VCF Management Component Installation Fails at Staging with error VCFMS-STAGE-COMPONENT-002

Products

• VCF Operations

Issue/Introduction

During VMware Cloud Foundation (VCF) Management component installation or updates via SDDC Lifecycle Management (LCM), component staging fails consistently at the initialization stage. The user interface displays internal staging errors, preventing software deployment:

Internal error occurred. Failed to stage the VCF Component. Please retry the operation or contact support [VCFMS-STAGE-COMPONENT-002]

Console logs (sddc-build-service and fleet-build) display the following error output:

ERROR sddc-build-service ... Internal error occurred. Failed to stage the VCF Component. Please retry the operation or contact support if the issue persists. [VCFMS-STAGE-COMPONENT-002]
INFO sddc-build-service ... Execution terminated of workflow: INSTALL_VSP_COMPONENT_WORKFLOW.1/...

The file-server container (nginx) logs connection reset errors during archive package transfers:

[error] 22#0: *upstream prematurely closed connection while reading upstream, client: IPAddress, server: content-gateway, request: "GET /depot-service/content-gateway/PROD/COMP/VRLI/operations-logs-9.1.0.0400.buildnumber.tgz HTTP/1.1"

The sidecar proxy-forwarder indicates that file transfers consistently stall and abort at exactly specific bytes (~0.1% of the complete ~2.18 GB file):

ERROR: Stream failed after 2180340 bytes ... unexpected EOF. Connection was reset during transfer.

Environment

VMware Cloud Foundation 9.1
VCF Operations 9.1

Cause

A network inspection appliance (Next-Generation Firewall, DLP engine, or Secure Web Gateway) on the egress path to dl.broadcom.com actively resets the TCP stream during .tgz package downloads. This occurs due to archive inspection or file-download filtering policies that trigger on large compressed files.

Resolution

To resolve this issue, please check the below configuration 

1. Identify all egress firewalls, proxy appliances (e.g., Skyhigh Secure Web Gateway), or DLP devices positioned between SDDC Manager/VCF Operations and dl.broadcom.com.
2. Review gateway Anti-Malware, DLP, and URL-filtering logs for rule triggers matching destination dl.broadcom.com at the download failure timestamps.
3. Modify network security policies to exclude .tgz archive scanning, file download restrictions, and progressive streaming inspection for traffic directed to dl.broadcom.com.
4. Re-run the VCF component installation or staging workflow from the VCF Operations / SDDC Manager user interface.

Additional Information

If the issue persists, contact support via Contact Broadcom Support.