DonalB Tracker

Re: NSX-T Multisite

DonalB — Mon, 05 Sep 2022 21:51:47 GMT

I have a VMC on cloud as my third DC , latency between the sites is as follow
DC1 < --> DC2 - 1-3ms

DC1< --> DC3 - 2-4ms

DC2<-->DC3 - 3-6ms

I'm deploying an NSX-T environment for the clusters in DC1 and DC2 (single VC , with a Stretched VSAN cluster and a couple of non-Stretched)

Can I consider deploying my NSX-T managers one per location given my latency is less that 10ms between each site? I'd be hosting the NSX-T manager quorum for the on-prem infrastructure on the VMC on cloud

Re: NSX-T Multisite

DonalB — Thu, 10 Dec 2020 10:48:15 GMT

Hi Dimitri,

Excellent deck, 2 quick questions

1. Is protecting the NSX Managers with vSphere Replication and SRM a valid approach in the case where stretched management vSphere cluster is not an option (we do have an NSX-V universal LS to place the managers on) - any drawbacks to using vSphere replication?

2. For the T0 is there local site recoverability from Blue to Green?

Thanks

VVD Upgrade - VCF Required?

DonalB — Wed, 18 Nov 2020 21:01:46 GMT

Hi,

An existing SDDC deployment based on VVD3.x - considering upgrade options and wondering if VCF is needed (we don't have licensing for it) and whether an upgrade to a VVD6.x aligned deployment is possible?

Thanks

Re: Only two of four BGP paths being populated in routing table on DLR

DonalB — Wed, 24 Apr 2019 06:24:36 GMT

Apologies for the delay in replying, I had some PTO the last few days. I had raised an SR with support around the same time I posted last week and have gotten feedback yesterday to say that what we have currently setup will not work as BGP on the ESGs evaluates the ASN also for ECMP so if different ASNs are used only the paths with the lowest ASN will be used. Resolution is to use the same ASN , KB article here outlines this:

VMware Knowledge Base

Bit of a surprising one, need to see if I can get this configuration on the physical side to confirm this works for us.

Cheers

Re: Only two of four BGP paths being populated in routing table on DLR

DonalB — Fri, 19 Apr 2019 07:13:04 GMT

I had checked with the networking team on this and they had confirmed that they did see this. I didn't think it would be something to worry about however as the DLR to the south of the edges is where I'm only getting 2 of the 4 routes pushed into the routing table

Re: Only two of four BGP paths being populated in routing table on DLR

DonalB — Thu, 18 Apr 2019 21:02:09 GMT

Hi Sreec,

Thanks for replying,

1)Each ESG is certainly showing 4x subnets , is that correct ?

--> Each ESG shows 2 paths to networks north of the ESGs published from it's upstream physical peer as expected

--> the DLR shows in BGP a path to each Northbound subnet advertised from the 4 x ESGs

2)Do you have reachability from missing subnets(2x) to workloads behind DLR or vice versa keeping the routing table issue aside ?

--> yes, have tested this by overriding BGP with static routes

3) You have mentioned filtering is minimal - however I'm interested to know the actual configuration

--> on ESGs out direction; we deny for the subnets that the ESGs and physical routers peer over, and permit any

--> on DLR for in direction; we deny for the subnet behind the DLR (this is to prevent any routing loops), and permit any

I'm attaching a diagram in case it helps

Tks

Only two of four BGP paths being populated in routing table on DLR

DonalB — Thu, 18 Apr 2019 17:10:52 GMT

Hi ,

We have an NSX DLR configured in a BGP peering relationship with 4 x NSX ESGs (2 x ESGs in one Datacenter and 2 x ESGs in another datacenter), with ECMP mode enabled on the DLR and each ESG. The 4 x NSX ESGs are in peering relationships with upstream physical routers local to them in the their respective datacenters.
We are advertising routes from the physical network to the ESGs, including the default route , and these routes are being advertised to the DLR from the ESGs.
Our challenge is that we are expecting to see 4 x instances of a route, one from each ESG, at the DLR however we only see 2 x routes when running sh ip route, and these are the routes from one datacenter only. We do not have any specific preferences set for BGP and filtering is minimal and configured the same on all ESGs, also the AS-Path is the same length on each route when viewed in the BGP outputs on the DLR (i.e. sh ip bgp)

