VMware Cloud Foundation Automation 9.0.2 patching fails with Error Code LCMVMSP10037 due to an ESXi network timeout

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When applying a patch to VMware Cloud Foundation (VCF) Automation 9.0.2 using VMware Aria Suite Lifecycle, the product deployment fails. The following error exception is recorded in the logs:
Plaintext

com.vmware.vrealize.lcm.vmsp.common.exception.VmspPatchingException: -- BUNDLE [vmsp-platform/vmsp] STATUS: Failed --failed to import /tmp/vmsp-pkg1861590148/vmsp-photon-kube-v1.32.0/ovas/cap-poi/vcf-services-platform-template-9.0.2.0200.25455440.ova: Post "https://esxiFQDN/nfc/datstoreUUID/disk-0.vmdk": dial tcp 10.255.120.135:443: connect: connection timed out at com.vmware.vrealize.lcm.vmsp.plugin.tasks.VmspPatchApplicationPlatformTask.execute(VmspPatchApplicationPlatformTask.java:81)

This issue occurs when the lifecycle manager attempts to deploy the platform's OVA template directly to a target ESXi host via Network File Copy (NFC), but the network connection times out.

Environment

• Product: VMware Cloud Foundation Automation 9.0.2
• Deployment Tool: VMware Aria Suite Lifecycle
• Target Environment: VMware Cloud Foundation (VCF) ESXi Hosts

Cause

This issue is caused by a network connectivity or firewall restriction between the orchestrating VMware Aria Suite Lifecycle appliance and the destination ESXi host network. During this specific patching phase, the lifecycle manager must stream the virtual disk (.vmdk) file directly to the host over TCP port 443. An intervening firewall, network misconfiguration, or hung management agent on the host will cause the connection to time out.

Resolution

Resolution:

To resolve this issue, you must verify and fix the network communication path between the orchestrating appliance and the target ESXi host.
Step 1: Verify Host Connectivity

• Log in via SSH to the VMware Aria Suite Lifecycle appliance.
• Verify basic network reachability by running a ping test to the destination ESXi host IP:

Bash

ping 10.255.120.135

• Ensure the target host is not in Maintenance Mode or in a disconnected state within vCenter Server.

Step 2: Verify Firewall Rules and Port Access
The deployment requires open communication across specific ports from the lifecycle manager network to the ESXi management network.

• From the appliance command line, use curl to check if TCP port 443 on the ESXi host is reachable:

Bash

curl -v telnet://10.255.120.135:443

• If this connection times out, update your firewall configurations to permit traffic from the appliance network to the ESXi management network on the following ports:
• TCP Port 443 (HTTPS): For the initial deployment connection.
• TCP Port 902 (NFC): Required for Network File Copy traffic.

Step 3: Validate DNS Resolution

• Verify that the FQDN of the ESXi host listed in the log error (esxiFQDN) resolves to the correct IP address (10.255.120.135) by running:

Bash

nslookup esxiFQDN

• Correct any stale or missing DNS records if the returned IP address does not match the active host network configuration.

Step 4: Restart ESXi Management Agents (If Required)
If no firewall is blocking the traffic and network routing is correct, the management agents on the ESXi host may be unresponsive.

• Log directly into the affected ESXi host CLI via SSH.
• Restart the host management agents during an approved maintenance window by running:

Bash

services.sh restart

• Once connectivity over port 443 is verified, retry the VCF Automation 9.0.2 patch application from the user interface.