Content in VMware Communities

Install VMCA root cert to SDDC Manager VM Failed with VCF 3.7.2 on VxRail 4.7.211 due to not Shell model on PSC1

communities-emailer@vmware.com — Mon, 02 Sep 2019 05:36:56 GMT

Hi,

Is below issue fixed in VCF 3.8. if not, how do I raise an enhancement to RnD team?

Issue:

We met "Install VMCA root cert to SDDC Manager VM Failed " with VCF 3.7.2 on VxRail 4.7.211 (Upgraded from VxRail 4.5.*) as following:

Troubleshooting:

It shows "Unknown command: '/usr/lib/vmware-vmca/bin/certool'" in log, due to the default model of PSC 1 for VxRail is command.

Solution:

It works to change the PSC model from Command to shell.

OpenSSL Error when trying to validate vCF 3.8?

communities-emailer@vmware.com — Mon, 14 Oct 2019 15:34:28 GMT

I'm working on standing up vCF nested in a lab, and followed William Lam's guide to prepping the environment, I'm pretty sure everything is configured properly. While trying to validate the configuration file before bring up, I'm getting a nice generic OpenSSL error on several of the sections (vSAN Disk availability, ESXi version, ESXi host readiness, Time Synchronization, and Network validation): "ESXi Host <HOST IP> unable to connect: Unknown OpenSSL error. This error is commonly encountered when another library is not cleaning up the OpenSSL error stack. If you are using cryptography with another library that uses OpenSSL try disabling it before reporting a bug. Otherwise please file an issue at https://github.com/pyca/cryptography/issues with information on how to reproduce this. ([_OpenSSLErrorWithText(code=2147897744L, lib=128, func=101, reason=400, reason_text='error:80065190:lib(128):osrandom_rand_bytes:getrandom() initialization failed.')])."

I've validated that the Cloud Builder VM can communicate with the hosts, NTP is functioning, and DNS is resolving.

Everything should be self-signed certs, and I'm not seeing anything out there, so I'm not sure where to start looking. Does anyone have any ideas on where to start?

Thanks in advance for your time

Remove a vRealize Product

communities-emailer@vmware.com — Sun, 13 Oct 2019 12:54:30 GMT

Has anyone ever tried to remove and redeploy a vRealize product from SDDC Manager? Is there an actual procedure/KB for this? I can't find one.

INTERNAL_SERVER_ERROR at 'Apply vCenter Server License' in Cloud Builder

communities-emailer@vmware.com — Fri, 11 Oct 2019 13:26:03 GMT

Hi folks,

I'm hitting an issue during bringup on Cloud builder (VCF 3.8.1). The following message is displayed in the UI:

Apply vCenter Server License > A problem has occurred on the server. Please retry or contact the service provider and provide the reference token.

From the vcf-bringup-debug.log:

2019-10-10T11:41:46.825+0000 [bringup-app,[85b64ffb21efef28,048a]] ERROR [c.v.e.s.o.model.error.ErrorFactory,pool-3-thread-14] [LHI2G] INTERNAL_SERVER_ERROR Param Building for prefix 'preValidate' part of task ApplyVcLicense in plugin com.vmware.evo.sddc.bringup.plugin.spi.VcPlugin65 failed with exception.

com.vmware.evo.sddc.common.core.error.InternalServerErrorException: Param Building for prefix 'preValidate' part of task ApplyVcLicense in plugin com.vmware.evo.sddc.bringup.plugin.spi.VcPlugin65 failed with exception.

I did find a VMware Knowledge Base article (not directly related issue) that referenced a timesync issue with a previous SDDC release however i have doublechecked all components and everything is in sync with NTP.

Any ideas?

[vCF 2.3.1] vRA Deployment error

communities-emailer@vmware.com — Wed, 11 Jul 2018 00:45:38 GMT

Hi all.

I would like to ask those who have similar experience.

What should I check to resolve the errors in this step?

1. vRA deployment failed through SDDC Manager.

