bmcb555 Tracker

Re: Packer is complaining that vcenter_server.com/sdk is not accessible

bmcb555 — Wed, 18 Oct 2023 22:26:26 GMT

The SDK uses the vSphere APIs so HTTP/HTTPs via SOAP. Is the account you're using unlocked and has the correct permission?

Re: Remove IPv6 Configuration on NSX Managers

bmcb555 — Wed, 18 Oct 2023 22:08:11 GMT

Unfortunately the only method I know is to redeploy in a rolling fashion. If you've not integrated yet with vCenter it might be quicker just to tear down and rebuild. I hope you get a more satisfactory answer

Re: Vcenter stopped working

bmcb555 — Fri, 06 Oct 2023 15:18:45 GMT

If you've edited the file it might be worth giving the resolver services a kick

systemctl restart systemd-resolved

systemctl restart dnsmasq

Could you also share the host file with the IP addressing blanked out?

Re: Multiple vDS with same uplink

bmcb555 — Fri, 22 Sep 2023 08:09:05 GMT

You cannot share vmnics with multiple vDS, however, depending on your vendor you can use the same physical uplink, create multiple virtual vmnics that map to the same physical uplink. These will be presented to the ESXi host as multiple vmnics which in turn can be used to create multiple vDS with.

I'm aware that Cisco FIs can do the above, your vendor may very. If you're equipment isn't able to do this sort of setup then you'll have to have everything on the same vDS assuming they need network access.

Re: Firewall vlan segment supervision

bmcb555 — Thu, 21 Sep 2023 13:11:02 GMT

It'll need more licensing but you can use VRNI for what you're trying to accomplish.

https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/products/vrealize/vmw-vrni-solution-brief.pdf

You add your NSX Managers + vCenters to the VRNI and it gathers the flow information much the same way as nsx intelligence. It'll then report back to you what rules are being hit based on how you build the search criteria. It requires two VMs to function

Re: Access data from a possibly corrupt vdmk delta file

bmcb555 — Thu, 21 Sep 2023 11:48:52 GMT

I'd something similar in a cyber attack and was able to get the data off the disks following the below

https://enes.dev/

Now the guide is for recovering off flat files but you can follow the process from "06/02/2023 - UPDATE!" Guides you through mounting using the software and pulling it off.

Re: Problem transferring VM OVF from 4.1 to 6.7, missing /dev entries

bmcb555 — Thu, 21 Sep 2023 11:39:37 GMT

Sounds like something went on in the export. Maybe give the converter a try in standalone mode?

https://www.vmware.com/de/products/converter.html

Re: vSAN Data at Rest Encryption and KMS Failure

bmcb555 — Fri, 08 Sep 2023 16:24:08 GMT

I don't believe there is anything more detailed than that there is however a very good session (again old) on how KMS operates and it hasn't functionally changed as fair as I'm aware.

I've cut into the section you will be interested in.

https://youtu.be/I5gR_dVqfz0?t=653

What happens if vCenter is offline/ failed?
- Depends, on boot the hosts are given the keys by vCenter. The keys are stored in ESXi memory so as long as you do not reboot the hosts, your VMs will be fine. If it comes up and vCenter is not available it will not be able to get it's host keys to then get the VM keys therefore that particular host cannot access the VMs on storage.
What happens if 1 KMS is offline Failed?
- It fails over to the next KMS in the list
What happens if both KMS are offline/failed?
- Again depends if you reboot the hosts, the keys are stored in the hosts memory and are lost on reboot

Re: vSAN Capacity what if scenario

bmcb555 — Fri, 08 Sep 2023 14:34:19 GMT

Are you taking into account your policies are assuming all disks will be thin provisioned?

Re: vSAN Data at Rest Encryption and KMS Failure

bmcb555 — Fri, 08 Sep 2023 14:30:35 GMT

Here you go

https://docs.vmware.com/en/VMware-vSphere/8.0/vsan-monitoring-troubleshooting/GUID-084B3888-499F-4CD0-8954-A149560B1534.html

In an encrypted vSAN cluster, when communication between a host and the KMS is lost, the disk group can become locked if the host reboots. You should be fine until you reboot the hosts

Re: NSX-T REST APIs with Unique Identifier for Security Groups

bmcb555 — Thu, 07 Sep 2023 15:58:50 GMT

No problem, I hope it's clear! Group ID must be unique for the security groups but they can all share the same display_name if you wanted. If this has helped you solve your issue please mark as solved.

