Deployment of VMware NSX-T for Workload Domains. 19 MAR 2019 VMware Validated Design VMware NSX-T 2.4

Transcription

1 Deployment of VMwre NSX-T for Worklod Domins 19 MAR 2019 VMwre Vlidted Design VMwre NSX-T 2.4

2 You n find the most up-to-dte tehnil doumenttion on the VMwre wesite t: If you hve omments out this doumenttion, sumit your feedk to dofeedk@vmwre.om VMwre, In Hillview Ave. Plo Alto, CA Copyright VMwre, In. All rights reserved. Copyright nd trdemrk informtion. VMwre, In. 2

3 Contents 1 Aout 5 2 Prepring for Deploying Worklod Domin with NSX-T 6 Prerequisites for the NSX-T Deployment for the Shred Edge nd Compute Cluster 7 Generte Certifite for the NSX-T Mnger for the Shred Edge nd Compute Cluster 9 3 Instll nd Configure the ESXi Hosts for the Shred Edge nd Compute Cluster 11 Instll ESXi Intertively on All Hosts in the Shred Edge nd Compute Cluster 11 Configure the Mngement Network on the Hosts for the Shred Edge nd Compute Cluster 12 4 Deploy nd Configure the Shred Edge nd Compute Cluster Components 14 Deploy the Compute vcenter Server Instne for the Shred Edge nd Compute Cluster 15 Reple the Certifite of the Compute vcenter Server 18 Set the SDDC Deployment Detils on the Compute vcenter Server 20 Add vsphere Lienses nd Assign Liense to the Compute vcenter Server 21 Add the Compute vcenter Server to the Virtul Mhine Group for vcenter Server 22 Exlude the Compute vcenter Server from the Distriuted Firewll 23 Configure the Shred Edge nd Compute Cluster 23 Crete vsphere Distriuted Swith for the Shred Edge nd Compute Cluster 27 Enle vsphere HA on the Shred Edge nd Compute Cluster 29 Configure SSH, NTP, nd Advned Options on the First ESXi Host in the Shred Edge nd Compute Cluster 31 Configure Syslog on the Shred Edge nd Compute Cluster 32 Crete nd Apply the Host Profile for the Shred Edge nd Compute Cluster 33 Use the UMDS Shred Repository s the Downlod Soure in Updte Mnger 36 5 Deploy the NSX-T Instne for the Shred Edge nd Compute Cluster 38 Deploy the First NSX-T Mnger Appline 40 Import the CA-Signed Certifites for the NSX-T Mnger Cluster 42 Reple the Certifite for the First NSX-T Mnger Appline 43 Connet NSX-T Mnger to the vcenter Server Instnes 45 Deploy the Remining Nodes of the NSX-T Mnger Cluster 46 Crete n Anti-Affinity Rule for the NSX-T Mnger Applines 48 Move the NSX-T Mnger Applines to the NSX Folder 48 Reple the Certifites for the Remining NSX-T Mnger Applines 49 Assign Virtul IP Address nd Certifite to the NSX-T Mnger Cluster 51 Assign Liense to NSX-T 52 VMwre, In. 3

4 Crete the Trnsport Zones for System nd Overly Trffi 53 Crete Uplink Profiles nd the Network I/O Control Profile 54 Crete the NSX-T Segments for System, Uplink, nd Overly Trffi 55 Crete Trnsport Node Profile 57 Configure the ESXi Host Trnsport Nodes 58 Remove the ESXi Hosts for the vsphere Distriuted Swith 59 Configure Dynmi Routing in the Shred Edge nd Compute Cluster 60 Deploy Segment for Smple Tennt Worklod 73 6 Connet vrelize Log Insight to the NSX-T Instne for the Shred Edge nd Compute Cluster 74 Instll the vrelize Log Insight Content Pk for NSX-T 74 Configure the NSX-T Components to Forwrd Log Events to vrelize Log Insight 75 7 Bk Up nd Restore the NSX-T Instne for the Shred Edge nd Compute Cluster 76 Configure Automti Bkups of the NSX-T Configurtion 76 Restore the NSX-T Mnger Cluster 77 VMwre, In. 4

