Unable to configure Proxy in SDDC Manager

Products

• VMware SDDC Manager

Issue/Introduction

• While trying to configure proxy on sddc manager 5.2.2 , below error is received --

  " Can't validate proxy configuration. Error establishing SSL/TLS connection with proxy: Remote host terminated the handshake. Check proxy is configured with HTTPS, certificate is valid and trusted by SDDC Manager, SSL/TLS ciphers are compatible with SDDC Manager."

• Below errors are seen on SDDC UI,  while adding proxy-
  
  

 

• Running the following command on SDDC manager cli, checks for connectivity from SDDC manager to proxy and then from proxy to dl.broadcom.com. Proxy is not be able to reach to dl.broadcom.com-
  

  wget -e use_proxy=yes -e https_proxy=http://<proxy_ip>:8080 -- no-check-certificate https://dl.broadcom.com
  
  xx:yy:zz -- https://dl.broadcom.com/
  
  Connecting to <proxy_ip>:8080 ... connected.
  
  Proxy request sent, awaiting response ... 403 Forbidden
  
  ERROR 403: Forbidden.

  
  
  
• Running the following command on proxy server to check connectivity with dl.broadcom.com fails too-

  wget https://dl.broadcom.com:443
  
  HH:MM:YYYY -- https://dl.broadcom.com/
  
  Resolving dl.broadcom.com (dl.broadcom.com) ... 
  
  Connecting to dl.broadcom.com (dl.broadcom. com) | xx.yy.zz| :443 ... connected.
  
  HTTP request sent, awaiting response ... 500 Internal Server Error
  
  HH:MM:YYYY ERROR 500: Internal Server Error.

Environment

VMware SDDC Manager 5.2.2

Cause

If proxy server is not able to communicate with dl.broadcom.com then proxy can not be configured on SDDC manager. During proxy configuration, VCF SDDC Manager tries to validate proxy configuration by using it to connect to dl.broadcom.com and expect successful HTTP Status codes as response.

Resolution

Please engage firewall/network team to enable communication between proxy server and dl.broadcom.com.

NOTE : If any NATing IP is used after proxy server,  to communicate to dl.broadcom.com then it needs to be checked by firewall/network team to allow the communication between proxy server, NATing IP and dl.broadcom.com.