vCenter Server connections to vcsa.vmware.com occasionally trigger firewall DDOS mechanism

Products

• VMware vCenter Server

Issue/Introduction

• vCenter Server connections to vcsa.vmware.com intermittently is frequent enough to trigger the configured firewall DDOS detection.

• The vCenter's CEIP (Customer Experience Improvement Program) is joined/enabled.  

Environment

VMware vCenter Server

Cause

• vCenter Server's connect to vcsa.vmware.com when CEIP is enabled for a multitude of purposes. 

  • vSphere Health utilizes data collected under the Customer Experience Improvement Program (CEIP).

  • CEIP provides information that enables VMware both to improve VMware products and services and to identify and resolve issues.

  • When configured to participate in CEIP, VMware collects technical information about the use of VMware products and services on a regular basis.

Resolution

• vCenter Server connections to vcsa.vmware.com can be greatly reduced by disabling/leaving Customer Experience Improvement Program (CEIP). 

• Alternatively, configure the VCSA to use a proxy rather than traverse the firewall to access vcsa.vmware.com.