For anyone stumbling on this, I had a similar issue with SCVMM 2016 (Update rollup 8) and vCenter 6.7.
My issue was needing to go into the management interface of my vCenter (fqdn.domain.local:5480), going to Firewall, and adding an entry to explicitly allow access from the subnet where my SCVMM server was.
My SCVMM server was for example IP 10.130.140.20 with a subnet mask of 255.255.255.0.
In the Firewall rule, select the right NIC, type IP address of 10.130.140.0 (to include the whole subnet) and give the Subnet Prefix Length of 24. If your subnet mask is not 255.255.255.0, you gotta figure out your SPL from your networking team.
Action should be Accept.
When I did this, and ensured that the appropriate account I was using to connect to vCenter had appropriate SSH rights (in this same management interface, go to the Access section), I was finally able to add my vCenter server. I can also verify that I've
been able to add my ESXi hosts and cluster.