VCF authenticated downloads configuration update instructions

Products

• VMware vCenter Server
• VMware Cloud Foundation
• VMware vSphere ESXi
• VMware SDDC Manager
• VMware vSAN

Issue/Introduction

Affected products are no longer able to download updates from internet facing VMware by Broadcom public repositories. This article describes the process to update affected products with provided details.

Environment

• Async Patch Tool (AP Tool)
• Offline Bundle Transfer Utility (OBTU)
• SDDC Manager 4.5.x
• SDDC Manager 5.x
• Update Manager Download Service (UMDS)
• VMware vCenter Server 7.x
• VMware vCenter Server 8.x
• VMware vSphere ESXi 7.x
• VMware vSphere ESXi 8.x
• vSAN File Services
• VVF 9.0

Cause

Public facing repository URLs and authentication mechanisms are changing. Download URLs are no longer common but unique for each customer, therefore will require to be re-configured.

Resolution

1. Download Token
   
   The common first step for ALL products is to obtain a Token from Broadcom Support Portal.
   
   Notes:
   
   
   • This assumes the end user has valid login credentials to Broadcom Support Portal and authorized to a Site with entitlements to VCF software.
   • Effective 3/31/25, only users with the Product Administrator role have the capability to create the token for their site.
   • Access and additional portal roles to the Broadcom Software Portal is typically managed by a designated User Administrator. The User Administrator can apply the Product Administrator role to the necessary individual(s) who will then have the ability to generate unique tokens to be used for software downloads for their site. 
   • If you have multiple environment owners under one Site ID, you can use this new functionality to designate Product Administrators and manage who can generate unique tokens.
   • Refer to the KB article Manage user permissions and Site ID access as a User Administrator for guidance on how User Administrator can grant Product Administrator role.
   • Refer to the KB Article Request the Product Administrator role to manage Portfolio License Agreement (PLA) products on how customers can raise a request for Product Administrator role. 
     
     
     1. Login to Broadcom Support Portal
     2. Use the dropdown next to Username and select VMware Cloud Foundation.
        
        
        
        
     3. Ensure to select "My Dashboard" pane on the top left side.
        
        
        
        
     4. In the bottom right side of the screen select "Generate Download Token" under "Quick Links"
        
        Note: The "Generate Download Token" button will only appear if the user has the Product Administrator role. Access and additional portal roles to the Broadcom Software Portal is typically managed by a designated User Administrator. The User Administrator can apply the Product Administrator role to the necessary individual(s) who will then have the ability to generate unique tokens to be used for software downloads for their site.
        
        
        
        
     5. Pick the correct Site and click "Generate". When generating a token there is now an additional (optional) description that can be used to track why a token may have been generated
        
        Warning: Tokens will not be valid for a short duration after creation.
        
        
2. Update the Download repository URLs for each Product / Component
   
   Notes:
   
   
   • The software depots address has changed to "dl.broadcom.com" for all the VCF Products or Components, ensure that the affected components can reach the dl.broadcom.com through the firewall. Once depots are successfully reconfigured, remove the legacy depot addresses depot.vmware.com, hostupdate.vmware.com, and vapp-updates.vmware.com from firewall config as these addresses will be retired at a future date.
   • If available, scripted method is the preferred option to update the configurations.
     
     

     Depot	Component	Scripted Method	Manual Method
     VCF Depot	SDDC Manager	KB389276	KB389871
     	Offline Bundle Transfer Utility (OBTU)	Not Available	KB390119
     	Async Patch Tool (AP Tool)	Not Available	KB390122
     vApp Update (vCenter)	vCenter Server	KB389276	KB390120
     Host Update (ESXi)	vSphere Lifecycle Manager (vLCM) and VMware Update Manager (VUM)	KB389276	KB390121
     	Update Manager Download Service (UMDS)	Not Available	KB390123
     	Auto Deploy / Image Builder	Not Available	KB391021
     vSAN File Services	vSAN	Not Available	KB390237

Additional Information

If tokens are not working after replacing in-product URL's see: VCF Authenticated Downloads Token Troubleshooting Guide

Japanese KB: VCF 認証ダウンロード構成の更新手順

------------------------------------------------------------

The same issue will be seen if the older "vmw-depot-index.xml" are still configured or "vmware.com" download sources are still in use 

updating these to the new Broadcom token based ones will also resolve this issue