Thanks

vmk0 clones flexnic mac

DonalB — Fri, 23 Dec 2016 07:51:04 GMT

Hi,

Anyone else come across a gotcha with HP BL using FlexNICS and Virtual Connect assigned MAC where creating the management network using the DCUI after install causes the vmk0 port that's created to clone the physical MAC address (in this case the VC assigned MAC - which can cause a bit of a hidden gotcha if you ever change around server profiles) rather than create a vmware assigned MAC address ? We've found we need to delete this vmk0 port and manually recreate at the command line in order to rectify. Using latest HP ESXi6 iso.

Just curious really - didn't find anything specific to this with an admittedly brief search

Cheers

External database failover - vRO fails to reconnect

DonalB — Sat, 21 Nov 2015 09:19:29 GMT

Hi,

We've got a vRO cluster running with an MSSQL database backend that is also clustered. When the SQL database is failed over to the secondary for maintenance we find that both vROs gets disconnected from the database and don't reconnect and require us to restart the application servers to recover. Is this expected behaviour? Is there a way to extend the timeout for the database connection or anything along those lines?

Thanks

Re: VRMGuestAgent on Server 2012 R2 deployed via SCCM 2012 Task Seqeunce - [info] [ssl client] Client certificate chain filenot specified

DonalB — Sat, 24 Oct 2015 10:59:30 GMT

If your IaaS server is on Windows 2012 then you may need to disable TLS1.2 - you may have reviewed this already but in case you hadn't:

vCAC 6.0.x with Windows 2012 Guest Agent “stuck” Looping with “wait.vbs” script | Cloud Relevant

http://vmwarevcloudvirtualization.blogspot.ie/2014/04/vcac-agent-ssl-issue.html

VMware KB: Connecting the guest agent to IaaS on Windows 2012 fails with the error: Client certificate chain file no…

Re: Orchestrator and wildcard ssl weirdness

DonalB — Sat, 24 Oct 2015 10:50:38 GMT

Mads,

Apologies, have only picked up this now. Have some of that working alright, I'll see can I dig out the details if you still need it?

Cheers

Orchestrator and wildcard ssl weirdness

DonalB — Fri, 04 Sep 2015 11:59:52 GMT

Hi,

Anyone used a wildcard ssl cert with latest release of vRO yet? I'm coming across a bit of weirdness and wondering if I've hit a bug or am doing something stupid (very possible!)

Background:

I've got a wildcard cert for my domain and I've used it for all of the vRA components in my environment and all's good. I'm setting up an external vRO to work with this vRA environment and trying to use the same wildcard cert (I'm a bit lazy me;-) )

Problems:

I followed the process to create a new jssecacerts at /etc/vco/app-server/security and imported the wildcard cert, set the alias to dunes and all looks good when I start up the vco server and the configurator

I then go about importing all the ssl certs I will need to register with the component registry of vRA. This is all good too. If i do a keytool -list on the jssecacerts I can see all the certs I;ve imported and the dunes aliased cert etc.

If i then restart the vco server I seem to be coming up on a newly generated self-signed cert that vRO has generated on restart ??

Running a keytool -list does indeed seem to show that my dunes cert has been changed but all of the certs that I had imported are still there. if I redo the delete dunes, import my wildcard and re-alias it to dunes and then restart everything looks good again until the next time I restart ....

Comments, suggestions welcome...

Cheers

Re: Problem with vCAC distributed install

DonalB — Thu, 25 Jun 2015 08:06:46 GMT

Had something similar and while LB was also something I looked into, maybe the solution I posted here may help:

Error whilst installing vCAC 6 - error MSB3073

Re: Error whilst installing vCAC 6 - error MSB3073

DonalB — Thu, 25 Jun 2015 08:05:17 GMT

Appreciate I'm posting on an old thread but in case anyone else get's stuck on this - I was getting the exact same issue with a vRA 6.2 install and the logs weren't really giving me any clue as to what was going on. Looooong story short - I had to specify the SQL Instance name along with the server name ; hadn't had to do this in previous installs which is why this was somewhat confusing. OS used was Win2012R2 for the IaaS machines and SQL 2014 Express for the SQL instance (it's a lab environment so not fussed about the SQL support). So whenever the database server was being asked for setting it to be <FQDN>\<SQLInstance> sorted this out. I had named the SQL instance VRSQL so the format looked like this <FQDN>\VRSQL

