vSAN Data Protection module is not loading in vCenter

Products

VMware vSAN

Issue/Introduction

vCenter Data protection frame is blank
At the cluster level via Configure > vSAN > Data Protection the frame does not populate.
After a period of time, get an error states: Unable to extract requested data. Check the vSAN data protection logs for details.
In storage/log/snapservice/snap-service-ui.log you see messages referring to ChunkLoadError

{"level":"error","timestamp":"2025-05-20T12:45:16.421Z","C":"controller/LogsImpl.go:48","message":"[\"[vSAN SM ERROR]: \",\"Uncaught (in promise): ChunkLoadError: Loading chunk 565 failed.\\n(timeout: https://vsphere-vc01.example.com/plugins/com.vmware.vsan.snapshot.manager.client~8.0.3.0~-401749405/VSANSNAP.example.com-8443/565.js)
In the vCenter Envoy logs /var/log/vmware/envoy/envoy-access.log you see messages referring to http2.remote_reset

2025-04-22T13:26:24.428Z info envoy[2007] [Originator@6876 sub=Default] 2025-04-22T13:25:56.962Z GET /plugins/com.vmware.vsan.snapshot.manager.client~8.0.3.0~-401749405/VSANSNAP.example.com-8443/runtime.js 0 http2.remote_reset - 0 0 - 24596 - - 105.193.246.243:53735 HTTP/2 TLSv1.2 ###.###.###.88:443 - - - - - -

Environment

VMware vSAN 8.x

vSAN Data Protect

Cause

This is likely caused by invalid network configuration in the environment, which prevents communication between the vSAN Data Protection Appliance and vCenter.

Resolution

Test the communication between vCenter and the vSAN Data Protect Appliance by doing the following:

Check the vSAN Data Protect UI services by running the below command via the vSAN DP CLI
```
systemctl status nginx
```
Try restarting the service by running
```
systemctl restart nginx
```

If restarting the nginx service doesn't resolve the issue then try the connectivity to the vSAN DP Appliance by entering the following commands from the vCenter console to bypass the proxy:

wget -S https://<vSAN_DP_Applaince_Name>.example.com:8443/index.html --no-check-certificate 
wget -S https://<vSAN_DP_Applaince_Name>.example.com:8443/main.js --no-check-certificate 
wget -S https://<vSAN_DP_Applaince_Name>.example.com:8443/565.js --no-check-certificate 
wget -S https://<vSAN_DP_Applaince_Name>.example.com:8443/38.js --no-check-certificate

Check if multiple IPs are being used for the Data Protect Appliance and verify if some of them are giving a timeout error. The output from some of the above commands will look like this:
```
Resolving <vSAN_DP_Appliance_FQDN>... Appliance_IP_ADDRESS_1, Appliance_IP_ADDRESS_2
Connecting to <vSAN_DP_Appliance_FQDN>|Appliance_IP_ADDRESS_2|:8443... failed: Connection timed out
Connecting to <vSAN_DP_Appliance_FQDN>|Appliance_IP_ADDRESS_1|:8443... connected
```
In this case the command will be stuck for a long time while waiting for the Appliance_IP_ADDRESS_2 to respond and then once it gets to using Appliance_IP_ADDRESS_1, the download will be quite fast. This indicates a problem with Appliance_IP_ADDRESS_2 and it should be removed from the DNS entries.
If further assistance is required collect the vSAN DP logs by running vm-support from the vSAN DP console, open a case with vSAN Support, and upload the logs.

Additional Information

Using a ping test to test connectivity is not ideal as ICMP is blocked by default on the vSAN Data Protect Appliance so pining from vCenter to vSAN DP will fail, however pinging from the vSAN DP to vCenter will succeed if communication is working.

Packet captures may also be helpful Collecting network packets using the lightweight PacketCapture