Here are some details about what goes on behind the scenes when you stage an agent for an upgrade...
WCC tells the AutoSys app server to send a couple of "ad-hoc" jobs to the target agent. These jobs are generated internally by the app server so they are not jobs you have to define. The first job creates some files in the agent spool directory. The second job executes a script created by the first job that ends up downloading the agent installer from the WCC server. It does that by making a web service call back to the WCC server over the WCC port (8443 or 8080). Therefore, you need to make sure the WCC port is open to the agent you are trying to upgrade.
If you confirm the port is open and the staging is still failing, go to the target agent machine and look in the spool directory. You should see a directory called "wcc_agent_cmd". Go into that directory and you should then see a subdirectory with a very long name and a time stamp from the same time you attempted to stage the agent. It will look something like this...
drwxr-xr-x. 2 root root 65 Mar 7 23:39 1678232369197-10dfeff726914416902c18ce91b0c52f
Go into that directory and you will see the following files...
-rw-r--r--. 1 root root 826 Mar 7 23:39 b64.js
-rw-r--r--. 1 root root 8762 Mar 7 23:39 cmd.jar
-rw-r--r--. 1 root root 0 Mar 7 23:39 cmd.err
-rw-r--r--. 1 root root 477 Mar 7 23:39 cmd.out
Look in cmd.err and cmd.out for clues as to why the staging is failing.