Re: 2 vCenter ELM and NSX 4.0 Manager Clusters

bmcb555 — Thu, 07 Sep 2023 15:29:41 GMT

Yes as long as you connect them to the same transport zones. What you are looking to do is multi-site NSX. It has some limitations so have a read and make sure it's the right fit for you

https://docs.vmware.com/en/VMware-NSX/4.1/administration/GUID-5D7E3D43-6497-4273-99C1-77613C36AD75.html

Re: NSX-T REST APIs with Unique Identifier for Security Groups

bmcb555 — Thu, 07 Sep 2023 06:46:37 GMT

The group id is a unique identifier. You can call every group the exact same name but the identifier has to be different. Thats how it's been in my experience.

So for example using the exmaple in the API document

PUT https://<policy-mgr>/policy/api/v1/infra/domains/vmc/groups/webgroup { "expression": [ { "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "resource_type": "Condition" } ], "description": "web group", "display_name": "web group", "_revision":0 }

PUT https://<policy-mgr>/policy/api/v1/infra/domains/vmc/groups/webgroup1 { "expression": [ { "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "resource_type": "Condition" } ], "description": "web group", "display_name": "web group", "_revision":0 }

You need a unique ID for each group you add otherwise it'll overwrite the previous group.

Pretty much every API you query is looking for that ID. Below is the API to add a rule

PUT https://<policy-mgr>/policy/api/v1/infra/domains/vmc/security-policies/application-section-1 { "description": "comm map", "display_name": "application-section-1", "category": "Application", "rules": [ { "description": " comm entry", "display_name": "ce-1", "sequence_number": 1, "source_groups": [ "/infra/domains/vmc/groups/webgroup" ], "destination_groups": [ "/infra/domains/vmc/groups/webgroup1" ], "services": [ "/infra/services/HTTP", "/infra/services/CIM-HTTP" ], "action": "ALLOW" } ] }

If it wasn't unique you'd never be able to reference it since you wouldn't know what you're calling.

Re: How do you go about downrading your license?

bmcb555 — Wed, 06 Sep 2023 20:49:37 GMT

Through the vmware licenses portal. Assuming you have your keys with VMware you can move down from 8 to 7 no problems

https://kb.vmware.com/s/article/81665

Re: Querying vCenter for VM info using PowerShell - Too slow

bmcb555 — Wed, 06 Sep 2023 20:47:22 GMT

If you want the code to run faster you're better off making use of the REST APIs rather than PowerCLI and call the APIs you wish to query directly. Get-VM will pull in a lot of irrelevant data.

Re: Sending logs to a remote syslog server

bmcb555 — Wed, 06 Sep 2023 19:48:31 GMT

Yes, for version 7 it's a little different. Create your own xml file, eg udp1514.xml

<ConfigRoot>
<service id='0032'>
<id>udp1514</id>
<rule id = '0000'>
<direction>outbound</direction>
<protocol>udp</protocol>
<porttype>dst</porttype>
<port>1514</port>
</rule>
<enabled>true</enabled>
<required>false</required>
</service>
</ConfigRoot>

Copy it into the /etc/vmware/firewall and issue esxcli network firewall refresh. You won't be able to edit services.xml from version 7.

Re: Sending logs to a remote syslog server

bmcb555 — Wed, 06 Sep 2023 19:17:57 GMT

Yes it is possible, follow this KB https://kb.vmware.com/s/article/2008226

You'll create a custom firewall service and allow it outbound on port 1514 UDP. From there configure udp:host01:1514 in your syslog settings and you should be good to go.

There is some additional workarounds at the end of the post on getting it to work with 7 and above.

Re: multicast dns(MDNS)

bmcb555 — Wed, 06 Sep 2023 18:36:17 GMT

Here you go - https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/nsxt_32_admin.pdf

Have I configured multicast, yes. With NSX, no. The concept of multicast PIM and RP isn't locked down to a specific vendor, my experience with multicast is via Cisco but the concepts are the same.

NSX supports PIM Sparse Mode with IGMPv2 so I would probably configure the t0 (assuming both subnets terminate to the same t0) as a static RP for the traffic. Use that as your target/receiver.

here is some additional information on sparse mode https://networklessons.com/multicast/multicast-pim-sparse-mode

I have implement multicast into production networks, nothing to really note.

Re: Partition Data Storage on ESXi to be used by any VM on the host at a time

bmcb555 — Wed, 06 Sep 2023 17:11:03 GMT

No problem, be sure to mark as accepted solution if you're happy with the answer

Re: How to Remove One VCenter from Link mode

bmcb555 — Wed, 06 Sep 2023 19:05:57 GMT

The KB does cover everything but I agree it's rather confusing and you are expected to know which steps to follow and which to ignore.

https://kb.vmware.com/s/article/2106736

William Lam has also done a similar article here - https://williamlam.com/2017/03/how-to-split-vcenter-servers-configured-in-an-enhanced-linked-mode-elm.html

Will is a vExpert as well as an employee so as close to an official step by step guide you can get. Best of luck, I've completed similar work like this, the guide given was more than enough to see me through.