As two days ago the VMware vCenter Server Appliance 6.7 Update 2c patch (build 14070457) was released to resolve minor issues and update the Photon OS kernel to version 4.4.182 to resolve a couple of security issues (release notes), it was time to update a couple of VCSA appliance I set up for a client. After verifying the backup schedule was still working as intended and taking a snapshot I decided to start the upgrade via CLI and not via the vCenter Server Appliance Management Interface (VAMI). To be able to use the “software-packages” binary required for this we first need to change the standard shell of the root user, which usually looks like this when connecting via SSH:
Using username “root”. Pre-authentication banner message from server: | | VMware vCenter Server Appliance 188.8.131.52000 | | Type: vCenter Server with an embedded Platform Services Controller | End of banner message from server root@vcenter[ ~ ]#
Enter the following commands to do the change:
chsh -s /bin/appliancesh root
After reconnecting the prompt should now look like this:
Using username "root".
Pre-authentication banner message from server:
| VMware vCenter Server Appliance 184.108.40.206000
| Type: vCenter Server with an embedded Platform Services Controller
End of banner message from server
Keyboard-interactive authentication prompts from server:
End of keyboard-interactive prompts from server
Connected to service
* List APIs: "help api list"
* List Plugins: "help pi list"
* Launch BASH: "shell"
Now connect the patch ISO to the VCSA VM (via PowerShell or the vSphere Client) and start the upgrade with these commands:
software-packages stage --iso
software-packages list --staged
software-packages install --staged
If everything works as intended the result would look like this:
To speed up the process or when placing the upgrade ISO on a network share instead of a local storage replace the first command by one of these lines:
In VMware Cloud Foundation (VCF) workloads usually are deployed in one or more dedicated virtual infrastructure (VI) workload domains. During the VCF deployment (as shown in my earlier posts) the management workload domain (MWLD) is created with a minimum of four hosts. The WLD contains among other components the management vCenter and the SDDC manager. For each VI workload domain (WLD) created using the SDDC manager a separate vCenter is deployed in the MWLD. The vCenters manage the WLD’s hosts and use the vSphere linked mode. As only fifteen vCenters can be linked as per current configuration maximums, currently up to 14 WLDs are supported. Before the SDDC manager can create a WLD enough hosts (minimum three per WLD) need to be commissioned. Click on the button “Commission hosts” either in the Dashboard or the Inventory/Hosts view:
The hosts need be be prepared similarly to the VCF deployment. This includes ESXi version, hardware configuration and network settings (e.g. DNS resolution) and shown in below checklist. In a later post I will provide some helpful PowerCLI snippets to accelerate the host preparation.
After clicking on “Proceed” the details of the hosts need to be provided. Either add each individual host manually (Select “Add new”) or perform a bulk commission by preparing and uploading a JSON file:
The JSON template provided looks like this:
"hostfqdn": "Fully qual. domain name goes here",
"username": "User Name goes here",
"password": "Password goes here",
"networkPoolName": "Network Pool Name goes here"
"hostfqdn": "Fully qual. domain name goes here",
"username": "User Name goes here",
"password": "Password goes here",
"networkPoolName": "Network Pool Name goes here"
Not only the host’s details (FQDN, credentials) and the storage type (preferably vSAN) needs to be provided, but the network pool to be used. Later on also license keys are required. A total of three license keys for vSphere, vSAN and NSX should be entered in the “Administration/License” screen of the SDDC manager. Network pools are created in the “Administration/Network settings” screen. In this case VLAN-IDs and subnet for vMotion and vSAN separate from the default pool (used by the MWLD) are used:
After the hosts are commissioned they show up in the “Usassigned hosts” tab:
Click on a host to show its details, e.g. manufacturer, model and storage capacity:
To create a new WLD use the “+ workload domain” button in the inventory:
Select your storage in the next dialog box. vSAN and NFS are fully supported out of the box (Fibre Channel can be added later on manually, but must be managed independently):
In the first step of the VI configuration wizard enter names for the WLD, the first cluster and the organization the domain is intended for:
Then enter a free IP address in the management subnet, a FQDN configured in your DNS servers and root password for the WLD’s vCenter:
The most interesting part if you are enthusiastic for VMware’s SDN portfolio is the networking screen, which allows you to choose between the legacy product NSX-V or the 2019 released NSX-T version 2.4. In both cases FQDNs, IP addresses and root/admin password for the NSX managers must be entered, as well as a VLAN ID used for the overlay transport (VXLAN for NSX-V; Geneve for NSX-T):
If you selected vSAN as primary storage provider in the first step you need to enter the PFTT (primary failure to tolerate) parameter in step four. “One failure to tolerate” means each data set is replicated once, similar to RAID 1. This means that any of the three required hosts can fail at any point in time without data loss. If you have at least five hosts you can select PFTT=2, which means data is replicated twice, so two hosts may fail simultaneously. This is only the default setting however. PFTT can be set for each object via storage profiles later on, too.
