Install the missing VIB file to fix the issue.

Symptoms:

• In the /var/log/vmkernel.log file, you see the entries similar to:
  
  esxupdate: downloader: DEBUG: Downloading from https://10.61.236.94:8043/vib/vr2c-firewall.vib...
  esxupdate: Transaction: INFO: Skipping installed VIBs VMware_bootbank_vr2c-firewall_5.8.0.1-2170514
  esxupdate: Transaction: INFO: Final list of VIBs being installed:
   
• The repeated vib install messages reappear after every action performed in the vCenter Server or each time a host reconnects to the vCenter Server.
• Replications to cloud using the VMware vSphere Replication 5.6.x or later remain in Not Active status
• If vCenter Server on the tenant site is installed with a custom port for reverse proxy, Example: 81, and if the source ESXi host is not explicitly configured to allow access to this port, vSphere Replication cannot install the vr2c-firewall.vib package on the host. The package contains custom firewall rules that are required for replications to cloud.
  
  Note: It is the customers responsibility to enable custom port from the ESXi firewall.
   
• In the /var/log/esxupdate.log file, you see the entries similar to:
  
  esxupdate: esxupdate: ERROR: VibDownloadError: ('https://vr_appliance_address:8043/vib/vr2c-firewall.vib', None, "('https://vr_appliance_address:8043/vib/vr2c-firewall.vib', '', '[Errno 12] Timeout: <urlopen error timed out>')").

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

VMware vSphere Replication 8.x

This is a known issue affecting VMware vSphere Replication until version 8.2.1 | OCT 29 2020 | Build 17079075. The vr2c-firewall VIB was required for clients that were using DR to Cloud functionality that was provided by vCloud Availability for vCloud Director. This VIB was deprecated from VMware vSphere Replication 8.2.1 | OCT 29 2020 | Build 17079075 release & is no longer available in higher versions of the appliance.

Workaround:

To workaround this issue, install the missing VIB file on each ESXi host that you plan to use as a replication source.

To install the missing VIB file on each ESXi host that you plan to use as a replication source:

Download the vr2c-firewall.vib package and copy it to the /tmp folder of the source ESXi host.

1. You can copy the VIB file from the vSphere Replication virtual appliance to the ESXi host by logging in the appliance and running the command:

scp /opt/vmware/hms/vib/vr2c-firewall.vib user@ESXi_host:/tmp

NOTE: ESXi firewall must be disabled before downloading the file. 

[root@ESXi70APR:] esxcli network firewall get
Default Action: DROP
Enabled: false
Loaded: true

Run this command to disable firewall on ESXi - 

esxcli network firewall set --enabled false
esxcli network firewall set --enabled true (Set it back to true after downloading the file)

2. You can download the VIB file from the location https://vrappliance_address:8043/vib/vr2c-firewall.vib.

Note: You must use a machine that can connect to port 8043.

3. Install the package by using the esxcli utility to run this command:

esxcli software vib install -v /tmp/vr2c-firewall.vib

Alternatively, disable the automatic installation of the firewall VIB.

To disable the automatic installation of the firewall VIB & stop the continuous installation loop:

1. SSH to the vSphere Replication appliance and run one of the commands below depending on the version of replication appliance:

/opt/vmware/hms/bin/hms-configtool -cmd reconfig -property hms-auto-install-vr2c-vib=false     - Use this command for 8.2 and below. 

/opt/vmware/hms/bin/hms-configtool -cmd reconfig -property hms-auto-install-hbragent-vib=false - Use this command for 8.3 and above. 

Note: Another workaround is to manually edit the hms-auto-install-vr2c-vib value at /opt/vmware/hms/conf/hms-configuration.xml to true or false to stop the VIB installation

root@VRMSPR [ / ]# cd /opt/vmware/hms/conf/

root@VRMSPR [ /opt/vmware/hms/conf ]#

Edit 'hms-configuration.xml' using vi and update the following entry from true to false.

<!-- Whether to install hbragent vib automatically when reconnecting to the hosts -->
<hms-auto-install-hbragent-vib>true</hms-auto-install-hbragent-vib>

NOTE: If replication traffic encryption is not used, we can change hms-auto-install-hbragent-vib to false in hms-configuration.xml and restart hms service. Then hms will not push the vib to ESX.

Setting hms-auto-install-hbragent-vib to false can prevent installing it again. But we need to uninstall or stop it in ESX side.

2. Restart HMS by running the command : systemctl restart hms

Enabling vSphere Replication 8.5,8.6,8.7,8.8 on a vLCM managed cluster (87487) - https://kb.vmware.com/s/article/87487?lang=en_US

“esxcli software vib” component commands in ESXi 7.x hosts (78356) - https://kb.vmware.com/s/article/78356