Error: "Host cannot download files from VMware vSphere Update Manager patch store. Check the network connectivity and firewall setup, and check esxupdate logs for details."

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

• The following error is observed when running "Scan for updates" or attempting to stage a baseline patch for ESXi host:
  Host cannot download files from VMware vSphere Update Manager patch store.  Check the network connectivity and firewall setup, and check esxupdate logs for details.
  
  
• The vLCM Image Compliance check hangs at 30% and displays a 'hosts unknown' status.
  
  
• The following errors appear in the /var/log/vmware/vmware-updatemgr/vum-server/vum-server.log file on the vCenter Server:
  YYYY-MM-DDTHH:MM:SS 'HostUpdateDepotManager' 14168 ERROR]  [scanHost20, 371] result for host: esxihost1.example.local (entity: host-<id>) shows error :
-----Result Begin (esxihost1.example.local)-----
<esxupdate-response>
<version>###</version>
<error errorClass="MetadataDownloadError">
  <errorCode>4</errorCode>
  <errorDesc>Failed to download metadata.</errorDesc>
  <url>http://###.###.###.###:9084/vum/repository/hostupdate/vmw/vmw-ESXi-###-metadata.zip</url>
  <localfile>None</localfile>
  <msg>('http://###.###.###.###:9084/vum/repository/hostupdate/vmw/vmw-ESXi-###-metadata.zip', '/tmp/tmptVJYa1', '[Errno 12] Timeout: &lt;urlopen error timed out&gt;')</msg>
</error>
</esxupdate-response>
YYYY-MM-DDTHH:MM:SS info vmware-vum-server [2568740] [Originator@6876 sub-VciScanTask. ScanTask(22}] [vciTaskBase 1496] SerializeToVimFault fault:
--> (integrity.fault.HostPatchEsxFile DownloadFailure) {
-->     faultCause = (vmodl.MethodFault) null,
-->     faultMessage = <unset> 
-->     msg =
--> }
-->     Converted fault:
-->     (vim.fault.ExtendedFault) {
-->     faultCause = (vmodl.MethodFault) null,
-->     faultMessage = <unset>,
-->     faultTypeId = "com.vmware.vcIntegrity.HostPatchEsxFileDownloadFailure",
YYYY-MM-DDTHH:MM:SS warning vmware-vum-server[7F1897F5D700] [Originator@6876 sub=Libs] SSL_Connect: SECURITY WARNING: Should use SSL_ConnectAndVerify instead
YYYY-MM-DDTHH:MM:SS warning vmware-vum-server[7F188936E700] [Originator@6876 sub=Libs] SSL_Connect: SECURITY WARNING: Should use SSL_ConnectAndVerify instead
YYYY-MM-DDTHH:MM:SS warning vmware-vum-server[7F188926A700] [Originator@6876 sub=Libs] SSL_Connect: SECURITY WARNING: Should use SSL_ConnectAndVerify instead
  
  
• The following entries may be observed on the affected ESXi host:
  • /var/run/log/esxupdate.log
YYYY-MM-DDTHH:MM:SS Host cannot download files from VMware vSphere Update Manager patch store. Check the network connectivity and firewall setup, and check esxupdate logs for details.
[Errno 4] IOError: <urlopen error [Errno -3] Temporary failure in name resolution>'
    
    
  • /var/run/log/lifecycle.log
YYYY-MM-DDTHH:MM:SS lifecycle[2113481]: DepotCollection:379 Could not download from depot at http://vCenter_FQDN:9084/vum/repository/hostupdate/__micro-depot__vendor-#-cumulative_metadata__index__.xml, skipping (('http://vCenter_FQDN:9084/vum/repository/hostupdate/__micro-depot__vendor-#-cumulative_metadata__index__.xml', '', '<urlopen error timed out>'))

Environment

• vCenter Server 8.x
• vCenter Server 7.x
• VMware ESXi 8.x
• VMware ESXi 7.x

Cause

• ESXi host is unable to communicate with VMware Update Manager service running on vCenter Server through port 9084, 80, 443.

Resolution

Port 9084, 443 and 80 are required for VMware Update Manager. Refer to: TCP and UDP ports required to access VMware vSphere Update Manager.

1. To test network connectivity, open an SSH session to the ESXi host, login as root and run the following commands directed at the vCenter Server (VCSA):
   1. 1. nc -z [VCSA_IP] 9084
         Expected response: Connection to VCSA_IP 9084 port [tcp/*] succeeded!
         
         
      2. nc -z [VCSA_IP] 443
         Expected response: Connection to VCSA_IP 443 port [tcp/*] succeeded!
         
         
      3. nc -z [VCSA_IP] 80
         Expected response: Connection to VCSA_IP 80 port [tcp/*] succeeded!
         
         
2. If any of these connections fail, verify network and firewall configurations to ensure ports 9084, 443, and 80 are open and reachable between the ESXi host and vCenter Server.

Note: Ensure both the vCenter Server and ESXi hosts have correct DNS entries. Confirm that forward and reverse DNS lookups for the vCenter Server are resolving properly from the ESXi host by using the nslookup command.