Posted by

Posted on

October 18, 2016

Posted under

ESXi, Security, vCenter, VMworld, vSphere

Comments

VMware announces vSphere 6.5!

Today at VMworld Europe, VMware announced vSphere 6.5. This highly anticipated release promises to deliver on several key features and components that have been in the works for some time. Among the anticipated features are native backup and restore of the vCenter 6.5 appliance, the HTML 5 vSphere Client, native HA for the vCenter 6.5 appliance, Update Manager integrated with the vCenter 6.5 appliance. This release also brings VMotion encryption, VM disk level encryption, vSphere integrated Containers, major enhancements to DRS, dramatic improvements to API and automation capabilities with enhancements to REST APIs and CLI’s as well as improvements to the logs and integrated GUI for Auto Deploy, to name a just a few.
For more information on the vSphere 6.5 announcements visit VMware’s vSphere Blog posts:

Introducing vSphere 6.5
What’s New in vSphere 6.5: vCenter Server
What’s new in vSphere 6.5: Security
What’s New in vSphere 6.5: Host & Resource Management and Operations

The vSphere 6.x product page at VMware.com also highlights the product versions and licensing:

vSphere and vSphere with Operations Management

With VMworld Europe 2016 underway, expect more announcements from VMware.

Posted by

vminstructor

Posted on

April 15, 2015

Posted under

ESXi

Comments

Leave a comment

Installing ESXi6 on VMware Workstation 11 – part 1

In my job I spend most of my days on-site with customers or in a classroom teaching for VMware. I have found it convenient to carry my lab with me. I have a laptop with a quad core i7, 32 GB of RAM and 1 TB combined of SSD and Hybrid drives. The laptop running VMware Workstation has made an effective mobile lab. AS it stands now, I have windows 2008 R2 and 2012 R2 domain controllers configured to provide AD, DNS, DHCP and CA services. Additionally I have a MS SQL 2012 server and vCenter 6 server. In this article I am going to go through the process I followed to deploy an ESXi 6 VM.

Creating a new VM for ESXi 6

File > New Virtual Machine

Select Custom and click Next >.

I chose Workstation 11.0 as the VM hardware compatibility level.

Click Next >.

On the Guest OS Installation page, browse to your ESXi 6 ISO.

Click Next >. Notice that The OS was detected! If we chose I will install the operating system later, the next page in the wizard select ESX Server and VMware vSphere 2015 Beta for the version.

On the Name the Virtual Machine page, enter your desired virtual machine name and verify the location. On my machine, I store my VMs on a separate drive.

Click Next.

On the processor configuration page, I chose the preselected default of 2 CPUs with one core each.

Click Next.

On the Memory for the Virtual Machine page, I kept the default of 4096 MB.

Click Next.

On the Network Type page, I selected Use host only networking so that the VM would get an IP address with existing management VM DHCP server and use the private DNS and AD that are already configured on a private vmnet.

Click Next.
Accept the default selection of the LSI Logic adapter.

Click Next.

On the Select a Disk Type page, accept the default disk type of SCSI.

Click Next.

On the Select a Disk page, accept the default: Create a new virtual disk.

Click Next.

On the Specify Disk Capacity page, I took the defaults. I could have lowered the size to 5GB and still met the recommended minimum disk size for ESXi 6. Additionally, I kept the default Split virtual disk into multiple files.

Click Next.

On the Specify Disk File page, accept the suggested file name (<VM display name>.vmdk).

Click Next.

On the Ready to Create Virtual Machine page, I select Customize Hardware… so I can configure the VM’s NIC connection for the specific private vmnet I use for accessing management VMs and infrastructure services.

On the VM’s Hardware page, I selected the CD/DVD device, then under Device status, I removed the check from the Connect at power on so I could power on the VM without starting the deployment of ESXi. This allows me to get the MAC address that is assigned to the VM’s NIC so that I can configure a DHCP reservation and the associated DNS A and PTR records.

Click OK.

I select the Network Adapter from the device list. In the Network connection section, I select Custom then selected VMnet2 from the list (because my management systems are on VMnet2). Note that the Device status shows a checkmark for Connect at power on.

Click Close.

Back on the Ready to Create Virtual Machine, I deselected Power on this virtual machine after creation so I could look at the contents of the .vmx file.

Click Finish.