In the next steps select the hosts which shall be used for initial WLD creation. Further hosts can be added to the WLD later. The host selection screen previews the accumulated resources of the selected hosts:
In the License step select the license keys entered before from the drop down menus. Each license should provide enough capacity for each product (e.g. enough CPU socket count) and not be expired:
The last two screens show a review of all entered parameters and a preview of the component names which will be created:
After finishing the wizard the creation progress can be tracked in the Tasks view in the bottom of the SDDC manager. If you click on the task all of its subtasks and their status are shown below:
After some time the WLD creation tasks should succeed:
Open the overview of the newly created WLD under the “Inventory/Workload Domains” to show its status. The “Services” tab features links to the vCenter and the NSX-T manager GUIs:
After a host is removed from a workload domain or the entire WLD is deleted the hosts are found under the tab “Unassigned hosts” again, but their state shows “Need Cleanup”:
First select the checkbox on the left of each host needing cleanup and click on the button “Decommission selected hosts”.
Then login into the SDDC manager using SSH (e.g. “ssh email@example.com”) and prepare a JSON file containing the hosts and their management credentials as follows:
Now run the following commands found in the VCF documentation to commence the cleanup:
./sos --cleanup-decommissioned-host /tmp/dirty_hosts.json
Afterwards however there is still the task of the network cleanup, which requires access to Direct Console User Interface (DCUI). If the network cleanup is not performed you will be presented with errors as shown below when trying to re-commission the hosts:
When logging into the ESXi management GUI in your browser you can see the left over distributed virtual switch and its port groups from the previous WLD:
Perform the network cleanup by logging into the DCUI with the root user and then select “Network Restore Options”:
Then select “Restore Network Settings” option which resets any network settings and devices to the defaults:
Re-configuration of management network settings like IP address, subnet mask, default gateway and VLAN is needed afterwards. Now of the cleaned hosts are ready to be re-commissioned, which works as shown in the beginning of this post.
In hyperconverged setups the servers usually have a very limited amount of physical network interfaces. So when using your ESXi hypervisor hosts as NSX-T transport nodes you often can’t use dedicated vmnic devices as VTEPs. This posts shows how you can use the same pyhsical adapters for VTEP traffic and for VMkernel adapters (e.g. for vSAN or vMotion) by migrating them to an N-vDS switch while configuring the hosts for NSX-T.
Starting point in this example is a hosts with two network cards, one quad port 10 GbE card and a dual 100 GbE card, resulting in six available ports. The first two are used by a Virtual Distributed Switch, which contains a port group for the management VMkernel adapter (vmk0). The next two ports are reserverd for future use (e.g. iSCSI), so the last two ports are supposed to function as uplink for our N-vDS. Both ports will be used as active uplinks with the teaming policy “LOADBALANCE_SRCID”.
To be able to migrate the vSAN and vMotion VMkernel adapters they need to be created first. If you are using PowerCLI you can use this command:
In the vSphere Client open the Configure/VMkernel adapters view and click on “Add Networking…”:
As the port group is going to be replaced by a logical switch anyway it does not matter which network is selected:
Set up the port settings depending on its purpose:
Configure the IP address settings according to your design:
Repeat the steps for the vMotion VMkernel adapter. The use of the custom vMotion TCP/IP stack is recommended:
Finally our two additional adapters are created:
In the NSX-T GUI you can accomplish the goal to migrate VMkernel adapters to N-vDS in three different ways, depending on how you configure your host transport nodes. If the host is not part of a cluster which has a Transport Node Profile assigned it can be configured manually as shown here:
After configuring the details like transport zones etc. the VMkernel migration can be set up after clicking on “Add Mapping”:
Add a mapping for each vmk-adapter:
Select which logical switch should be used for connectivity for each vmk-adapter:
In the second case a transport node is already configured for NSX, but no mappings have been added as shown above. Select the host transport node and click on the “Migrate ESX VMkernel and Physical Adapters” entry in the “Actions” menu:
The third way is to create a Transport Node Profile which contains “Network Mappings for Install” as shown above.
