vLCM image compliance scan fails with unknown error due to blocked TCP port 80

Products

• VMware vSphere ESXi

Issue/Introduction

Compliance check of an ESXi host against a vSphere Lifecycle Manager (vLCM) image fails with the error: "VMware vSphere Lifecycle Manager had an unknown error". This prevents the cluster from completing lifecycle baseline scans or verifying software specification alignment.

The vmware-vum-server logs on the vCenter Server appliance record repetitive TCP connection timeouts when attempting to reach the VMware Update Agent (VUA) on the ESXi host over port 80:

2026-06-09T19:39:29.104Z info vmware-vum-server[12199] [Originator@6876 sub=ServerConnection] [serverConnection 94] connecting vua on port 80...
2026-06-09T19:41:38.587Z warning vmware-vum-server[09748] [Originator@6876 sub=IO.Connection] Failed to connect; <io_obj p:0x00007f8c081c34d0, h:51, <TCP '<REDACTED_IP> : 49258'>, <TCP '0.0.0.0 : 80'>>, e: 110(Connection timed out), duration: 129481msec
2026-06-09T19:41:38.588Z warning vmware-vum-server[09748] [Originator@6876 sub=HttpConnectionPool-000000] Failed to get pooled connection; <cs p:00007f8c3cafd040, TCP:<REDACTED_HOSTNAME>:80>, (null), duration: 129483msec, N7Vmacore15SystemExceptionE(Connection timed out)...
2026-06-09T19:41:40.947Z info vmware-vum-server[12199] [Originator@6876 sub=VciScanTask.ScanTask{16}] [vciTaskBase 1496] SerializeToVimFault fault:
--> (integrity.fault.VcIntegrityFault) {
-->    faultCause = (vmodl.MethodFault) null,
-->    faultMessage = <unset>
-->    msg = ""
--> }

Environment

VMware vCenter Server 8

VMware ESXi 8

VMware vSphere Lifecycle Manager (vLCM)

Cause

TCP port 80 traffic is firewalled, blocked, or dropped along the network data path between the vCenter Server and the ESXi host, preventing communication with the host agent.

Resolution

 

1. Identify all intermediate hardware firewalls, network access control lists, and virtual switches separating the vCenter Server management network from the ESXi host management interface.

2. Permit outbound TCP Port 80 (HTTP) traffic from the vCenter Server to the ESXi host management interfaces.

3. Re-run the vSphere Lifecycle Manager image compliance scan to verify connectivity and scan execution.

 

Additional Information

Required ports for configuring an external firewall to allow ESX/ESXi and vCenter Server traffic