Upgrade Sequence Error During NDR Upgrade – Metrics Component Reported as Incomplete

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Firewall

Issue/Introduction

During an SSP upgrade, the NDR (Network Detection and Response) component upgrade fails with an error stating that the Metrics component needs to be upgraded, even though the UI shows Metrics upgrade as completed.

Symptoms:

You may observe one or more of the following symptoms during an SSP upgrade:

• While attempting to upgrade NDR, the upgrade workflow blocks progression and reports that Metrics components are not fully upgraded.

• The UI may show:

  • Metrics upgrade marked as Success or near completion.

  • NDR upgrade status remaining Not Started.

• Support bundle of SSPI - /var/log/upgrade-coordinator.log logs report an error similar to:

Error while continuing the upgrade for component metrics
CannotSkipComponentUpgradeException
Cannot upgrade component NDR, since Metrics component has upgrade units that have not been upgraded.

 

Expected Behavior

The SSP upgrade workflow enforces a strict upgrade sequence:

SSP → Metrics → Intelligence → NDR → Malware Prevention

Under normal conditions:

• A component cannot be upgraded unless all prerequisite components have completed successfully.

• The UI greys out the upgrade option for dependent components until prerequisites are fully upgraded.

Environment

Security Services Platform 5.1

Cause

This issue occurs due to a state mismatch in the upgrade coordinator, where:

• The Metrics upgrade appears complete in the UI, but

• One or more Metrics upgrade units remain in an IN_PROGRESS state internally.

Because of this inconsistency:

• The upgrade coordinator correctly blocks the NDR upgrade, as it detects that Metrics has not fully completed at the backend level.

• This results in the misleading error message, even though Metrics appears upgraded from a user perspective.

Resolution

Recommended Actions

1. Go back to the Metrics and click on Continue to complete the upgrade fully

   • Monitor the upgrade progress and avoid initiating dependent component upgrades prematurely.

   • Recheck component status after some time or refresh the UI.

2. Retry the NDR upgrade only after Metrics is confirmed as fully completed.

Future Enhancement (Planned):

Engineering is working on a future enhancement that will:

• Remove the need for users to manually upgrade each component.

• Automatically upgrade all dependent components sequentially and atomically.

• Eliminate dependency-related upgrade blocking caused by partial component states.

Note: This enhancement is planned but not yet confirmed or available in current releases.