Error: - "Depot returned authentication/authorization failure. Expected HTTP status 200 but received 403"

Products

VMware SDDC Manager / VCF Installer

Issue/Introduction

When attempting to configure the Software Depot for the online download method in VMware Cloud Foundation (VCF) 9.1, the validation of the activation code fails.
To view the download service logs from the support bundle, navigate through the VCFMgmtComponents directory to this specific file

/log/vmware/vcf/sddc-support/sos-########/VCFMgmtComponents/vcf-management-services/v#######/services-logs/vcf-fleet-depot/#######/depot-service-5b5#####c49-zt2tm/download-service/console-log-#####.log)
YYY-MM-SSTHH:MM:SS stdout F YYY-MM-SSTHH:MM:SS.259+0000 INFO [download_service,6a18####b150cba####482,ece7] [c.v.e.s.l.t.d.i.DepotSettingsServiceImpl,https-jsse-nio-0.0.0.0-8443-exec-5] Updating depot settings to: ONLINE YYY-MM-SSTHH:MM:SS stdout F YYY-MM-SSTHH:MM:SS.260+0000 DEBUG [download_service,0000000000000000,0000] [c.v.e.s.l.d.DepotAccessTokenService,ds-exec-1] Retrieving access token from https://eapi.broadcom.com/vcf/generateTokenfor activation code #####... YYY-MM-SSTHH:MM:SS stdout F YYY-MM-SSTHH:MM:SS.355+0000 DEBUG [download_service,0000000000000000,0000] [c.v.e.s.l.t.d.i.FdsProxySettingsProviderImpl,ds-exec-1] Proxy credentials disabled or not configured - skipping username and password YYY-MM-SSTHH:MM:SS stdout F YYY-MM-SSTHH:MM:SS.355+0000 INFO [download_service,0000000000000000,0000] [c.v.e.s.l.t.d.i.FdsProxySettingsProviderImpl,ds-exec-1] Using proxy http://<<FQDN_OF_PROXY_SERVER>>:80 ...... ...... ...... YYY-MM-SSTHH:MM:SS stdout F YYY-MM-SSTHH:MM:SS.697+0000 DEBUG [download_service,0000000000000000,0000] [c.v.e.s.l.t.d.v.DepotConnectionValidator,ds-exec-1] Making HEAD Request to: https://dl.broadcom.com:443/PROD/metadata/manifest/v1/vcfManifest.json YYY-MM-SSTHH:MM:SS stdout F YYY-MM-SSTHH:MM:SS.703+0000 ERROR [download_service,0000000000000000,0000] [c.v.e.s.l.t.d.v.DepotConnectionValidator,ds-exec-1] Expected 200 OK but received - Status: 403, Headers: [Content-Type: text/html, Server: Zscaler/6.2, Cache-Control: no-cache, Access-Control-Allow-Origin: *, Content-length: 14672] YYY-MM-SSTHH:MM:SS stdout F YYY-MM-SSTHH:MM:SS.718+0000 DEBUG [download_service,0000000000000000,0000] [c.v.e.s.c.c.i18n.LocalizationTools,ds-exec-1] VCF_USE_RESOURCE_BUNDLE_LOCALIZATION='true' -> using ResourceBundle-based localization

Environment

VCF 9.1

Cause

In VCF 9.1, the architecture for software lifecycle and downloads has changed. Downloads are no longer handled exclusively by the traditional SDDC Manager core services; they are now executed by the Fleet Lifecycle components.

Because of this architectural shift, existing firewall or proxy whitelist rules that previously only accounted for the SDDC Manager appliance's IP address may not cover the new IP addresses or FQDNs assigned to the Fleet components. When the Fleet Depot service attempts to reach out to the Broadcom servers, the proxy/firewall intercepts the request, recognizes it as unapproved traffic, and blocks it (HTTP 403).

Resolution

To resolve this issue, update the firewall and/or proxy rules to explicitly allow outbound traffic from the IPs and FQDNs assigned to the Fleet components.

Ensure the Fleet components have unrestricted outbound HTTPS (Port 443) access to the following public URLs:

eapi.broadcom.com (Required for OAuth token acquisition and authentication)
dl.broadcom.com (Required for binary and metadata downloads)
vvs.broadcom.com (Required for vLCM compatibility data)
vsanhealth.vmware.com (Required for vSAN Health checks and HCL updates)

Additional Information

Public URLs Required for Online Functionalities for VCF and vSphere Foundation