Browse to the location of the ESXi6.vmx file and open it for editing. (VMware KB 1714- Tips for editing a .vmx file)

Notice that the .vmx file already contains the vhv.enable = “TRUE” setting required to run 64-bit VMs in the nested ESXi host. Previously this required a manual addition to the file (VMware KB 2034803 – Installing ESXi in VMware Workstation).

Close the .VMX file, then power on the virtual machine.

After powering on the VM, I reopened the .vmx file and recorded the MAC address – called “ethernet0.generatedAddress”:

Then I opened up my Windows DHCP server console and created a new DHCP reservation:
Configured lease:

Then I created the DNS records

New Host record:

Check the reverse lookup record:

Back in the virtual machine settings, select the CD/DVD and check the box next to Connect at power on so the ISO image will be mounted when we power the VM back on.

That is it for part 1!. Next is the install and configuration of a ESXi 6

Posted by

vminstructor

Posted on

March 10, 2014

Posted under

ESXi, Security, training, VMware, vSphere

Comments

Leave a comment

New VMware vSphere Blog post on ESXi console lockdown

This week I am back in the classroom teaching a vSphere 5.5: Install, Configure and Manage class for VMware in Sacramento, CA. During the first few sections of the class, the ESXi user interfaces and basic configuration tasks are presented, including an overview of the tasks that can be accomplished with DCUI (Direct Console User Interface). The topic of lockdown mode is mentioned as well as how to configure an ESXI host to use Active Directory for user authentication and a little advice on user account best practices. As part of the discussion, I bring up the use of an “ESX Admins” group in Active Directory, the treatment of the Root user password as an “in case of emergency” item to be tightly controlled and the use of lockdown mode.

Today when I was leaving class, I was happy to see a new blog post from Kyle Gleed of VMware entitled: “Restricting Access to the ESXi Host Console – Revisiting Lockdown Mode” and in particular his 5 step recommendation on restricting access to ESXi with version 5.1 or later:

1. Add your ESXi hosts to Active Directory. This not only allows users to use their existing active directory accounts to manage their ESXi hosts, but it eliminates the need to create and maintain local user accounts on each host.

2. Create the “ESX Admins” Group in Active Directory and add all your admins as members to this group. By default, when an ESXi hosts is added to active directory the “ESX Admins” group is assigned full admin privileges. Note that you can change the name of the group and customize the privileges (follow the link for information on how to do this).

3. Vault the “root” password. As I noted above, root is still able to override lockdown mode so you want to limit access to this account. With ESXi versions 5.1 and beyond you can now assign full admin rights to named users so it’s no longer necessary to use the root account for day-to-day administration. Don’t disable the root account, set a complex password and lock it away in a safe so you can access it if you ever need to.

4. Set a timeout for both the ESXiShellTimeOut and the ESXiShellInteractiveTimeOut. Should you ever need to temporarily enable access the ESXi Shell via SSH it’s good to set these timeouts so these services will automatically get shutdown and idle SSH/Shell sessions terminated.

5. Enable Lockdown Mode. Enabling lockdown mode prevents non-root users from logging onto the host console directly. This forces admins to manage the host through vCenter Server. Again, should a host ever become isolated from vCenter Server you can retrieve the root password and login as root to override the lockdown mode. Again, be sure not to disable the root user . The point is not to disable root access, but rather to avoid having admins use it for their day-to-day activities.

Terrific advice and I appreciate the timing, I will definitely refer to this in class this week and in the future!

Posted by

vminstructor

Posted on

November 26, 2013

Posted under

ESXi, training, vCenter, vSphere

Comments

Leave a comment

VMware KB: VMware vSphere 5 Memory Management and Monitoring diagram

While digging through VMware’s Knowledge Base for articles for a future blog post I ran across this and couldn’t wait to share.

This has the most brilliant diagram of the various memory management features and their instrumentation in the various interfaces available to vSphere admins.

VMware KB: VMware vSphere 5 Memory Management and Monitoring diagram.

Posted by

vminstructor

Posted on

October 31, 2012

Posted under

ESXi, Security, vCenter, VMware, vSphere

Comments

1 Comment

Configure vSphere 5.1 for remote debug logging

Recently I have been working with customers on designs for new vSphere 5.1 installs and upgrades. As part of the design, I have been specifying the installation and configuration of the vSphere ESXi Dump Collector service on their Windows vCenter Server. The ESXi dump collector service allows the collection of the diagnostic dump information generated when an ESXi host has a critical fault and generates a “purple diagnostic screen.”