When the profile is attached to a cluster as shown below any hosts added to that cluster in vSphere is automatically configured for NSX-T (including the vmk-adapter mappings) accordingly:
A green checkmark next to the attached profile is shown for the cluster when all NSX-T is finished configuring all hosts:
In the vSphere client you can verify whether the correct logical switches are used for the migrated VMkernel adapters:
Also the phyiscal adapters used as uplinks for the N-vDS are visible in the vSphere client:
If your hardware only has two physical interfaces you can migrate the management VMkernel adapter (usually vmk0) to the N-vDS as well. The NSX-T product documentation shows this in a diagram and offers some additional consideratios, e.g. that the DVS port group type should be set to Ephemeral when reverting back from a N-vDS.
Recently when checking the vRealize Suite Lifecycle Manager GUI in the lab I am working on I noticed a new notification (red dot at the bell symbol in the upper right corner). Further inspection of the notifications showed the availability of the Product Support Pack 2 (Content Version 220.127.116.11), as shown in the lower entry in below screenshot. It is also mentioned at the vRealize LCM release page at “VMware docs”.
Comparing the supported product versions of this new version with its predecessor (Version 18.104.22.168) reveals that vRealize Network Insight 4.1.1 is now supported: (highlighted in blue)
The release notes show all fixed issues, which are mostly focused on performance and stability.
After applying the new version a new entry in the Product Support section appears. As usual start the download in the “Actions” column. If your My VMware credentials are not configured in the Lifecycle Manager or your deployment is a at a dark site, you can always download the product binaries manually, upload them via SCP and map them yourself, as shown in my previous post.
After the product binaries are available you can either deploy a fresh vRNI deployment or upgrade existing environments as shown in this screenshot below. You can also import existing vRNI deployments into an LCM environment which were not created by an LCM or by a different LCM.
Follow the wizard by clicking on “Next” or on “Check compatibility matrix” to make sure the products used in your environment are supported:
vRealize Network Insight 4.1.1 supports all recent VMware products, like NSX, vCenter Server & vRealize Log Insight as shown in the compatibility matrix: (NSX-T is not mentioned, but is
Before upgrading you should run the the pre-check validations. If any items do not show the “Successful” status you should follow the recommendations before proceeding:
Once the upgrade request is submitted you can check the status on the “Requests” section:
Depending on the specifications of your environment, e.g. cluster size, computing power etc. the upgrade process will take some time so complete. In this lab it took almost 50 minutes.
To verify the successful upgrade log into your vRNI GUI and open the “About” page in the “Settings” section. The version string should show the following:
In the beginning of May vRealize Network Insight 4.1 [vRNI] was released with a lot of interesting new features and enhancements described in the release notes.
It is getting more and more popular to use the vRealize Suite Lifecycle Manager appliance to deploy vRealize components like vRNI. In earlier posts I described how to deploy and update this tool to the current version as shown on below screenshot:
In that version however support for vRNI 4.1.0 does not come out of the box. You rather have to install a product support package available in the VMware Marketplace / Solution Exchange first.
After installing the .pak file in the vRSLCM GUI under the “Settings/System Administration” page the new version needs to activated by clicking on the “Apply version” button:
You can check which products are supported by your deployment any time by clicking on the user name in the top right corner and then on “Products”, which opens up a pop up window. The message “Policy successfully refreshed” confirms the new version is applied correctly:
Of course vRSLCM needs access to the product binaries. If the appliance has internet access and you would provide your my.vmware.com credentials it can download the .ova files directly. For dark sites you can download both the “proxy” and “platform” .ova files on your workstation and upload them using SCP/SFTP: (screenshot shows WinSCP)
You need to add the product binaries to the product binary repository by entering the base location where you uploaded the .ova files earlier and then click on the “Discover” button. Finally select the added binaries and click “Add”:
It takes a while until the product binaries are mapped and show up in the list:
Now you can deploy vRNI using vRSLCM by adding it to an existing environment or by creating a new environment. You have two deployment options for vRNI: Standard (1 Platform VM and 1 Cluster VM) or Cluster (3 Platform VMs and 1 Cluster VM). If you select “Cluster” only large nodes will be deployed, otherwise you can choose from “Standard” or “Large”.
This blog post shows all the required steps in between (prodiving certificate information, network details like IP addresses, subnet mask, gateway, portgroup and so on). Although the post is based on older versions of both vRealize Suite Lifecycle Manager and Network Insight the steps are mostly the same.
After entering all the details for creating a new environment you should run the pre-check validations:
If the validation succeeds you can commence the environment creation:.
