Punkgeek Tracker

Re: Enhancing ESXi Host Security Against Ransomware with VMware NSX DFW

Punkgeek — Thu, 26 Oct 2023 18:21:33 GMT

Thank you for your response.

Is it safe enough to only limit IP addresses in the ESXi firewall?

Enhancing ESXi Host Security Against Ransomware with VMware NSX DFW

Punkgeek — Mon, 23 Oct 2023 14:08:34 GMT

Hello,

I have an ESXi host with a public IP address, and it is connected to the vCenter via the public IP address. Given that I am unable to move the ESXi into a private network, I'm considering using VMware NSX DFW to enhance its security against ransomware. Would this solution suffice?

Regards,

Re: vCenter NAT

Punkgeek — Thu, 19 Oct 2023 12:51:29 GMT

I don't want to put the ESXi host over the internet, but the problem is that I don't have access to the physical router.

If I configure a router as a VM and disable the ESXi host public IP address, I won't be able to access the ESXi host if the router VM fails.

vCenter NAT

Punkgeek — Thu, 19 Oct 2023 11:34:23 GMT

As I understand it, vCenter does not support the NAT method. I need to connect approximately 20 ESXi hosts from different countries to the vCenter, and each ESXi host has one public IP address. I could only find two methods to solve this problem:

Moving the vCenter over the network and assigning it a public IP address.
Installing a router as a virtual machine on each ESXi host to access the ESXi hosts over the private network (since I do not have access to the physical router of the ESXi hosts).

Both of these solutions come with numerous difficulties and potential security issues. Do you have any other suggestions for this challenge?

Re: NSX-T faulty TEP

Punkgeek — Wed, 16 Aug 2023 22:22:22 GMT

Hello,

Yes, the edge node is inside the nested lab, but I'm using a single uplink for the ESXi and edge vm.

I've checked the MTU, and everything is working fine:

From ESXi to ESXi:

vmkping -I vmk10 -S vxlan -d -s 8000 192.168.10.61

8008 bytes from 192.168.10.61: icmp_seq=0 ttl=64 time=0.374 ms

From ESXi to Edge Node:

vmkping -I vmk10 -S vxlan -d -s 8000 192.168.10.61

8008 bytes from 192.168.10.61: icmp_seq=0 ttl=64 time=0.374 ms

How can ESXi communicate with the edge node in different VLANs? Could you please explain this?

Regards,

Re: NSX-T faulty TEP

Punkgeek — Tue, 15 Aug 2023 16:45:41 GMT

Hello, thank you for your response.

Sorry, I wrote incorrectly. All IPs are in the 192.168.10.0/24 range, and there is no configured VLAN.

Nsx-T version 4

I didn't understand the part that appliances VTEP. How can an appliance have VTEP?

It's a nested environment; I only have a single edge node and a single nsx appliance.

I've attached some screenshots from nodes and hosts.

Thanks

NSX-T faulty TEP

Punkgeek — Tue, 15 Aug 2023 07:22:01 GMT

I have created a VLAN segment in NSX and a T-0 gateway. I added the created VLAN segment as the Tier-0 interface. Then, I created an overlay segment and connected it to the T-0 gateway.

Everything was fine until I connected the Overlay segment to one of the virtual machines, causing the Edge node and the ESXi host to go down.

I checked the VTEP between the ESXi hosts and the edge node, and they are responding with an MTU of 1700.

I'm using 192.168.8.0/24 for the management, which the ESXi hosts, NSX appliance, vCetner, and Edge node management IP are in this range.
And 192.168.10.9/24 for the VTEP IP range.

Here are the error messages that show in the NSX:

TEP Health, Faulty TEP
Description :
TEP:vmk10 of VDS:VDS at Transport node:2e7e8310-aabb-4c9e-aec1-9f37ed1f9fa8. Overlay workloads using this TEP will face network outage.

Recommended Action
1. Check if TEP has valid IP or any other underlay connectivity issues. 2. Enable TEP HA to failover workloads to other healthy TEPs.

Infrastructure Communication, Edge Tunnels Down

Description:
The overall tunnel status of Edge node 31829895-3a35-432f-a2d3-0b3d24469dd6 is down.

Recommended Action:
Invoke the NSX CLI command `get tunnel-ports` to get all tunnel ports, then check each tunnel's stats by invoking NSX CLI command `get tunnel-port <UUID> stats` to check if there are any drops. Also check /var/log/syslog if there are tunnel related errors.

High Availability, Tier0 Gateway Failover
Description:
The tier0 gateway 94bd643e-a463-452c-9c66-b734a6c31623 failover from Active to Down, service-router 3b7b34f6-ebee-4dd6-afc4-ae777f7d4fd3

Recommended Action:
Invoke the NSX CLI command `get logical-router <service_router_id>` to identify the tier0 service-router vrf ID. Switch to the vrf context by invoking `vrf <vrf-id>` then invoke `get high-availability status` to determine the service that is down.

