Connection reset when trying to access the vami and ssh to vCenter or vSphere replication

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

• Connectivity to the VAMI is currently unavailable.

• Attempts to access the VAMI result in a “connection was reset” error in the browser on port 5480, and SSH access on port 22 fails with ssh_exchange_identification: read: Connection reset by peer.

• Despite these management access issues, vCenter and vSphere replication services remain functional and accessible within the local network segment.

  

• The output of the connectivity test, from the client system, using CURL over port 5480 & 22 shows unsuccessful connection.

For vSphere replication:

• Error Messages Observed: Initial browser attempts threw an Envoy proxy routing drop: "upstream connect error or disconnect/reset before headers... delayed connect error: 111". Subsequent service manipulations resulted in an HTTP 404 Not Found page or an abrupt ERR_CONNECTION_RESET block when attempting to navigate to port 5480.
  
  
  

Environment

• VMware vCenter Server 8.x 

• vSphere replication 9.x

Cause

• The issue is caused by external network restrictions, typically at a physical firewall, that prevent traffic on ports 5480 and 22 from reaching the vCenter Server from external subnets.

• This often occurs when network security policies or stateful inspection rules do not permit these management ports.

For vSphere replication:

• Since the VR appliance responds perfectly to localhost web requests internally but drops with a Connection was reset error when hit from the jump box CLI across subnets, the traffic is being intercepted and terminated by an external network security policy (firewall) before reaching the destination virtual machine.

• Validate using below:

  • Service Status Check: Run curl -kI https://localhost:5480 locally inside the SSH sessions for VR and it returns an HTTP/1.1 200 OK, proving the internal web services are healthy and listening.

  • vSphere Replication Network Check: Run curl.exe -kI https://<VR IP>:5480 from the Jump Box PowerShell CLI. It explicitly fails with curl: (35) Recv failure: Connection was reset.

Resolution

• To restore management access, follow these steps:

• • Test Local Access:
    Attempt to log in to the VAMI (https://<vCenter-IP>:5480) and SSH from a VM located on the same Layer 2 network segment as the vCenter Server.
    Successful access from the local segment confirms that the appliance services are running and listening, narrowing the issue down to the external network path/routing, when trying to access VC from other subnet.

  • Review Perimeter Security:
    Coordinate with the network or security team to inspect the physical firewalls between the source subnets and the vCenter appliance.

  • Configure Firewall Rules: Ensure that the following ports are explicitly allowed in the access control lists (ACLs):

    • TCP 5480: Required for VAMI access.

    • TCP 22: Required for SSH access.

• • Once the port 5480 is allowed, the output of the connectivity test, from the client system, using CURL should be as below. Verify VAMI is accessible.

    • Example:

      For VAMI (Port 5480):
      PS C:\> curl -v telnet://<vCenter_URL>:5480
      * Trying <vCenter_IP_Address>:5480...
      * Connected to <vCenter_URL> (<vCenter_IP_Address>) port 5480 (#0)
      
      For SSH (Port 22):
      PS C:\> curl -v telnet://<vCenter_URL>:22
      * Trying <vCenter_IP_Address>:22...
      * Connected to <vCenter_URL> (<vCenter_IP_Address>) port 22 (#0)
      
      

• Successful connection output confirms that the respective ports are reachable and accessible. If issue persist please feel free to open a Broadcom support case.

Additional Information

• vCenter Appliance Management Interface (VAMI) inaccessible with error 'ERR_CONNECTION_REFUSED' or Error: read ECONNRESET
• Unable to access vCenter VAMI on port 5480
• Using Curl to test port connectivity in VMware vCenter Server Appliance