Make the VCenter-MOB Accessible Again in VCF 9.x

After upgrading to VMware Cloud Foundation 9.x, the Managed Object Browser (MOB) can no longer be opened at https://vcenter-fqdn/mob. Instead of the object interface, a message appears stating that the MOB is disabled. For administrators who regularly use this interface for troubleshooting or detailed queries, this initially seems like a defect. However, it is usually a deliberate standard change.

The MOB was disabled in VCF 9.0 to comply with the Security Technical Implementation Guide (STIG) requirements. Since the interface provides detailed information about the Managed Object structure and configuration, enabling it increases the attack surface. This means: the upgrade itself did not damage the interface — it has been intentionally closed.

Check Status

First, call the MOB with the complete URL on the relevant vCenter system. When the interface is disabled, the browser displays an appropriate notice page. In this case, DNS, certificates, or the web server are not automatically the cause. What matters is the message regarding the MOB and the information that VCenter 9.x or VCF 9.x is being used.

Before making any change, you should check whether the MOB is actually needed. It is usually not required for routine tasks. However, it can be helpful if a support team needs to investigate object relationships or examine certain properties of a managed object.

Security Considerations

Enabling the MOB should only be performed in a protected management environment. The interface must not be left openly accessible over the public Internet. A VPN, a restrictive firewall rule, and a restriction to authorized administrators are recommended. Additionally, document who uses the feature and when it can be disabled again.

The MOB is not a standard diagnostic tool with limited functionality. It provides insight into internal structures and configuration data. For this reason, activation should be time-limited and reversed after the work is completed, unless the interface is needed permanently.

Backup and Adjust vpxd.cfg

To make the change, SSH access to the vCenter Server Appliance is required. First, back up the existing configuration:

cp /etc/vmware-vpx/vpxd.cfg /var/core/vpxd.cfg_backup

Next, edit /etc/vmware-vpx/vpxd.cfg with a suitable text editor. Look for the entry enableDebugBrowse. If the value is false, change it to true. If the entry is missing entirely, add it within the <vpxd> section:

<vpxd>
  ...
  <enableDebugBrowse>true</enableDebugBrowse>
  ...
</vpxd>

Pay attention to the exact spelling: the relevant key is enableDebugBrowse, not enableDebugBrowser. The XML structure and existing settings should be kept as unchanged as possible.

Restart Service and Test

After saving the file, restart the vCenter service vpxd:

service-control --stop vpxd
service-control --start vpxd

Wait until the service is reachable again, then call the MOB URL once more. After a successful start, the object interface should be available. If the service does not come back up or the page still does not work, verify the change against the vCenter logs and contact VMware support if necessary.

For later deactivation, set the value back to false or remove the entry entirely. A restart of vpxd is then required. This keeps the MOB active only during the necessary operating window.

References