Cannot ping ESXi or Edge TEP IP

Punkgeek — Fri, 04 Aug 2023 13:45:43 GMT

Hello,

I have configured NSX-T on my nested environment and increased the MTU to 1800.

While I can easily ping ESXi hosts from each other on vmk0, I encounter issues when attempting to ping the other ESXi hosts through the following command, as there is no response. Additionally, the Edge VM's tep IP address is also unreachable.

esxcli network ip interface ipv4 get Name IPv4 Address IPv4 Netmask IPv4 Broadcast Address Type Gateway DHCP DNS ----- ------------- ------------- --------------- ------------ ------------ -------- vmk0 192.168.8.51 255.255.255.0 192.168.8.255 STATIC 192.168.8.1 false vmk10 192.168.10.23 255.255.255.0 192.168.10.255 STATIC 192.168.10.1 false vmk50 169.254.1.1 255.255.0.0 169.254.255.255 STATIC 192.168.8.1 false

# vmkping -I vmk10 -S vxlan -d 192.168.10.21 -s 1400 PING 192.168.10.21 (192.168.10.21): 1400 data bytes --- 192.168.10.21 ping statistics --- 3 packets transmitted, 0 packets received, 100% packet loss # ping 192.168.8.52 PING 192.168.8.52 (192.168.8.52): 56 data bytes 64 bytes from 192.168.8.52: icmp_seq=0 ttl=64 time=1.036 ms

I've tried to find an article to troubleshoot this case, but I couldn't find one.

input fields during ova deployment

Punkgeek — Mon, 22 May 2023 13:05:39 GMT

Some OVA templates require you to enter network IP address information, a password, and an SSH key. I would like to know the name of this action or ask for a document that can guide me on customizing my OVA template to prompt customers for specific information during deployment. I have attached a screenshot from the DELL VSA OVA file, which prompts for network configuration.

Re: vsan hybrid suggestion

Punkgeek — Wed, 10 May 2023 15:05:10 GMT

Hello,

Thank you for your response. Could you please give me the name of an enterprise SSD drive with the same or close price?

Regards,

vsan hybrid suggestion

Punkgeek — Tue, 09 May 2023 17:02:42 GMT

Hello,

I have a Marshal 2600ss-T15k with 6x600 GB SAS drives (15000RPM).

I am planning to configure VSAN on the dl360 g7 servers and I am looking for suggestions. The dl360 G7 has 10 disk slots.

I need a configuration for general usage since we have different types of customers, some requiring IOPS while others require read or write.

Which configuration would be the most reasonable option:

2x500 GB EVO 870 SSD as the cache
2x256 GB EVO 870 SSD
4x256 GB EVO 870 SSD
4x120 GB EVO 850 SSD

Since I have 6 SAS drives, I can create two VSAN groups with each group consisting of three SAS drives and two SSDs as cache. However, I would like to know which one is more reasonable between these configurations.

Tanzu DNS problem

Punkgeek — Sat, 15 Oct 2022 10:02:54 GMT

Hello,

I want to install Tanzu. I've run an ubuntu DHCP server with bind9 DNS configured, which is connected to the VM network with a public static IP address and VLAN-111 distributed switch.

CIDRs of three networks:

VLAN-111	10.111.10.0/24	Management
VLAN-40-Tanzu-Workload	10.0.40.0/24	Workload
VLAN-41-Tanzu-Frontend	10.0.41.0/24	Frontend

IP assignments:

10.111.10.1	Ubuntu DHCP server
10.111.10.12	HAProxy IP Address
10.111.10.20-10.111.10.24	SupervisorControlPlaneVM(s)
10.0.40.10-10.0.40.254	Workload Network (IP range) for the Cluster (K8S) Nodes
10.0.41.128/25 (10.0.41.128-10.0.41.254)	Load Balancer IP Range (VIPs)
10.111.10.1, 8.8.8.8	DNS
0.pl.pool.ntp.org	NTP

However, I've received this problem regarding installation:

Unable to connect to the management DNS servers '10.111.10.1,8.8.8.8' from the control plane VM 421c235c4038270f6f71862ad8c6849a.
Unable to connect to the management DNS servers '10.111.10.1,8.8.8.8' from the control plane VM 421c677df8a45ab7bb03ffac8bbadb96.
Unable to connect to the management DNS servers '10.111.10.1,8.8.8.8' from the control plane VM 421c5b2e1c1f69295e5437aebd580242.

The Haproxy VM can ping the 10.111.10.1 or google.com, which it has connected to the internet through the DHCP server.

VMware storage profile service doesn't start

Punkgeek — Tue, 12 Apr 2022 10:29:38 GMT

We have VCenter version 7, and the VMware storage profile service (vmware-sps) doesn't start.