During the environment creation you can track the progress under the corresponding “In progress” request:
Once the request completes the deployment is ready to use:
You can access the vRNI GUI via HTTPS on the configured address. Use the default admin user “admin@local” and the password you selected:
After first login the main features are explained in four separate screens:
You can use the self service wizard which helps you configure and learn about your vRNI deployment. Among the first steps it suggests to add data sources like vCenters and NSX managers:
Apart from physical devices like routers and switches a whole variety of transport and infrastructure components can be added as data source:
After some time to record flow information vRealize Network Insight is ready to display the first example path, in this case how a VM, which is attached to a logical switch (NSX-T 2.4 segment), connects to the Internet. The path from the T1 distributed router on the same host as the VM (cyan background) to the service router on the Edge Transport Node (purple background) is visible. As the physical switches and routers behind the NSX-T edges have not been configured as data source (yet) no further topology information is available between the service router and the Internet.
One week ago NSX-T version 2.4.1 (Build 13716575) was released. Dozens of resolved issues are listed in the release notes. The process of upgrading a deployment is depicted in this post.
First step is to download the 7,5 GB upgrade bundle file and upload it in the first screen of the NSX-T GUI’s Upgrade section:
After the upload is complete the bundle is extracted and its compatibility matrix is checked. Afterwards the upgrade process can be started:
The obligatory End User License Agreement has to be accepted as usual:
First step in the upgrade process is to upgrade the “Upgrade Coordinator” component:
When this step is completed three boxes with the current and new versions for the hosts, edges and management nodes are displayed:
It is recommended to run the pre-checks first, which check if the environment correctly configured for the further upgrade steps, e.g. whether the vSphere clusters are configured for DRS:
When the pre-checks are completed successfully you can proceed to the second step of the ugprade process which is upgrading the hosts. All of the hosts known to NSX via Fabric/Nodes are displayed and grouped according to their clusters in vCenter. The order of the hosts in each group can be changed, as can the upgrade order (parallel or one after the other). The upgrade mode “Maintenance” is recommended for productive environment, which evacuates (vMotion) each host while placing it in maintenance mode before installing the new NSX VIBs. For test deployments the “In-place” upgrade mode can be selected, which might lead to service interuptions of the network functions offered by NSX to the running VMs.
The overall group upgrade order defines whether the host groups should be upgraded simultaneously:
During the upgrade the invidual status of each group can observed by clicking on it:
When all hosts are upgraded you can contine to the next step by clicking on “Next”:
All edge VMs have to be part of an edge cluster as those correspond to the edge groups, by which the edges are upgraded. During the upgrade the status reveals that a new operating system is installed on these:
When all edges are upgraded you can contine to the next step by clicking on “Next”:
With the NSX-T 2.4 upgrade the controller functionality was moved from the dedicated controller VMs to the manager, which was in turn changed from a single VM to a cluster, the fourth step is obsolete and can be skipped by clicking on “Next”:
The upgrade of the NSX-T manager cluster should be communicated to concerned parties (e.g. network admins) as functionality will not be available during the maintenance window:
The three manager VMs are upgraded in parallel:
By clicking on “More information” the detailed upgrade logs are displayed:
After completing the upgrade the manager VMs are rebooted. Until the services are available again this message is displayed:
With the management nodes being upgraded successfully the upgrade process is completed:
The upgrade history can be tracked by clicking on “Show Upgrade History”:
Two weeks ago the latest and greatest in VMware’s SDDC came out: VMware Cloud Foundation (VCF) version 3.7. Apart from including the current security patches (e.g. ESXi 6.7 EP 06 / build number 11675023) a couple of new automation features have been added, as you can see in the release notes. Also the cloud builder for setting up greenfield Cloud Foundation and VMware Validated Design deployments have been merged. As you can see in my tweet from a while back this used to be to separate OVA files.
VCF 3.7 can be installed as a new deployment or upgraded from the previous version (3.5.1), which is what I did to a dark site I am maintaining. The process is the same as in my previous posts:
After downloading the bundle files (around 21 GB) on a PC with internet access and importing those into the SDDC manager you can trigger the first phase of the update process, which is updating the SDDC manager itself:
This took less than 22 minutes on current Dell EMC hardware:
The new build numbers are 12695026 / 12695044 (UI).
After triggering the next update phase the vCenter and PSC instances are bumped from build number 10244745 to 11726888, which is the most current security update available:
The last step is upgrading the ESXi hosts to build number 11675023 which was released on 01/17/2019. Only recently (03/28/2019) a more current security patch was released, which will presumably be included in one of the future VCF upgrades.
Having all VCF 3.7 patches installed is confirmed by the displayed text “There is no update available”.