2. evosddc-debug.log :

2018-05-31 23:54:35.579 [https-jsse-nio-8443-exec-16] ERROR [com.vmware.vrack.vrm.security.websso.util.RequestAuthorizationUtility] Not all pre-authorization conditions met for URL /vrm-ui/api/1.0/lcm/bundles called from 172.16.16.200

2018-05-31 23:54:35.579 [https-jsse-nio-8443-exec-24] ERROR [com.vmware.vrack.vrm.security.websso.util.RequestAuthorizationUtility] Not all pre-authorization conditions met for URL /vrm-ui/api/1.0/lcm/inventory/upgrades called from 172.16.16.200

2018-05-31 23:54:35.590 [https-jsse-nio-8443-exec-20] ERROR [com.vmware.vrack.vrm.security.websso.util.RequestAuthorizationUtility] Not all pre-authorization conditions met for URL /vrm-ui/api/1.0/lcm/inventory/upgrades called from 172.16.16.200

2018-05-31 23:54:35.591 [https-jsse-nio-8443-exec-23] ERROR [com.vmware.vrack.vrm.security.websso.util.RequestAuthorizationUtility] Not all pre-authorization conditions met for URL /vrm-ui/api/1.0/lcm/bundles called from 172.16.16.200

2018-05-31 23:55:18.956 [https-jsse-nio-8443-exec-15] ERROR [com.vmware.vrack.vrm.security.websso.util.RequestAuthorizationUtility] Not all pre-authorization conditions met for URL /vrm-ui/api/1.0/core/activity/vrack/workflows called from 172.16.16.200

3. Environment

vCF version : 2.3.1

Work-VM : 172.16.16.200

I checked Deploy vRealize Automation in Cloud Foundation

Prerequisites

Verify that you have created an Active Directory account.You must create an Active Directory (AD) user account with permission to join Windows VMs to the domain.
Verify that you have a valid license key for vRealize Automation, which is purchased separately from Cloud Foundation.
Verify certificate and private key.You must have a multi-SAN certificate and private key generated by a trusted certificate authority. During generation, you must specify the short and full names of all vRealize Automation VMs and load balancer servers. >> Used vRealize Certificate Generation Tool VMware Knowledge Base
Verify that you have created a subzone in the Active Directory DNS.
Verify that Microsoft SQL Server is configured properly.You must join the Microsoft SQL Server VM to the Active AD, create a new login for the AD administrative user in SQL Server, modify the firewall and port configuration, and create the SQL database.
Verify that you have an OVA template for the vRealize Automation Windows VM, using Windows 2012 R2.
Verify that your Windows server image meet the following requirement for IaaS.
- All Windows servers that host IaaS components must meet certain requirements. See Requirements for IaaS Windows Servers.
- A Windows server that hosts the Web component must meet additional requirements. See IaaS Web Server in the vRealize Automation documentation.
- A Windows server that hosts the Manager Service component must meet additional requirements. See IaaS Manager Service Host in the vRealize Automation documentation.
- Ports on the IaaS Windows servers must be configured before vRealize Automation installation. See https://docs.vmware.com/en/vRealize-Automation/7.3/com.vmware.vra.install.upgrade.doc/GUID-497EECE9-018E-428B-9ED9-AB4B6722D2AB.html in the vRealize Automation documentation.

Thank you

- Hyun

Please Update command

communities-emailer@vmware.com — Wed, 09 Oct 2019 20:02:21 GMT

Author : Ben Corson

URL : http:////docs.vmware.com/en/VMware-Cloud-Foundation/3.8/com.vmware.vcf.admin.doc_38/GUID-24B42A36-1F37-4407-957D-F1A1C869411D.html

Topic Name : Look Up Account Credentials

Publication Name : VMware Cloud Foundation Operations and Administration Guide

Product/Version : VMware Cloud Foundation/3.8

Question :

Please remove the double quotes in the curl commands. I was able to confirm single quotes work successfully.

VCF with VVD Plumbing?

communities-emailer@vmware.com — Thu, 19 Sep 2019 12:54:31 GMT

Hey all,

As you probably know, when deploying VCF with Cloud Builder NSX-V deploys controllers and installs vRLI on the VLAN backed portgroup during bring up. My assumption is that the networking architecture under the covers that should be used is the VVD architecture to allow for multi-region futures. However, when deploying vRSLCM, VCF only asks for a VLAN and creates a VLAN backed portgroup during deployment and configuration. So a few questions hopefully you can help answer for me:

1. In the VVD architecture, vRSLCM is put on the cross region VXLAN so that it can perform a site failure. I've tried editing the portgroup post deployment but it fails during vRLI import.