This post is a walk through of installing and configuring the ESXi Dump Collector service on vCenter and configuring an ESXi host to use it.

The Windows Server 2008 R2 VMs I use for vCenter are configured with additional drives for installing applications and storing data. In this example from my virtual lab, I have a “d:\” drive for applications and data.

Install the vSphere ESXi Dump Collector

The installer for the dump collector in included on the vCenter installer ISO image. I mount the ISO image to the Windows 2008 R2 VM where I have installed vCenter server.

Launch “autorun.exe” as an administrator.

From the VMware vCenter Installer, select “VMware vSphere ESXi Dump Collector”. Then click “Install” to begin the installation.

After the installer starts, select “English” as the language.

On the Welcome… page, click “Next >.”

On the End User Patent Agreement page, click “Next >.”
On the End User License Agreement page, select “I accept…”; click “Next >.”
On the Destination Folder page, click the “Change…” button beside “vSphere ESXi Dump Collector repository directory:”
On the Change Current Destination Folder page, change the “Folder name:” value to “d:\…”. Click “OK.”
Back on the Destination Folder page, observe that the path has been updated and click “Next >”

On the Setup Type page, select “VMware vCenter Server installation”, then click “Next >.”

On the VMware vCenter Server Information page, enter the appropriate information for connecting to vCenter. Click “Next >” to continue.

If you are using the default self-signed SSL certificate for vCenter, you will receive a message with the SHA1 thumbprint value for the vCenter server’s certificate. Click “Yes” to trust that the certificate for connecting to the vCenter server.

You can verify the thumbprint by looking at the certificate properties on your vCenter server. Notice that the thumbprint from the installer matches the thumbprint on the vCenter server’s certificate.

On the vSphere ESXi Dump Collector Port Settings page, click “Next >” to accept the default value of UDP port 6500.

On the vSphere ESXi Dump Collector Identification page, select the FQDN of the vCenter server and click “Next >.”

On the Ready to Install page, click “Install.”

After the installer has completed, click “Finish” on the Installer Completed page.

You can view the configured settings with the vSphere Client by selecting VMware ESXi Dump Collector from the Administration page.

You can also view the configuration with the vSphere Web Client by selecting the vCenter server, then browsing to the “Manage” tab and selecting “ESXi Dump Collector” under “Settings.”

Configuring an ESXi host to transmit the core dump over the network to the dump collector service.

Now that we have installed the dump collector service, we need to configure the ESXi hosts to send their diagnostic dump files to the vCenter server.
I set this up through the ESXi console. You will notice that I am logged in a “root” as I had not configured the ESXi host to use Active Directory authentication yet. Any user account that has the “administrator” role on the ESXi host can configure these settings.

First, checked the current coredump network configuration:

~ # esxcli system coredump network get
Enabled: false
Host VNic:
Network Server IP:
Network Server Port: 0

Next, I confirmed the name of the vmkernel connection I planned to use: “vmk0” with the old “esxcfg-vmknic -l” command

Then, I configured the system to send coredumps over the network through the “vmk0” vmkernel port to my vCenter server’s IPv4 address at port 6500:

~ # esxcli system coredump network set –interface-name vmk0 –server-ipv4 10.0.0.51 –server-port 6500

You have to enter the interface name and server IPv4 address. The port is optional if you are using the default of 6500.

Then, I enabled the ESXi host to use the dump collector service:
~ # esxcli system coredump network set –enable true

I verified that the settings were correctly configured:
~ # esxcli system coredump network get
Enabled: true
Host VNic: vmk0
Network Server IP: 10.0.0.51
Network Server Port: 6500

I checked to see if the server was running:
~ # esxcli system coredump network check
Verified the configured netdump server is running
~ #

Here is a screenshot of the process:

FYI, by default, the diagnostic dump file (core dump) is stored on a local disk partition of the ESXi host. You can find the local partition from the local ESXi console (if it is enabled) with the following command:

# esxcli system coredump partition get

I have highlighted the command in the figure below:

More information about managing the ESXi core dump disk partition is in the online documentation here.

Now that the vCenter server has the dump collector service installed and the ESXi host is configured to use it, I had to try it out!

Using the vsish tool and specific setting that Eric Sloof or NTPRO.NL described in his post “Lets create some Kernel Panic using vsish“, I crashed the ESXi host. As you can see in the screenshots, I was rewarded with a purple screen and success with transmitting the dump over the network to my vCenter server!