Error 'connect to eapi.broadcom.com:443 failed: connect timed out' when downloading templates from VMware Cloud Director Marketplace

Products

• VMware Cloud Director

Issue/Introduction

• The template import task is stuck at 1% in the Cloud Director UI.
• Marketplace download is timing out.
• The error message 'connect to eapi.broadcom.com:443 failed: connect timed out' is logged in /opt/vmware/vcloud-director/logs/vcloud-container-debug.log, with the following exception:

xxxx-xx-xx xx:xx:xx,xxx | WARN     | content-library-activity-pool21 | LibraryItemSyncActivity        | [Activity Execution] Cannot fetch remote library endpoint. Subscription URL https://eapi.broadcom.com/vcf/vsc/gtw/api/v1/pub/content-library/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/cspmarketplacemainbuck/marketplace-product-files/xxx_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json - Handle: urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx | requestId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,request=POST xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,requestTime=xxxxxxxxxxxxx,remoteAddress=xx.xx.xx.xx:xxxxx,userAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...,accept=application/json;version 39.0.0-alpha vcd=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,task=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx activity=(com.vmware.vcloud.backendbase.management.system.TaskActivity,urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) activity=(com.vmware.cl.activities.CreateAppTemplateActivity,urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) activity=(com.vmware.cl.activities.AppTemplateSyncActivity,urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) vcd=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,task=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx activity=(com.vmware.vcloud.backendbase.management.system.TaskActivity,urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) activity=(com.vmware.cl.activities.LibraryItemSyncActivity,urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
org.apache.http.conn.ConnectTimeoutException: Connect to eapi.broadcom.com:443 [eapi.broadcom.com/141.202.0.16] failed: connect timed out
        at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151)
        at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)
        at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
        at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
        at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
        at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
        at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
        at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
Caused by: java.net.SocketTimeoutException: connect timed out
        at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)

• Connectivity to the endpoint eapi.broadcom.com:443, from VMware Cloud Director appliance, fails using curl:

curl -v telnet://eapi.broadcom.com:443

Trying 141.202.0.16:443...

Environment

VMware Cloud Director 10.6.x
VMware Cloud Director 10.5.x

Cause

The VMware Marketplace uses the url EAPI.BROADCOM.COM on port 443 to download templates.

This issue occurs when Cloud Director cells cannot connect to the marketplace endpoint due to network restrictions.

Resolution

To resolve this issue, follow these steps:

1. Verify there are no network restrictions or firewall blocks preventing the Cloud Director cells from connecting to the endpoint at eapi.broadcom.com on port 443.
2. Ensure that no firewall or network policy is blocking outgoing traffic to eapi.broadcom.com on port 443.
3. If a proxy is being used, confirm that the proxy allows access to eapi.broadcom.com on port 443 and that the proxy settings are configured correctly.
4. Collaborate with the networking team to ensure that all necessary network communication paths are open between the Cloud Director cells and the endpoint.
5. Add these IP Addresses to the Allow List in your firewall:
   
   

   IPv4	Port
   141.202.0.16	443
   162.159.140.167	443
   172.66.0.165	443