5 Aout Deployment of VMwre 1 NSX-T for Worklod Domins Drft omment filepth: GUID-714DF0B3-CC18-4AC9-A F21CA0677.xml provides step-y-step instrutions for extending Stndrd SDDC with virtul infrstruture worklod domin tht uses VMwre NSX-T for softwredefined networking. Intended Audiene Drft omment filepth: GUID-714DF0B3-CC18-4AC9-A F21CA0677.xml The doument is intended for rhitets nd dministrtors who wnt to deploy NSX-T in virtul infrstruture worklod domin for tennt worklods. Required VMwre Softwre Drft omment filepth: GUID-714DF0B3-CC18-4AC9-A F21CA0677.xml is omplint nd vlidted with ertin produt versions. See VMwre Vlidted Design Relese Notes for more informtion out supported produt versions. Softwre omponents for VMwre Vlidted Design for Softwre-Defined Dt Center 5.0 Author: ikostov Thu Fe 7 14:41:18 UTC Sttus: Minor. The user might not need to downlod so mny omponents in this se. Mye list them expliitly without the versions for lower mintenne ost. IK: No hoie with Cloud Builder nywy t the moment. NSX-T 2.4 Prerequisites Drft omment filepth: GUID-714DF0B3-CC18-4AC9-A F21CA0677.xml Deploy the mngement worklod domin nd optionlly the initil virtul infrstruture worklod domin ording to VMwre Vlidted Design for Softwre-Defined Dt Center t lest in single region. See the VMwre Vlidted Design doumenttion pge. VMwre, In. 5

6 Prepring for Deploying 2 Worklod Domin with NSX-T Drft omment filepth: GUID-7A94F1C B-B331-E6591E xml is sed on VMwre Vlidted Design for Softwre-Defined Dt Center. You deploy the virtul network infrstruture on VMwre NSX-T for worklod domin in shred edge nd ompute luster. dds n dditionl worklod domin to VMwre Vlidted Design. Before You Deploy Compute Worklod Domin with NSX-T Drft omment filepth: GUID-7A94F1C B-B331-E6591E xml You must first deploy nd onfigure the omponents of the SDDC mngement luster. See Plnning nd Preprtion nd Deployment for Region A doumenttion. ESXi hosts Pltform Servies Controller pir nd Mngement vcenter Server NSX for vsphere vrelize Lifeyle Mnger vsphere Updte Mnger vrelize Opertions Mnger vrelize Log Insight vrelize Automtion with emedded vrelize Orhestrtor vrelize Business If you implement the full guidne in VMwre Vlidted Design, you lso deploy ompute worklod domin tht uses NSX for vsphere s the solution for virtul networking. 1 Prerequisites for the NSX-T Deployment for the Shred Edge nd Compute Cluster Before you deploy the NSX-T omponents, verify tht your environment stisfies the requirements for this deployment. VMwre, In. 6

7 2 Generte Certifite for the NSX-T Mnger for the Shred Edge nd Compute Cluster Use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte ertifites for the NSX-T Mnger signed y the Mirosoft ertifite uthority (MSCA). Prerequisites for the NSX-T Deployment for the Shred Edge nd Compute Cluster Drft omment filepth: GUID-DDD329E5-918F-4ACC-A4CA-56655AAF00DC.xml Before you deploy the NSX-T omponents, verify tht your environment stisfies the requirements for this deployment. IP Addresses nd Host Nmes Drft omment filepth: GUID-DDD329E5-918F-4ACC-A4CA-56655AAF00DC.xml Verify tht the stti IP ddresses nd FQDNs for ll omponents re lloted on the DNS server nd re ville for deployment. Tle 2 1. VLAN IDs nd IP Sunets for the ESXi Hosts of the Worklod Domin VLAN Funtion VLAN ID Sunet Gtewy ESXi Mngement / vsphere vmotion / vsan / Host overly / Uplink / Uplink / Edge overly / Tle 2 2. FQDNs nd IP Addresses for the ESXi Hosts of the Worklod Domin ESXi Host FQDN Mngement IP Address NTP Server sfo01w02esx01.sfo01.rinpole.lol ntp.sfo01.rinpole.lol sfo01w02esx02.sfo01.rinpole.lol ntp.sfo01.rinpole.lol sfo01w02esx03.sfo01.rinpole.lol ntp.sfo01.rinpole.lol sfo01w02esx04.sfo01.rinpole.lol ntp.sfo01.rinpole.lol Tle 2 3. FQDN nd IP Address of the Compute vcenter Server vcenter Server FQDN IP Address sfo01w02v01.sfo01.rinpole.lol VMwre, In. 7