2. I've deployed ESGs and UDLRs in the typical VVD fashion but am concerned about how the rest of the workflows will tie into the architecture (vROps and vRA).

3. In a multi-region scenario, are we saying that there will be a SDDC manager at both sites?

TIA!

Multiple Custom ESXi ISOs

communities-emailer@vmware.com — Sun, 15 Sep 2019 12:42:48 GMT

Is there a way to use more than one custom ISO image? I'm thinking of a scenario when one cluster or workload domain may have different server components than another. When looking at the documentation it appears that there's only a one to one relation, unless someone has figured a way to work with the properties and/or json file. Any ideas?

Upgrade ESXi with Custom ISO

VCF Cluster addition and VDS question

communities-emailer@vmware.com — Sat, 14 Sep 2019 03:26:11 GMT

So will adding a new cluster to a workload domain always create a new / dedicated VDS for the workload domain? Is this the same for NSX-V and NSX-T workload domains?

Thanks in advance.

VCF IPv6 Support

communities-emailer@vmware.com — Wed, 11 Sep 2019 12:35:11 GMT

Is it safe to assume that VCF does not support IPv6 in any fashion? I'm sure Cloud Builder does not because of the conditional formatting in the XLS, but wasn't sure what the official stance is. TIA.

Adding extra disks/disk groups to a VCF setup post deployment

communities-emailer@vmware.com — Wed, 04 Sep 2019 15:47:19 GMT

Author : Andy Dugas

URL : http:////docs.vmware.com/en/VMware-Cloud-Foundation/2.3.2/com.vmware.vcf.admin.doc_232/GUID-704FD57A-19A6-4305-8619-6B33DE557AAC.html

Topic Name : Replace Capacity Drive (SSD or HDD) or Cache Drive (SSD) in a Host

Publication Name : Administering VMware Cloud Foundation

Product/Version : VMware Cloud Foundation/2.3.2

Question :

If a customer procured a VSAN certified node for VMware Cloud Foundation, but the nodes were partially populated with disks, then 1. Can he add extra disks groups/capacity post deployment without re-imaging the cluster? 2. Will this affect the VCF certification of the VSAN ready node in any way? and hence the support

Password Authentication failed for user \"vcfui\""

communities-emailer@vmware.com — Sat, 31 Aug 2019 14:58:15 GMT

Has anyone ever seen this when attempting to browse to SDDC Manager UI? This is a brand new deployment.

{"message":"Session middleware wrapper failed initial and all retry attempts. Cannot continue. Throwing error from session middleware; password authentication failed for user \"vcfui\""}

vmware esx 6.5 Fatal error: 10(out of resources)

communities-emailer@vmware.com — Fri, 30 Aug 2019 05:08:06 GMT

I hope you are doing well.i had an issue on Esxi 6.5 there was power cut when power was on host failed to boot with this error

Error loading /jumpstrt.gz

Fatal error: 10 (out of resources)

i am using Dell R730xd servers

Dedicated ESXi host and private switch for via?

communities-emailer@vmware.com — Tue, 27 Aug 2019 06:01:30 GMT

We are preparing to implement our first VCF solution and VMware have suggested the best approach would be to run the via VM on an ESXi management host rather than use a laptop for stand up.

Looking at the VCF documentation the requirements for this type of deployment seem very specific in terms of having an ESXi host configured with a vmk0 address of 10.1.0.200 and also a private physical switch connected from this ESXi host to the management switch for VCF.

My question is could an existing ESXi host be used to run the VIA VM rather than a dedicated one to avoid this overhead? If so, is there a way to change the need for this specific IP address requirement on vmk0?

The other point I’m looking for clarification on is the need for the dedicated private switch. If i choose to deploy the solution using a laptop i connect directly to my management switch and run the deployment but when i use an ESXi host to run via it adds this additional physical switch to the solution.

Please can someone help me understand the above.

many thanks

VCF Network questions

communities-emailer@vmware.com — Tue, 20 Aug 2019 00:33:25 GMT

I'm new to VCF and am working on a deployment for a client, so I'm hoping the folks here can answer some questions. Thanks in advance for responses and I'll be sure to mark as correct for anyone that assists.

