vCenter VAMI (Port 5480) is Inaccessible via IPv4 Across Subnets

Products

• VMware vCenter Server

Issue/Introduction

Symptoms :
Users are unable to access the vCenter Appliance Management Interface (VAMI) on port 5480 from different subnets.
The page fails to load or times out when using an IPv4 address.
Accessing the VAMI from a virtual machine within the same subnet as the vCenter shows the page as loading.
Running netstat -tlnp | grep 5480 on the vCenter appliance shows the service listening on tcp6 (:::5480), which may lead to a suspicion of missing IPv4 bindings.

Environment

vSphere 8.x

 

Cause

Cause : 
The issue is typically not caused by the vCenter appliance or its lighttpd configuration. Instead, it is caused by underlying network infrastructure issues, such as:

BGP Outages: Border Gateway Protocol (BGP) being down in the environment, preventing routing between subnets.
Firewall/ACLs: Access Control Lists or firewalls blocking port 5480 traffic between specific subnets.
Routing Table Errors: Misconfigured or missing routes in the corporate network.

Resolution

Resolution : 
Before modifying the vCenter appliance configuration, perform the following troubleshooting steps to verify network integrity:

Local Verification: Log in to the vCenter appliance via SSH and run:

bash

curl -k https://localhost:5480
If the command returns HTML content (e.g., "VMware Appliance Management"), the service is running correctly.
Subnet Testing: Attempt to access the VAMI from a machine located on the same subnet/portgroup as the vCenter.
If this works, the issue is strictly related to inter-subnet routing.

Network Infrastructure Check:
Consult with the internal Networking Team to verify the status of BGP and other routing protocols.
Confirm that there are no active network outages affecting cross-subnet communication.
Ensure that port 5480 is allowed through all physical and virtual firewalls between the source and destination subnets.

Workaround:
Use a jump host located on the same subnet as the vCenter to manage the appliance until the routing issue is resolved by the network team.