Unable to Upgrade the vCenter Due to Intermittent Network Blockage
Article ID: 415634
Updated On:
Products
Issue/Introduction
Customers may experience an inability to upgrade vCenter through VAMI (online) due to a "Network failure. Check the network settings and try again." error. This error can occur despite manual connectivity tests to dl.broadcom.com intermittently succeeding, preventing the application of critical patches for recent vulnerabilities and impacting the security posture of the vCenter environment. The issue is verified through consistent "Network failure. Check the network settings and try again." errors in the VAMI UI and SSL connection errors in /var/log/vmware/applmgmt/applmgmt.log during the manifest retrieval process. Manual wget and openssl s_client tests to dl.broadcom.com may show intermittent connectivity failures, specifically an absence of "Server Hello" in the SSL handshake when the issue occurs.
Cause
The underlying cause of this issue is an intermittent network blockage originating from the firewall, which prevents consistent SSL connections between the vCenter appliance and dl.broadcom.com. This was identified through a process of elimination and network analysis, ruling out invalid URLs or tokens. Packet captures on eth0 revealed that when the update failed, vCenter intermittently did not receive a "Server Hello" during the SSL handshake with dl.broadcom.com, pointing to a network-level intervention.
Resolution
The network team needs to analyze packet captures to identify and resolve any potential packet drops, SSL inspection, or routing issues on the firewall that are blocking the connection between vCenter and dl.broadcom.com. Once the network path is stabilized, the VAMI upgrade should be reattempted. Resolving the firewall issue will restore consistent connectivity for SSL handshakes, allowing the vCenter VAMI upgrade to proceed successfully.
Additional Information
Feedback