1. I've noticed in the VMware HOL that VCF management WLD deploys NSX and the first edge, but it seems I can't configure load-balancing on this edge, even though it shows load-balancing is enabled. The typical tab doesn't seem to be available. Does VCF not allow this? I've even tried deploying a second edge and the configuration option isn't there.

2. It seems that all the management workloads in the management WLD are deployed to a VLAN backed port-group, so now logical switches are used and no management workload traffic goes through edges? If this is the case, what does this first edge do then?

3. I've tried deploying a NSX-V WLD in the HOL and can't get it to work properly, it fails at configuring NSX manager backups. My question is, per the VVD two Uplink port-groups are created. I'm assuming this is to peer ESGs with upstream routers. My client wants to use NSX-V and not use dynamic routing, their use case calls for every workload to be NAT.

a. Is there any reason or restrictions I should be aware of using NSX-V with VCF? I'm assuming when I deploy a NSX-V WLD it deploys the NSX configuration greenfield? Meaning, no logical switches, no DLRs, no ESGs? And then I can build out those constructs to my client's needs?

b. Even if I can configure NSX-V however I like, will I still be required to have two uplink port-groups and VLANs to deploy the WLD?

4. It appears that NSX Manager backups up to the SDDC Manager? So if this is the case, does the SDDC manager host SFTP server or will I still need to provision this service somewhere else?

Cheers.

VCF mixed host vSAN confit in Consolidated Architecture Model

communities-emailer@vmware.com — Mon, 19 Aug 2019 05:03:28 GMT

IHAC that would like to

Use the VCF consolidated architecture model to run both management and compute resource pools in a single Management Domain
predominately use external NFS storage for their VM datastores, but
still get the seemless bring up process & SDDC management of a VCF cluster

They are looking at requiring 13 ESXi hosts (compute + VCF management workloads).

Can anyone help answer these questions for me in a 13-host VCF environment:

Is it possible to have just the minimum required 4 * vSAN hosts to hold storage for the management resource pool, but then have all the remaining 9 ESXi hosts for the. Compute resource pool (inside the same MANAGEMENT domain) use separate NFS datastores for VM data?

Do all VCF nodes in a domain (mgmt OR workload) need to also have same vSAN config or are they able to make all of the nodes in a compute resource pool within the MGMT domain compute-only nodes so that they can use external storage?

I hope that makes sense - not an ideal scenario so I’m sure that I’ll confuse many with this question!

The alternative is that we just build all 13 nodes as a traditional VMware cluster and only use the NFS datastores.

many thanks

John

PSC within VCF

communities-emailer@vmware.com — Mon, 19 Aug 2019 04:55:18 GMT

Hi All

I have notice that the PSC is deployed with two instances within the bring up and configured to replicate with each other and as other WLD are brought they added to this. The question I have is that based on the VVD there is a post deploy configuration to put a load balancer in front of the PSC but don't see any reference to this as a requirement within VCF.

Is this something that still needs to be done or is it a case of repointing the vCenters to the available PSC in the event of a failure?

If a load balancer has to be introduced will SDDC manager still support the lifecycle operations for the virtual infrastructure layer.

Thanks in advance

SQL instance in VCF for vRA?

communities-emailer@vmware.com — Tue, 13 Aug 2019 12:17:09 GMT

Hi All

Does anyone know on how to specify the SQL instance for a vRA deployment within VCF? ( version 3.7 and greater?)

Thanks in advance.

Regards

Broadcom 57416 10Gb Base-T/Dell R740 not running ESXi 6.7u2

communities-emailer@vmware.com — Wed, 07 Aug 2019 06:17:06 GMT

Hi all!

I have Server Dell R740 with Broadcom 57416 10Gb Base-T (Dual port).

I istall OS ESX6.7u2.

2 port 10Gbps not running. Port up. I can set IP. But not working.

