Order of Operations for Version Upgrade: ESXi, VMWare Tools, VM Hardware?

[jauling]

Hi all.

I've seen some conflicting information about version dependency and what order I need to upgrade VM and hypervisor components, and would like to get a straight answer.

We currently are running some severely out of date virtualization components:

• ESXi 5.5 build 3568722
• VMWare Tools 8.6.14 build 2312428
• VM Hardware Version 8

The majority of our VMs are still on RHEL6, and we install VMWare Tools on them using OSP via http://packages.vmware.com/tools/esx/5.0p10/

There currently is an active project that is upgrading our hypervisors to 6.5 build 7388607 on a per cluster basis. Some hypervisors are already running 6.5, with VMs running the older version of components as stated above.

We definitely want to upgrade the VM hardware version as well as VMWare Tools, if not to stay more current but also to be support compliant. Which should we do first? I found https://kb.vmware.com/s/article/1010675  that explicitly stated:

          Note: Upgrading VMware Tools must be done before upgrading the virtual hardware.

Is this true?

Can I preemptively upgrade the VMWare Tools to 10.2.0 before VMs are hosted on ESXi 6.5 hypervisors? Sounds like I can leisurely upgrade the VM hardware version as needed or whenever a VM is powercycled. From all the wording, it seems a VM reset will not activate hardware version upgrade.

Could anyone confirm any of the info above, or offer corrections?

[andiwe79 · Accepted solution]

Yes you have to upgrade the Tools Version before Upgrading the VM Hardware Version if your actual Tools Version does not support the new HW version.

On your ESXi 5.5 you could go to max. HW Version 10 ... when you have upgraded to vSphere 6.5 the recent Version would be HW 13.

Don't expect too much benefit from upgrading the hardware version unless you use new features.

But of course you could upgrade VMware Tools before. It's backwards compatible. See VMware Product Interoperability Matrices

Think about open-vm-tools for your distributions too.

Regards

Andreas

[jauling]

Thanks for the quick reply andiwe79​!

It sounds like regardless if I upgrade my VM hardware version or not, we should be upgrading our VMWare Tools ASAP. That said, we need to be on at least VM hardware version 9 to mitigate CVE-2017-5715 per https://kb.vmware.com/kb/52085.

[andiwe79]

As i understand you would need to apply the cpu microcode updates to your Hardware before you can get any protection for CVE-2017-5715.

If you have EVC enabled you may need to update your vCenter so that your Cluster can see the CPU features.
Then next step is for to get this inside your vm to have at least Virtual Hardware 9 and patch your OS.

For most of my environents the lack of the microcode updates makes everything nonsens now to me.