For further background, I was doing a distributed install so what threw another kink into it was that the first part of the Custom install is to create the database and using just the server name without the instance name worked fine for creating the database. But then putting only the server name in when installing the Primary IaaS Website & Model Manager in the next run of the installer would cause the same error as listed on this thread

Hope this helps someone else out, had a truly frustrating week trying to figure this out and in fairness it being something simple whilst making me feel a bit stupid is also a good thing as it isn't black magic!

Cheers

Re: VCAC 61: Login Fail with error "Login failed. Please contact your System Administrator and report error code mv2km0hv."

DonalB — Fri, 21 Nov 2014 11:25:13 GMT

Pointed towards this from GSS:

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2090809

Haven't tried it yet, will do so later, but just in case anyone else still having this problem ....

Re: VCAC 61: Login Fail with error "Login failed. Please contact your System Administrator and report error code mv2km0hv."

DonalB — Sat, 15 Nov 2014 08:39:54 GMT

Having the same problem with a fresh install of 6.1. Have tried SBeavers certificate shenanigans but can't get the ID appliance to accept a concatenated pem chain, my certs have 3 layers though (host, SubCA, CA) so wondering if that's causing a problem . Have also tried targeting the GC in AD on port 3268 rather than straight ldap on 389. and have confirmed time is synced across the appliances. have to be missing something in this .....

Re: VCM 5.7.2 installation problems windows 2008R2, MS SQL 2012. Tier 2

DonalB — Sat, 27 Sep 2014 07:37:25 GMT

Have had a similar problem, couple of things that aren't clearly documented in the standard install guide (think they may be in the Advanced guide, and if you dig around the web you'll also find references .. .eventually!)

Make sure to install

Download and install SQL 2008 R2 native client package on the server where you'll install VCM (Collector and Webserver)
Download and install SQL 2008 R2 command line tools (sqlcmdlnutils.msi) on server where you'll install VCM (Collector and Webserver)

Apparently even for a 2012 SQL server these packages are still required by the installer for the SQL and SSRS installation. I had already had the native client install (found that requirement through an earlier issue in my original install) and then got exactly the same error as the one you have here , installed the command line tools, rebooted the server and the install ran through then.

HTH

Re: Office 2013 high CPU usage causing session lockups

DonalB — Wed, 26 Feb 2014 12:31:25 GMT

It is 1 , have bumped to 2 to see but it may be some more hours before I can tell if it helped, the issues typically do not start from first logon, they usually start to occur after a few hours or even a day or two - again intermittent and inconsistent so far

Thanks for the suggestions though, have you seen similar issues or have a Win7 & Office 2013 desktop environment in View where this isn't happening?

Re: VMware tools causing Microsoft Office 2013 products to hang on Windows 8

DonalB — Wed, 26 Feb 2014 10:15:17 GMT

Not exactly the same environment but seeing something similar in terms of office 2013 in a View environment, have started a separate thread about it here: Office 2013 high CPU usage causing session lockups

Our VMTools version is currently 9.0.5 build 1065307

I had assumed at this stage that it was Office 2013 but seeing your post I'm wondering, might explore this a bit more and if I find anything I'll let you know

Re: Office 2013 high CPU usage causing session lockups

DonalB — Wed, 26 Feb 2014 10:07:53 GMT

Not disconnected, screen locks up and appears to become unresponsive while the office application is in the foreground, however I have found that putting the office app in the background either through task manager or alt-tab and selecting another non-office app will recover graphics control and if watching task manager the now office app running in the background will after a few seconds of continued 100% CPU usage, drop back but if you try to bring the application to the foreground again it hammers CPU again. If you sit and wait it will eventually get over what it's trying to process and then become responsive again - the killer is that this at the moment is completely inconsistent, no one action appears to cause this and most of the time the application works just fine....!!?