Can you help me?

test by shilpa

communities-emailer@vmware.com — Tue, 06 Aug 2019 14:05:02 GMT

Author : Ben Corson

URL : http:////docs.vmware.com/en/VMware-Cloud-Foundation/3.8/vcf-38-upgrade/GUID-1AEBB4E5-D31D-4141-8D08-8B236EBFE845.html

Topic Name : Upgrade ESXi

Publication Name : VMware Cloud Foundation Upgrade Guide

Product/Version : VMware Cloud Foundation/3.8

Question :

test by shilpa

Looking to learn more about Cloud Foundation on Dell EMC VxRail?

communities-emailer@vmware.com — Mon, 05 Aug 2019 19:33:21 GMT

For those interested, you can learn more about VCF on VxRail through the following blog series....

https://blogs.vmware.com/cloud-foundation/2019/06/04/vmware-cloud-foundation-on-dell-emc-vxrail-blog-series-part-1-introduction/

https://blogs.vmware.com/cloud-foundation/2019/06/14/vmware-cloud-foundation-on-dell-emc-vxrail-tm-blog-series-part-2-setup/

https://blogs.vmware.com/cloud-foundation/2019/06/24/vmware-cloud-foundation-on-dell-emc-vxrail-tm-blog-series-part-3-stretched-cluster/

https://blogs.vmware.com/cloud-foundation/2019/07/10/vmware-cloud-foundation-on-dell-emc-vxrail-blog-series-part-4-life-cycle-management-upgrades/

https://blogs.vmware.com/cloud-foundation/2019/08/05/vmware-cloud-foundation-on-dell-emc-vxrail-blog-series-part-5-adding-nsx-t/

VxRail

communities-emailer@vmware.com — Mon, 05 Aug 2019 19:31:11 GMT

Author : Ben Corson

URL : http:////docs.vmware.com/en/VMware-Cloud-Foundation/3.0/com.vmware.vcf.planprep.doc_30/GUID-AE45ED7B-5530-4AE6-BB51-51E3D41CEDFD.html

Topic Name : Minimum Hardware Requirements

Publication Name : VMware Cloud Foundation Planning and Preparation Guide

Product/Version : VMware Cloud Foundation/3.0

Question :

What are the requirements for VxRail-based configurations?

Is offline Installation Bundle of vRA/vRO Ready on Lifecycle managemer of SDDC Manager?

communities-emailer@vmware.com — Thu, 25 Jul 2019 08:20:12 GMT

Hi all,

It needs online to download the VIB of vRealize Automation or vRealize Operations by Lifecycle manager on SDDC manger (VCF 3.7.2) when deploying VCF on VxRail/vSAN Ready Node.

Is any offline Installation Bundle of vRA/vRO Ready on Lifecycle manager of SDDC Manager?

VMware Cloud Foundation 3.8 is GA as of July 18, 2019

communities-emailer@vmware.com — Tue, 23 Jul 2019 15:54:04 GMT

As of July 18, 2019, VMware Cloud Foundation 3.8 is officially GA.

https://blogs.vmware.com/cloud-foundation/2019/07/22/announcing-the-general-availability-of-vmware-cloud-foundation-3-8/

vmware cloud l2 connection

communities-emailer@vmware.com — Tue, 02 Jul 2019 11:46:09 GMT

Hi ,

Here in the pic , how the asymmetric routing will happen ?

From 192.168.0.12 , the only way to get to 192.168.0.0/24 is through the local edge router

So how the asymmetric routing will happen ?

Thanks

Understanding Layer 2 Extensions for the Hybrid Cloud - VMware Cloud Provider Blog

Secondary Region within VCF

communities-emailer@vmware.com — Mon, 01 Jul 2019 15:00:37 GMT

Hi all

I have a quesiton with regards to the bring up of the second region with VCF. If the second region is earmarked as a recovery site for the primary region does the script that makes the remote SDDC manager aware of the vRealize Suite within the primary allow SDDC manager to connect the second region workload domains to this "primary" instance as is the case in the primary region or is this a manual process?

A second question also arises in that do you than use vRLCM to deploy new proxy servers for the secondary region for vRA and remote collectors for vROPS and vRB?

Thank in advance

Regards

Workload domain deployment failure

communities-emailer@vmware.com — Sun, 23 Jun 2019 10:42:47 GMT

Hello All,

I am trying to deploy workload domain via vCF in a nested environment in my lab. The workload domain creation fails at NSX manager deployment stage.

I checked doainmanager.log and seems SDDC manager can't reach out to NSX manager post deployment.

