Installing second VCenter for SRM. Need serious clarification.

[maleitch]

Getting ready to setup SRM in our 5.5 environment with a default setup of SSO tied to our active directory.  We have an offsite location, but due to our business we are fortunate enough that we have two dedicated (working/protect) 10Gb fiber paths between the two locations so we are not restricted by WAN limitations.

The two sites exist on the same subnet, and while the offsite will be assigned as my "recovery" site I would still like the ability to run VM's at the site outside of the context of SRM if possible.

Concerning the installation of the second vcenter:

1. In the world of vmware does the term site actually refer to just a physical or logical location or are they using it in same context as an AD site when discussing Replication/SRM and SSO?
2. Should the two vcenters be setup in Linked Mode to share resources/licenses or would it be better to keep them separate if sites lose connectivity?
3. Should I actually setup two separate sites or simply one site with two datacenters as it appears that Replication/SRM supports this configuration?
4. When I setup the second vcenter it is going to ask me to setup SSO again and I have the choice of additional vCenter SSO server in existing site or in a new site?  Can anyone tell me the ramifications of each option?

Thanks

[LeslieBNS9]

1. Site refers to the vCenter. So you'd have 2 sites for each SRM pair. It is not in relation to an AD site. Here we have one AD environment but multiple sites.

2. They can be setup either way. It is not a requirement to have them in linked mode or that they share resources/licenses. If you have them in linked mode neither site would be impacted if one loses connectivity. If you want to share an SSO service (manage them through the same vsphere WEB client) you'd need to make sure your SSO was high available.

3. I'm not sure on this one as we haven't tried to do SRM within the same site / different Datacenters.

4. Yes you'll have to setup SSO again. You can either..

A) select Join an existing vCenter Single Sign On installation when installing SSO to create an HA SSO install. Ramifications: Both vCenters can be managed from the same web client. More complex SSO install. 

B) install it standalone and manage it separately.  Ramifications: You have to manage this vcenter SSO permissions separately from your other vCenter install. Each vCenter would be managed from separate web clients.

[LeslieBNS9]

You might also check out this link for SSO deployment options and what ramifications each have.

vCenter Single Sign-On Deployment Modes

[rcporto]

In the world of vmware does the term site actually refer to just a physical or logical location or are they using it in same context as an AD site when discussing Replication/SRM and SSO?

In AD, the site normally refer to another physical site with a different subnet range... but in SRM this can be just a logical location, managed by another vCenter and can be on the same subnet.

Should the two vcenters be setup in Linked Mode to share resources/licenses or would it be better to keep them separate if sites lose connectivity?

SRM will work in both modes (with Linked Mode and without Linked Mode)... but Linked Mode with make things easy in management and license share, like you already know, and about "lose connectivity", each vCenter will have your own SSO deployed in multi-site mode and of course is recommended have a DC in each site, this way, even in vCenter lose connectivity, you will be able to access each vCenter individually.

Should I actually setup two separate sites or simply one site with two datacenters as it appears that Replication/SRM supports this configuration?

On each vCenter, create a datacenter that represent the logical location site.

When I setup the second vcenter it is going to ask me to setup SSO again and I have the choice of additional vCenter SSO server in existing site or in a new site?  Can anyone tell me the ramifications of each option?

Choose join a existing SSO, select Multisite type and create a new site.

Check this blog post for some example of SSO with Linked Mode: Back To Basics: vCenter 5.5 with MultiSite SSO and Linked Mode Configuration « Mike Laveri...

[maleitch]

Thanks to both of you, and I have actually been over both of those links several times.  I am about 95% there, but still a little confused on the SSO options I am presented.  Part of my confusion is that while the vmware docs constantly reference "site" and "geographic location", I am not sure the significance.  When they mention location do they assume a high level of latency to contend with?  Possible isolation of Active Directory?  I don't have those limitations fortunately.

So my primary site has existing AD, existing Vcenter, SSO setup.

My "recovery" site has a secondary AD at same site.

Both sites are on same subnet, so for all intents and purposes they are geographically at the same location but for replication purposes I think I still need to create a different site.  With that in mind, concerning SSO, which option should I pick?

vCenter Single-Sign On for an additional vCenter Server in an existing site.

OR

vCenter Single-Sign On for an additional vCenter Server with a new site  ( I think that is what Richardson is suggesting )

Thanks again.

[rcporto · Accepted solution]

Select vCenter Single Sign-On for an additional vCenter Server instance with a new site, since if you choose the option "an additional vCenter Server instance in an existing site" and the primary SSO become unavailable, you will affect the SSO on recovery site.

This blog post explain this in more detail: Getting ready to upgrade production to vCenter Server 5.5? Make sure you're using the corre...

[maleitch]

Thanks Richard, that link was the exact piece of information I was looking for.  Thanks to both of you for all the information.