VCF 9.1 Upgrade Fails with "No route to host" Error on Security Services Platform

Products

• VMware NSX

Issue/Introduction

During the upgrade of VMware Cloud Foundation (VCF) 9.0.1.0 to 9.1, the NSX planning phase pre-check fails. This failure prevents the upgrade from proceeding. The SDDC Manager reports an I/O error when attempting to query the status of the Security Services Platform (SSP/vDefend).

Error Message: Failed to execute Check for Security Services Platform version for upgrade. [UC] Error in rest call. url=/napp/api/v1/platform/monitor/platform/status, method=GET, response=Unknown Error occurred., error= I/O error on GET request for "https://<SSP_MANAGEMENT_VIP>:443/napp/api/v1/platform/monitor/platform/status": No route to host.

Environment

• Product: VMware Cloud Foundation (VCF)
• Version: 9.0.1.0
• Component: NSX Manager / Security Services Platform (SSP)
• Configuration: VCF 9.0.1.0 environment attempting upgrade to VCF 9.1.

Cause

The issue is caused by an incompatibility between the currently deployed Security Services Platform (vDefend) version 5.1 and the NSX version required for the VCF 9.1 target release. Additionally, one of the SSP control-plane nodes became stuck in a "Provisioned" state, which disrupted the management Virtual IP (VIP) connectivity. This loss of connectivity results in the SDDC Manager receiving a "No route to host" error when querying the SSP API endpoint.

Resolution

To resolve this issue, remove the incompatible SSP 5.1 instance and redeploy a compatible version of the Security Services Platform (SSP 5.2).

Prerequisites:

• Take a snapshot/backup of the SDDC Manager appliance before modifying the platform services.
• Ensure you have access to the SSP 5.2 Deployment documentation.

Please Consult with the vDefend/SSP support team if assistance is needed to perform the followingSteps:

1. Remove Existing SSP Instance: Delete a SSP Instance
2. Redeploy SSP 5.2: Install the SSP 5.2 instance, ensuring strict adherence to the SSP 5.2 Deployment Requirements and prerequisites documentation:  Deployment and Onboarding Workflow
3. Validate Node Health: Verify that all SSP controller and worker nodes are in a "Running" or "Ready" state and are accessible via their respective FQDNs and IP addresses from the SSP appliance management interface.
4. Connectivity Verification: Ensure the SDDC Manager can successfully reach the NAPP/SSP API endpoint over port 443.
   • Example command from SDDC Manager CLI: curl -k -v https://<SSP_MANAGEMENT_VIP>:443/napp/api/v1/platform/monitor/platform/status
5. Re-run Upgrade Pre-checks: Once the SSP environment is verified as healthy, return to the SDDC Manager UI and re-run the VCF 9.1 upgrade pre-checks.

Additional Information

• Always verify component compatibility before initiating a VCF upgrade by consulting the VMware Cloud Foundation Interoperability Matrix.
• Refer to the official Security Services Platform (vDefend) Release Notes for specific version compatibility mapping with NSX 9.1.0.x.