SSP-I UI does not load after attempting an upgrade

Products

VMware vDefend Firewall VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Symptoms / Issue in Detail

Users may encounter the following behavior after upgrading the SSP-I appliance:

After logging in with the admin user, the UI displays the message: "System Services are currently unresponsive."
The Depot and Secop (Security Operator) services are reported as "Down."
Service Status via CLI: When checking service status via "systemctl status secop"/"systemctl status depot", the services appear as:
- Loaded: masked
- Active: inactive (dead)
Manual attempts to start the service systemctl start secop result in the error: Failed to start secop.service: Unit secop.service is masked.
The upgrade status shows failed with below error:

Security Services Platform Installer - VM Upgrade
[Stop Services] Error occurred while executing the upgrade step. Traceback (most recent call last): File "/image/VMware-SSP-Installer-5.1.0.1.0.25141948/scripts/stop_services.py", line 121, in <module> main(args) File "/image/VMware-SSP-Installer-5.1.0.1.0.25141948/scripts/stop_services.py", line 78, in main stop_services(output) File "/image/VMware-SSP-Installer-5.1.0.1.0.25141948/scripts/stop_services.py", line 108, in stop_services service_utils.isolate_target(_SSPI_MULTI_USER_TARGET) File "/image/VMware-SSP-Installer-5.1.0.1.0.25141948/phoenix/utils/service_utils.py", line 167, in isolate_target subprocess_utils.run(["systemctl", "isolate", target], retries=3) File "/image/VMware-SSP-Installer-5.1.0.1.0.25141948/phoenix/utils/subprocess_utils.py", line 82, in run raise subprocess_error common.errors.SubprocessCommandError: Command 'systemctl isolate multi-user.target' failed with non-zero exit code: 1. Failed to start multi-user.target: Transport endpoint is not connected See system logs and 'systemctl status multi-user.target' for details. .

Environment

Security Services Platform - 5.1.0.1

Cause

The primary cause is that the Secop and Depot system units have been masked. In Linux systems, masking a service is a "stronger" version of disabling it, preventing the service from being started manually or automatically by other services.

During an upgrade from version 5.0.x, a failure in the service isolation process (specifically the systemctl isolate multi-user.target command) can leave these services in a masked state. This results in a "Transport endpoint is not connected" error, which prevents the upgrade script from proceeding and locks the UI.

Resolution

To restore service and complete the upgrade, follow these steps:

Step A: Unmask and Start Services

- Log in to the SSP-Installer VM using the root credentials.

- Execute the following commands in sequence to unmask and restart the critical services:

systemctl unmask secop
systemctl unmask depot
systemctl start secop
systemctl start depot

- Verify that the SSP-I UI is now accessible.

Step B: Finalize the Upgrade

Once the UI is functional, you may notice the upgrade status is marked as "Failed," even if Management and Workload clusters show as complete.

Navigate to the Upgrade section of the SSP-I UI.
Review the failure details to ensure they match the systemctl isolate error mentioned above.
Retry the upgrade process. With the services unmasked and active, the installer should now be able to successfully transition the VM to the new version (e.g., 5.1.0.1).