's status by running the following command service-control --status vmware-vsan-health, example output:
  Running:
  vmware-vsan-health
• If vmware-vsan-health is running, please check vsanvp logs in /var/log/vmware/vsan-health/vsanvp.log for the following message, "VSAN VP registration done". This means vsanvp has registered to sps.

1. Is the VASA Provider running?

One possibility is that the VASA provider (vsanvpd) is not running on the host. This can be examined easily by checking the status of vsanvpd with the init script:

If the vsanvpd is not running, start it manually:

Recheck the service. If it fails again, examine the log file to determine what the error is, and examine the Knowledge Base, Bugzilla, etc. for a resolution.

2. Is the VASA Provider reachable?

If the VASA provider is running on the hosts, the issue may be related to network connectivity. The vCenter Server and the on-host VASA providers communicate over port 8080. This port must be open to register VASA providers. This is easy to check on either Windows or Linux vCenter.

1.  Check for VASA accessibility

To examine for port liveness, connect to the VASA provider via port 8080 and determine if the VASA XML information is returned. This process varies between the vCenter Server Appliance (VCSA) and Windows vCenter.

Appliance:

Use the cURL utility to check the VASA Provider:
curl --insecure https://<host>:8080/version.xml

Windows:

Use a web browser to check the VASA Provider by navigating to https://<host>:8080/version.xml


If this type of XML response is not received even though the VASA provider is running, it indicates that something may be interfering with communication between the vCenter Server and the ESXi hosts over port 8080. Check the following:

2. Check ESXi host firewalls

 Examine the host Security Profile and ensure that the vsanvp rule is enabled to permit host communication over port 8080:

3. Check vCenter Server firewall

• On Windows vCenter Server, check that the Windows Firewall is either disabled or that all VMware-installed rules are active. In addition, check for custom rules that may be interfering with port 8080 outbound or inbound.
• On the VCSA, the firewall should be correctly configured by default.

If all host-side and vCenter firewalls are configured as expected but the VASA provider on the hosts is still inaccessible, it is very likely that a physical or virtual firewall may be interfering upstream - between vCenter Server and the ESXi hosts. Engage with the customer's network/firewall teams to make that determination.

3. Examine VASA certificates

If the VASA provider is running and it is not reachable by vCenter Server, the problem may be related to certificates. VASA and SPBM use certificate exchange, and the vCenter Server must accept the VASA provider certificates.

Certificate-related problems will be called in the SPBM Java process's wrapper log. The location varies by vCenter Server type.

Windows vCenter Server: %ProgramData%\VMware\vCenterServer\logs\vmware-sps\wrapper.log
VCSA: /var/log/vmware/vmware-sps/wrapper.log

If certificate-related problems are reported, examine the KB, Bugzilla, etc. for guidance based on the error message.

For more information, see 

• After an upgrade from vCenter Server 5.x to vCenter Server 6.0, you see a critical alarm for certificate expiry (2120105)

In some cases, the VASA provider certificate may have a 0 Byte size. To resolve this, the host-side (provider) VASA certificates are required, These are stored on each ESXi host in /etc/vmware/ssl/

It is usually the vsanvp_castore.pem that is 0 Bytes. In this case you can SCP a good copy from another host and restart /etc/init.d/vsanmgmtd and the issue will be cleared.

In certain rare circumstances, usually in vSphere 5.5, the VASA provider may need to be manually registered. To accomplish this, the host-side (provider) VASA certificate is required, This is stored on each ESXi host in /etc/vmware/ssl/vsanvp.pem 

1. Ensure that the VASA Provider is running and accessible per steps 1 and 2. 
2. Navigate to the Storage Providers section of vCenter Server, and click the green "+" icon to manually register a provider.
3. Name the provider for the ESXi host
4. The URL is the VASA provider URL, as described in step 2. 
5. The username that must be used is "VsanUser"
6.  The password must be fetched from the MOB and then pasted into the correct field. (https://<hostIP>/mob/?moid=vsanSystem&method=fetchVsanSharedSecret&vmodl=1)
7.  Fetch the VASA certificate from the host (/etc/vmware/ssl/vsanvp.pem) and attach it by checking the "Use storage provider certificate" check box.