8 Tle 2 4. IP Addresses nd Host Nmes for the NSX-T Components Role FQDN IP Address NSX-T Mnger instnes sfo01wnsx01.sfo01.rinpole.lol sfo01wnsx01.sfo01.rinpole.lol sfo01wnsx01.sfo01.rinpole.lol sfo01wnsx01.sfo01.rinpole.lol (VIP) Edge Servies Gtewy 01 sfo01wesg01.sfo01.rinpole.lol (Mngement) (Overly) (Uplink 1) (Uplink 2) Edge Servies Gtewy 02 sfo01wesg02.sfo01.rinpole.lol (Mngement) (Overly) (Uplink 1) (Uplink 2) Sunet msk DNS NTP Servers ntp.sfo01.rinpole.lol Deployment Prerequisites Drft omment filepth: GUID-DDD329E5-918F-4ACC-A4CA-56655AAF00DC.xml Verify tht your environment stisfies the following prerequisites for the deployment. Prerequisite Storge in the Mngement Cluster Virtul disk provisioning: Thin Required storge per NSX-T Mnger: Initil storge: 200 GB Initil storge ggregted for ll NSX-T Mngers: 600 GB Memory in the Mngement Cluster Required memory per NSX-T Mnger node Required memory: 48 GB Required memory ggregted for ll NSX-T Mnger nodes: 144 GB Network Connetivity Verify tht routing is in ple etween the mngement IP sunets of the mngement luster nd the new worklod domin. VMwre, In. 8

9 Prerequisite Softwre Fetures Verify tht the Mngement vcenter Server is opertionl. Verify tht the mngement luster hs vsphere DRS nd vsphere HA enled. Verify tht you hve the Postmn REST lient instlled in your We rowser. Instlltion Pkges Downlod the.iso imge for ESXi nd the vcenter Server Appline. Downlod the.ov file for the NSX-T Unified Appline nd NSX-T Edge Node. Boot Medi for the ESXi Instller Crete ootle USB drive nd uplod the ESXi instller to it. See the vsphere Instlltion nd Setup doumenttion. Ative Diretory Verify tht you hve prent Ative Diretory with the SDDC user roles onfigured for the rinpole.lol domin. Certifite Authority nd Custom Signed Certifites Configure the root Ative Diretory domin ontroller s ertifite uthority for the environment. Downlod the CertGenVVD-version.zip file of the Certifite Genertion Utility nd generte the signed ertifite for the NSX-T Mnger instnes. See VMwre Knowledge Bse rtile Aess to the dt enter Provide Mirosoft Windows virtul mhine or physil server to provide onnetion to the dt enter nd store softwre downlods. The host must e onneted to the externl network nd to the ESXi mngement network. Generte Certifite for the NSX-T Mnger for the Shred Edge nd Compute Cluster Drft omment filepth: GUID-5C9966B6-83C9-46C7-8AA3-C33BA36C0591.xml Use the VMwre Vlidted Design Certifite Genertion Utility (CertGenVVD) to generte ertifites for the NSX-T Mnger signed y the Mirosoft ertifite uthority (MSCA). 1 Log in to Windows host tht hs ess to your dt enter. 2 Downlod the CertGenVVD-version.zip file of the Certifite Genertion Utility from VMwre Knowledge Bse rtile nd extrt the ZIP file to C:\CertGenVVD-version. 3 In the C:\CertGenVVD-version folder, open the defult.txt file in text editor. VMwre, In. 9

10 4 Verify tht following properties re onfigured. ORG=Rinpole In. OU=Rinpole.lol LOC=SFO ST=CA CC=US CN=VMwre_VVD keysize= In the C:\CertGenVVD-version\ConfigFiles folder, rete text file nmed sfo01wnsx01.txt with the following ontent. [CERT] NAME=defult ORG=defult OU=defult LOC=SFO ST=defult CC=defult CN=sfo01wnsx01.sfo01.rinpole.lol keysize=defult [SAN] sfo01wnsx01 sfo01wnsx01.sfo01.rinpole.lol 6 Open Windows PowerShell prompt nd run the following ommnds to vlidte the preprtion of the Certifite Genertion Utility nd to generte the MCSA-signed ertifite. Set-ExeutionPoliy Unrestrited d :\CertGenVVD-version.\CertGenVVD-version.ps1 -vlidte.\certgenvvd-version.ps1 -MSCASigned -ttri 'CertifiteTemplte:VMwre' 7 Nvigte to C:\CertGenVVD-version nd verify tht the utility hs reted nd populted the SignedByMSCACerts folder. VMwre, In. 10