As per logs, SDDC manager is firing an api call to nsx manager to fetch the component info and it's failing as nsx is not getting initialized 100% by that time. This is what I see in logs

2019-06-23T04:33:55.607+0000 INFO [816ffc22a8b1693b,5bf5] [o.a.http.impl.execchain.RetryExec,pool-2-thread-6] Retrying request to {s}->https://172.16.31.199:443

2019-06-23T04:33:58.607+0000 WARN [816ffc22a8b1693b,5bf5] [c.v.e.s.c.s.nsx.impl.NsxServiceImpl,pool-2-thread-6] NSX Manager likely down:

org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://172.16.31.199/api/1.0/appliance-management/components/component/NSX": No route to host (Host unreachable); nested exception is java.net.NoRouteToHostException: No route to host (Host unreachable)

2019-06-19 17:42:27.478 [vcf_dm,2d09c0eb966f33a3,44db31a238298c9c] [-thread-13] ERROR [ c.v.e.s.common.services.nsx.impl.NsxServiceImpl] NSX Manager did not come alive within 600 seconds

2019-06-19 17:42:27.479 [vcf_dm,2d09c0eb966f33a3,44db31a238298c9c] [-thread-13] ERROR [ c.v.v.c.f.p.action.impl.DeployNsxManagerAction] NSX Manager did not respond within 600 seconds after deploy

2019-06-19 17:42:27.493 [vcf_dm,2d09c0eb966f33a3,44db31a238298c9c] [-thread-13] ERROR [c.v.e.sddc.orchestrator.model.error.ErrorFactory] [EVDD96] DEPLOY_NSX_MANAGER_FAILED Failed to deploy NSX Manager

com.vmware.evo.sddc.orchestrator.exceptions.OrchTaskException: Failed to deploy NSX Manager

I observed that NSX manager is taking a bit long to boot. Once booting is completed I can ping NSX manager from my sddc manager using hostname. But by that time SDDC manager is giving up and deletes the old instance of nsx and deploys a fresh vm. I am using NSX-V for my workload domain.

Have anyone seen this issue before?

Management Networks question.

communities-emailer@vmware.com — Thu, 20 Jun 2019 17:57:20 GMT

Hello people,

I'm designing a VCF 3.7.2 SDDC environment for a customer. The requirement is to have a vSAN stretch cluster for the Mgmt. Domain. While I know this is allowed I'm confused in one part. Can I have L3 routed networks for Management network? The VCF documentation says "The management VLAN between the two availability zones must be stretched" and shows L2 for Management as below. Why is it L2 and not L3 in VCF?

vSAN 6.7 deployment guide clearly shows the stretched L2 or L3 routed is supported for Mgmt. Networks. Anyone has any inputs? Appreciate it!!

Network Name	Connectivity to AZ2	Minimum MTU	Maximum MTU
vSAN	L3	1500	9000
vMotion	L3	1500	9000
VXLAN (VTEP)	L3	1600	9000
Management	L2	1500	9000
Witness Management	L3	1500	9000
Witness vSAN	L3	1500	9000

Unable to configure NSX vCloud Directory 9.5

communities-emailer@vmware.com — Wed, 19 Jun 2019 09:17:10 GMT

Hi,

I am preparing new environment with vSphere6.5, NSX-T2.4, ESXi6.5 and vCloud Directory9.5.

When I am trying to attach vCenter, getting below error:

[ 28653c62-f1c2-4e5d-8206-5fa8fe2f0516 ] Failed to connect to the NSX Manager

- /api/2.0/services/vcconfig, error code 98

Please help me if you know the solution for this.

Update step 4

communities-emailer@vmware.com — Mon, 17 Jun 2019 22:04:11 GMT

Author : Shikha Bhargava

URL : http:////docs.vmware.com/en/VMware-Cloud-Foundation/3.7/com.vmware.vcf.admin.doc_37/GUID-1CE2112B-CCD2-4DF9-A21D-64C70B30A2C1.html

Topic Name : Offline Bundle Download

Publication Name : VMware Cloud Foundation Operations and Administration Guide

Product/Version : VMware Cloud Foundation/3.7

Question :

Could you please update step for to say "Copy the /opt/vmware/vcf/lcm/lcm-tools" instead. Just copying the bin folder does not work.