Error: Unable to connect to the pre-check-vm - SSP Pre-check VM Fails SSH Connectivity (Port 22 Refused) Due to IP Conflict

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

During SSP deployment, the pre-check VM may be created successfully but fail SSH connectivity from the SSP Installer VM.

The following error is observed on the UI:

Error 1: [Attempt 15/15] Unable to connect to the pre-check-vm. Error: dial tcp <pre-check-VM-ip>:22: connect: connection refused.

Pings to the pre-check VM’s IP succeed, but SSH connections are refused, causing the pre-check stage to fail.

Environment

 

• Security Services Platform (SSP)

• Version: 5.0

 

Cause

Although initial symptoms may suggest a firewall block, this issue can also occur when there is an IP conflict in the deployment network.

In this case:

• TCP packets to the pre-check VM’s IP received responses even when the VM was powered off.

• This confirms that another VM in the environment had claimed the same IP.

• The conflict traced to an HA Proxy VM from a previous NAPP deployment, which had taken multiple IPs from the same pool (including the pre-check VM’s IP).

Resolution

 

• Confirm that the pre-check VM is assigned a unique, unused IP address.

  • From the SSP Installer VM, test connectivity:

    ping <pre-check-VM-IP>
nc -zv <pre-check-VM-IP> 22

• If port 22 is refused even when the pre-check VM is powered off, check for IP conflicts in vCenter:

  • Look for any leftover VMs (e.g., HA Proxy from older NAPP/NSX deployments) that may have claimed addresses from the same IP pool.

• Remove or reconfigure the conflicting VM.

• Re-run the pre-check stage.

Once the IP conflict is resolved, the pre-check VM should accept SSH (port 22) connections, and the deployment is expected to continue successfully.