11 Instll nd Configure the ESXi Hosts for the Shred Edge nd Compute Cluster 3 Drft omment filepth: GUID-CA12C1DA-D51B EDD85DC3108.xml Strt the deployment of the virtul infrstruture worklod domin y instlling nd onfiguring the dditionl ESXi hosts in Region A. ESXi ts s pltform for the tennt worklods tht use the softwredefined networking pilities of NSX-T. Author: ikostov Thu Fe 7 16:24:18 UTC Sttus: Moved ll prerequisites to the min "Prerequisites" pge of the guide to follow the VVD deployment do templte. 1 Instll ESXi Intertively on All Hosts in the Shred Edge nd Compute Cluster Instll mnully ESXi from USB drive on the hosts of the worklod domin. 2 Configure the Mngement Network on the Hosts for the Shred Edge nd Compute Cluster After the initil oot of ESXi, use the ESXi Diret Console User Interfe (DCUI) for initil host network onfigurtion nd dministrtive ess. Instll ESXi Intertively on All Hosts in the Shred Edge nd Compute Cluster Drft omment filepth: GUID F-D4D7-477E-A166-2CE98ED87FE7.xml Instll mnully ESXi from USB drive on the hosts of the worklod domin. 1 Power on the sfo01w02esx01.sfo01.rinpole.lol host. 2 Mount the USB drive ontining the ESXi.iso file nd oot from tht USB drive. 3 On the Welome to the VMwre Instlltion sreen, press Enter to strt the instlltion. 4 On the End User Liense Agreement (EULA) sreen, press F11 to ept the EULA. 5 On the Selet Disk to Instll or Upgrde sreen, selet the USB drive under lol storge to instll ESXi nd press Enter to ontinue. Author: ikostov Thu Fe 7 16:34:26 UTC Sttus: Removed "or SD rd" euse the oot-up is done from the USB drive. VMwre, In. 11

12 6 Selet the keyord lyout nd press Enter. 7 Enter the esxi_root_user_pssword, enter the pssword seond time to onfirm, nd press Enter. 8 On the Confirm Instll sreen, press F11 to strt the instlltion. 9 After the instlltion finishes, unmount the USB drive nd press Enter to reoot the host. 10 Repet this proedure for ll hosts. Configure the Mngement Network on the Hosts for the Shred Edge nd Compute Cluster Drft omment filepth: GUID-B2DF41C0-7D57-4B FCAE8356D61B.xml After the initil oot of ESXi, use the ESXi Diret Console User Interfe (DCUI) for initil host network onfigurtion nd dministrtive ess. On eh host, perform the following tsks to onfigure the host network settings: Configure the VMkernel network dpter vmk0 nd VLAN ID for the mngement network. Configure the IP ddress, sunet msk, gtewy, DNS server, nd FQDN for the ESXi host. Repet this proedure for ll hosts in the shred edge nd ompute luster. 1 Open the DCUI on the physil ESXi host sfo01w02esx01.sfo01.rinpole.lol. Press F2 to enter the DCUI. Log in y using the following redentils. User nme Pssword root esxi_root_user_pssword 2 Selet Configure Mngement Network nd press Enter. 3 Configure the VLAN ID of the mngement network. On the Configure Mngement Network sreen, selet VLAN (Optionl) nd press Enter. Enter 1641 s the VLAN ID for the mngement network nd press Enter. VMwre, In. 12

