Short story: If the vCenter Server Appliance has two interfaces, you need a DNS entry of the FQDN for both IP addresses, or you wont be able to chose the secondary IP for the Update Manager.
Longer story: If you are anything like me, you want everything separated. Networking for managing the infrastructure (ESXi hosts, switches, storage…) has nothing to do with networking for VMs like Active Directory and Fileservices. Even in a small private cloud like the one from this story.
So, while the vCenter resides on the internal network for AD connectivity, the ESXi hosts are in a separate VLAN. Therefore, the vCenter Server (Windows) has a secondary interface in the management VLAN. Now a new vCenter was installed using the VCSA. And if you want to configure the UpdateManager to use the secondary interface for staging patches to ESXi hosts, you will realize that you can’t chose that interface. Why is that?
Frankly, I don’t know, and I think this shouldn’t be the case. However, I stumbled across the fact that once you make the FQDN resolve both IPs in the separated networks, you are then able to chose the secondary IP, as well.