NSX-T Edge Upgrade fails to download the nub bundle

Products

• VMware NSX

Issue/Introduction

NSX Edge upgrade fails around 1%.

NSX web client error:

"http://#.#.#.#:8080/repository/<NSX version>/Edge/nub/VMware-NSX-edge-<NSX version>.nub failed on edge TransportNode ########-####-####-####-############: clientType EDGE , target edge fabric node id ########-####-####-####-############,return status Download and verify bundle failed with msg: Failed to verify bundle: ['tar', 'f', '/var/vmware/nsx/file-store/VMware-NSX-edge-<version>.nub', '--list'] returned 2: tar: This does not look like a tar archive.
tar: Skipping to next header
tar: Exiting with failure status due to previous errors"

From Edge CLI or SSH:

cd /var/vmware/nsx/file-store/
ls -l

If the VMware-NSX-edge-<version>.nub file size is around 7Kb instead of around 35Mb, as expected, then run the following command to see the error:

cat /var/vmware/nsx/file-store/VMware-NSX-edge-<version>.nub

Error:

<div class="response">

        <p>The file you are trying to download or upload has been blocked in accordance with company policy. Please contact your system administrator if you believe this is an error.</p>

        <p><b>File name:</b> VMware-NSX-edge-<version>.nub</p>

    </div>

Environment

NSX-T 3.x
NSX 4.x

Cause

The following error message indicates a physical firewall is blocking the transfer of the tar file.

The file you are trying to download or upload has been blocked in accordance with company policy. Please contact your system administrator if you believe this is an error.

Resolution

Verify that ports 443 and 8080 are open between the NSX Edges' and Managers' IP addresses. Verify that the tar file transfer is allowed between the NSX Managers and Edges on the physical firewall.