PowerProtect Data Manager: VM Direct Protection Engine Deployment Fails With "Unable to Connect to External vProxy on Port 9090"

The PPDM appliance protects the vSphere environment using the VM Direct Engine solution. The VM Direct Engine deployment in a demilitarized zone (DMZ) cluster or a network-segmented environment fails during the initialization phase. The PPDM System Job status shows the following error (proxy hostname varies per environment):

ProxySession unsuccessful during initialization. Unable to deploy and verify the vProxy [VPROXY_FQDN]. Unable to query vProxy status after 'Deploy'. Request unsuccessful. Unable to connect to External vproxy '[VPROXY_FQDN]' on port '9090', the host service is not running.
Action : Deploy
TransportMode : HotaddPreferred
Vproxy : [VPROXY_FQDN]
Error : ProxySession unsuccessful during initialization. Unable to deploy and verify the vProxy [VPROXY_FQDN]. Unable to query vProxy status after 'Deploy'. Request unsuccessful. Unable to connect to External vproxy '[VPROXY_FQDN]' on port '9090', the host service is not running. (0)
ProtectionType : VM
VproxyStatus : Failed

The vmdm.log at /var/log/brs/vmdm/vmdm.log shows the initialization failure:

YYYY-MM-DDHH:MM:SS.SSSZ ERROR [] [vproxyMonitor] [][][][TRACE_ID:b28dabec92e4fcae][] [c.e.b.v.v.s.VPEProxyService.updateTask(809)] - Update VM Direct Protection Engine failed [ENGINE_ID] ManagedProxySession(state=Failure, id=[SESSION_ID], error: code=0, text=ProxySession unsuccessful during initialization.  Unable to deploy and verify the vProxy [VPROXY_FQDN].  Unable to query vProxy status after 'Deploy'.  Request unsuccessful.  Unable to connect to External vproxy '[VPROXY_FQDN]' on port '9090', the host service is not running.)

Testing connectivity from the PPDM appliance to the VM Direct Engine on port 9090 fails:

admin@ppdm:~> curl -v [VPROXY_FQDN]:9090
*   Trying [VPROXY_IP]:9090...
* connect to [VPROXY_IP] port 9090 failed: No route to host
* Failed to connect to [VPROXY_FQDN] port 9090: Couldn't connect to server
* Closing connection 0
curl: (7) Failed to connect to [VPROXY_FQDN] port 9090: Couldn't connect to server

The curl test confirms port 9090 is blocked between the PPDM appliance and the VM Direct Engine. The No route to host response indicates a firewall or routing configuration is preventing the connection. This issue applies to all PowerProtect Data Manager versions.

The PPDM appliance cannot communicate with the VM Direct Engine over the required ports. During the VM Direct Engine deployment, PPDM must reach the engine over port 9090 (vProxy management API) and other required ports documented in the Dell PowerProtect Data Manager Security Configuration Guide. When a firewall, network segmentation, or routing configuration blocks traffic on these ports, the initialization fails because PPDM cannot query the engine status or complete the deployment configuration.

This is a network/environmental configuration issue, not a PPDM software defect. It is commonly encountered when the VM Direct Engine is deployed in a DMZ or a network segment that is separated from the PPDM appliance by a firewall.

1. Verify Port Connectivity:
   • From the PPDM appliance CLI, test connectivity to the VM Direct Engine on port 9090:

     curl -v <vproxy_fqdn>:9090 --connect-timeout 5

   • If the test fails with No route to host, Connection refused, or Connection timed out, a firewall or routing issue is blocking the port. Proceed to Step 2.
2. Review the Required Ports:
   • Refer to the Dell PowerProtect Data Manager Security Configuration Guide for the complete list of ports required for VM Direct Protection Engine communication. The guide documents all inbound and outbound port requirements between the PPDM appliance, VM Direct Engines, vCenter, ESXi hosts, and storage systems.
   • At a minimum, ensure port 9090 (vProxy management API) and port 22 (SSH) are accessible from the PPDM appliance to the VM Direct Engine.
3. Configure Firewall and Network Rules:
   • Work with the network administration team to add firewall rules allowing TCP traffic between the PPDM appliance and the VM Direct Engine on all required ports as documented in the Security Configuration Guide.
   • If the VM Direct Engine is deployed in a DMZ, ensure the firewall rules between the PPDM network segment and the DMZ allow traffic on all required ports.
   • After updating the firewall rules, re-run the connectivity test from Step 1 to confirm port 9090 is now accessible.
4. Retry the VM Direct Engine Deployment:
   • In the PPDM UI, retry the VM Direct Engine deployment or trigger a re-initialization of the failed engine.
   • Monitor the System Job status and confirm the initialization completes successfully without the "Unable to connect to External vProxy on port 9090" error.
   • Verify the VM Direct Engine status shows as Running in the PPDM UI under Infrastructure → Protection Engines.
5. If the VM Direct Engine deployment continues to fail after confirming port connectivity on all required ports as documented in the Security Configuration Guide, contact Dell Support for further investigation and reference this KB article.

The most recent versions of the product documentation are available for download on the PowerProtect Data Manager Drivers & Downloads page in PDF format.