I've attached the error log from /var/log/vmware/vmware-sps/sps.log

The error log seems to show an error from FCDDatastore,

But we do not have any storage called this name.

convert powercli script to pyvmomi

Punkgeek — Tue, 05 Apr 2022 06:30:49 GMT

Hello,

I'm searching for example of the following scrip in pyvmomi:

Connect-VIServer vcenter.domain.local -User "administrator@vsphere.local" -Password "passwd"
$esxcli = Get-EsxCli -VMhost esxi1.domain.local -V2
$esxcli.network.vm.list.invoke()
$esxcli.network.vm.port.list.Invoke(@{worldid=1167321})
$esxcli.network.port.stats.get.Invoke(@{portid=67108900})

Change VM IP address without guest password

Punkgeek — Mon, 04 Apr 2022 15:57:29 GMT

Is there any way to change the VM IP address without having the Guest login password through powerCLI or pyvmomi?

Regards

vCenter Appliance 7.0.x Firewall

Punkgeek — Thu, 24 Mar 2022 04:05:49 GMT

I want to block all traffic to the VCenter appliance except for the 1 IP address.

I've added the ESXi IP address plus my IP and created another rule to block the 0.0.0.0/0.
However, the VCenter cannot synchronize with the ESXi when I enable the 0.0.0.0/0 rule.

How can I restrict any other connection to the VCenter?

A general system error occurred: PBM error occurred during PreReconfigureCallback: Fault cause: vmod

Punkgeek — Mon, 14 Mar 2022 16:37:51 GMT

I have VMware VCenter windows 6.7, which I have a problem with after the VM clone feature.

"A general system error occurred: PBM error occurred during PreReconfigureCallback: Fault cause: vmod"

I've tried this article, but It seems the vmware-sps is not available on my windows vcenter

PS C:\Program Files\VMware\vCenter Server\bin> .\service-control --start vmware-sps
Operation not cancellable. Please wait for it to finish...
Service-control failed. Error: {
"componentKey": null,
"resolution": {
"translatable": "Please refer to component manager documentation to troubleshoot.",
"localized": "Please refer to component manager documentation to troubleshoot.",
"id": "install.ciscommon.cmlookup.resolution"
},
"detail": [
{
"translatable": "Unable to locate service '%(0)s'",
"localized": "Unable to locate service 'vmware-sps'",
"args": [
"vmware-sps"
],
"id": "install.ciscommon.service.notfound"
}
],
"problemId": null

Differences between VM and VCenter resource usage

Punkgeek — Sat, 19 Feb 2022 16:36:03 GMT

Hello,

On my Linux VM, when I check the resource usage with '''htop''' command, it shows me 1.5 GB ram usage. But on the VCenter or ESXI panel, shows me 5.8 GB usage from 8GB total ram.

The VCenter does not have any configuration.

Re: VCenter appliance failed to start vpxd service

Punkgeek — Mon, 03 Jan 2022 15:53:54 GMT

The vpxd-svcs.log has been attached.

Re: VCenter appliance failed to start vpxd service

Punkgeek — Mon, 03 Jan 2022 15:57:39 GMT

The /storage/core was full, And when I searched about that, it seems it was just logs for crashes, etc. Some of them have similar problems and suggest deleting dump files. So I did.

There was only one type of file but I don't remember the name, It was starting with core.. , Core.netlogond.xxxx etc

# df -h Filesystem Size Used Avail Use% Mounted on devtmpfs 9.3G 0 9.3G 0% /dev tmpfs 9.4G 476K 9.4G 1% /dev/shm tmpfs 9.4G 1.2M 9.4G 1% /run tmpfs 9.4G 0 9.4G 0% /sys/fs/cgroup /dev/mapper/vg_root_0-lv_root_0 47G 9.9G 35G 22% / tmpfs 9.4G 1.2M 9.4G 1% /tmp /dev/sda3 488M 29M 424M 7% /boot /dev/mapper/lifecycle_vg-lifecycle 98G 3.6G 90G 4% /storage/lifecycle /dev/mapper/imagebuilder_vg-imagebuilder 9.8G 37M 9.3G 1% /storage/imagebuilder /dev/mapper/autodeploy_vg-autodeploy 9.8G 37M 9.3G 1% /storage/autodeploy /dev/sda2 10M 2.2M 7.9M 22% /boot/efi /dev/mapper/core_vg-core 49G 53M 47G 1% /storage/core /dev/mapper/netdump_vg-netdump 985M 2.5M 915M 1% /storage/netdump /dev/mapper/vtsdblog_vg-vtsdblog 15G 57M 14G 1% /storage/vtsdblog /dev/mapper/updatemgr_vg-updatemgr 98G 368M 93G 1% /storage/updatemgr /dev/mapper/dblog_vg-dblog 15G 121M 14G 1% /storage/dblog /dev/mapper/archive_vg-archive 49G 22G 25G 47% /storage/archive /dev/mapper/vtsdb_vg-vtsdb 25G 76M 24G 1% /storage/vtsdb /dev/mapper/seat_vg-seat 25G 1.4G 22G 6% /storage/seat /dev/mapper/log_vg-log 9.8G 2.5G 6.8G 27% /storage/log /dev/mapper/db_vg-db 9.8G 410M 8.9G 5% /storage/db