If you set up a VMware Cloud Foundation (VCF) deployment you will notice all components (SDDC manager, vCenter, Platform Service Controllers, NSX manager & vRealize Log Insight) are using self-signed SSL certificates for their web services. If you have a Microsoft Active Directory server or cluster you can use their Certificate Authority (CA) functionality to generate trusted certificates as described in the official documentation. However there is an alternative if you are not willing to setup Microsoft servers or pay their license fees. You can create your own certificates by your internally trusted CA and let SDDC manager do the work of distributing them among the various VCF components.
In this example based on the corresponding documentation page I will use the freeware software XCA, which is a graphical frontend to create and manage X.509 certificates. It is available for Windows, macOS and Linux.
When you have downloaded and installed the software and are opening it for the first time, you need to create a new database (see “File” menu) as a starting point. It will ask you for a filename and a password which you need to enter each time you are accessing the database. Also you should set the default hash algorithm to “SHA256” in the options menu, as “SHA 1” is deprecated.
In the simplest case you would create a CA by hitting “New Certificate”, selecting the “CA” template (followed by “Apply all”), giving it at least a name (Internal name, commonName) and generating a private key for it.
In my case however I already had a CA up and running elsewhere, which I used to create an intermediate CA called “xca”. To be able to use that to create certificates in the XCA tool I first had to import the already created private key:
Then I imported both the certificates of the root and intermediate CA:
If you are not using a self created CA as described above you need to select the externally created root CA and click on “Trust” in the context menu: (the intermediate CA is then trusted automatically)
Now it was time to generate the certificate signing requests using the SDDC manager interface. Select all resources you want their certificates to replace and click on the “Generate CSR” button: (found under the “Security” tab of your workload/management domain)
This will let you download an tar.gz archive named like your workload domain. So for the management domain it is called “MGMT.tar.gz”. Extract that archive with your favorite tool, e.g. using “tar -xzf MGMT.tar.gz” for *nix. For Windows desktops 7-Zip is working fine, although you might need to extract in two steps (.tar.gz -> .tar -> extract contents).
After extraction you should have a folder also named like your workload domain with sub-directories named like the hostnames of your VCF components, containing a .csr file each. Import those in the “Certificate signing requests” tab in XCA using the “Import” button:
Pick a CSR, open the context menu and click on “Sign”:
The following window will appear. Make sure that the correct root or intermediate CA is selected for “Use this Certificate for signing”, and that a supported hash algorithm like “SHA 256” is selected: (ignore the Template selection)
In the next tab you can enter the time range the certificate will be valid. After entering a number you need to hit the “Apply” button. As all other important settings are already filled out from the CSR no further modifications are needed. Maybe the “X509v3 Subject Alternative Name” (SAN) field would be a good idea to fill out with the respective FQDNs and IP addresses (I will explain later on why).
After having the signing procedure repeated for all CSRs the “Certificate” tab of XCA should look like the next screenshot. Here you need to export the created certificates to the same folders you imported the CSRs from with the same filename (with file extension “.crt”). Also make sure the export format is set to “PEM”:
You also need to export a certificate chain of the trusted CAs to file called “rootca.crt” placed in the extracted directory where the other sub-directories are located. This can be done with XCA as shown below:
For the SDDC manager to be able to import the certificate structure (including the previously exported CSRs) the folder structure needs to be in an tar.gz archive once again. You might need to delete the old archive downloaded previously as the same name is used. In *nix use “tar -czf MGMT.tar.gz MGMT/”. Using 7-Zip it is again a two step procedure. First add the folder to a tar archive like this:
Then add the tar archive to a gzip archive using the default settings:
The resulting tar.gz file can then be uploaded in the menu opening after clicking on “Upload and install”:
If everything is done correctly the result should look like this:
All services except for the SDDC manager are restarted automatically, but you may need to close browser sessions if you still have old ones open or even clean your browsing cache. If you do not want to reboot your SDDC manager use SSH and the “vcf” user to log into it and run the following commands:
su sh /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh
Of course you still need to import your locally created CA into the trusted folder of your browser of choice so that it show as “valid” HTTPS. This howto should help to accomplish this. In the end it should look like this:
One issue I found was that the connection between vCenter and NSX manager was no longer working with the new certificates. Searching the symptoms (vCenter displaying “No NSX Managers available. Verify current user has role assigned on NSX Manager.”) in the VMware knowledge base led me check the lookup/registration page of the NSX manager appliance. It appears that Cloud Foundation sets up both URLs using their IP addresses. After changing both to the PSC/vCenter FQDNs (as shown in below screenshot) and restarting the VMs everything was working again:
Another solution to solve this could be to add the IP addresses of each VCF components into the individual “SAN” field when creating the certificates, as described above, so that the HTTPS connection is trusted in both ways.