13 4 Configure the IPv4 settings of the host. On the Configure Mngement Network sreen, selet IPv4 Configurtion nd press Enter. Configure the IPv4 network y using the following settings nd press Enter. Set stti IPv4 ddress nd network onfigurtion Seleted IPv4 Address Sunet Msk Defult Gtewy Configure the DNS settings of the host. On the Configure Mngement Network sreen, selet DNS Configurtion nd press Enter. Configure DNS on the host y using the following settings nd press Enter. Use the following DNS Server ddress nd hostnme Seleted Primry DNS Server Alternte DNS Server Hostnme sfo01w02esx01.sfo01.rinpole.lol d On the Configure Mngement Network sreen, selet Custom DNS Suffixes nd press Enter. Verify tht the suffix list is empty nd press Enter. 6 Press Espe to lose the DCUI nd press Y to onfirm the hnges. 7 Repet this proedure on the other ESXi hosts. VMwre, In. 13

14 Deploy nd Configure the Shred Edge nd Compute Cluster Components 4 Drft omment filepth: GUID-18A8F7C3-F36E-40C7-82EA-902B A.xml Deploy nd onfigure the shred edge nd ompute luster omponents. 1 Deploy the Compute vcenter Server Instne for the Shred Edge nd Compute Cluster To mnge nd onfigure the ESXi hosts in the dditionl worklod domin nd to provision tennt worklods from entrlized node, you must instll nd onfigure vcenter Server on the mngement luster of Region A. You onnet this vcenter Server instne to the Pltform Servies Controller pir tht is ville in the region to tke dvntge of the high vilility of nd to join the single vcenter Single Sign-on domin onfigured on the pir. 2 Reple the Certifite of the Compute vcenter Server To estlish trusted onnetion to the other SDDC mngement omponents, you reple the defult SSL ertifite on the vcenter Server instne in the worklod domin with ustom ertifite tht is signed y the ertifite uthority (CA) on the prent Ative Diretory (AD) server. 3 Set the SDDC Deployment Detils on the Compute vcenter Server Updte the identity of your SDDC deployment on the Compute vcenter Server in the worklod domin. You n use this identity s lel in tools for utomted SDDC deployment. 4 Add vsphere Lienses nd Assign Liense to the Compute vcenter Server Assign liense key to the Compute vcenter Server for the worklod domin to use its fetures in prodution. If the pity of the lienses for vcenter Server nd ESXi is insuffiient to liense the new instnes, dd new lienses to the inventory of the Liense Servie. Author: ikostov Fri Fe 8 11:24:40 UTC Sttus: Rerrnged to over the se when you do hve liense 5 Add the Compute vcenter Server to the Virtul Mhine Group for vcenter Server The Compute vcenter Server for the worklod domin must e memer of the virtul mhine group so tht it is powered on, in group with the other vcenter Server instnes, fter the Pltform Servies Controller pir. In this wy, the servies of the Pltform Servies Controller nodes re ville to the Compute vcenter Server fter vsphere HA migrtion ours. 6 Exlude the Compute vcenter Server from the Distriuted Firewll To llow network ess to the Compute vcenter Server for the worklod domin, exlude it from ll distriuted firewll rules. VMwre, In. 14

15 7 Configure the Shred Edge nd Compute Cluster After you deploy the Compute vcenter Server, you must rete nd onfigure the shred edge nd ompute luster for high vilility of nd resoure usge poliy for virtul mhines, nd for entrl user mngement using Ative Diretory. Author: ikostov Mon Fe 11 16:55:09 UTC Sttus: The proedure is very dense. Think out splitting it. 8 Crete vsphere Distriuted Swith for the Shred Edge nd Compute Cluster After you dd ll ESXi hosts in the worklod domin to the luster, you n rete the vsphere Distriuted Swith for the system trffi. This swith hndles trffi until you migrte the hosts to the N-VDS instne for the luster. 9 Enle vsphere HA on the Shred Edge nd Compute Cluster vsphere High Avilility protets virtul mhines hrdwre nd operting system outges. 10 Configure SSH, NTP, nd Advned Options on the First ESXi Host in the Shred Edge nd Compute Cluster Time synhroniztion issues n result in serious prolems with your environment. Configure the Network Time Protool (NTP) settings on eh of your ESXi hosts in the shred edge nd ompute lusters. To hieve greter levels of seurity, hnge the defult ESX Admins group nd remove known dministrtive ess point. 11 Configure Syslog on the Shred Edge nd Compute Cluster To mintin entrlized logging, enle the syslog servie on the ESXi hosts in the shred edge nd ompute luster. The syslog servie provides stndrd mehnism for logging messges from the VMkernel nd other system omponents. 12 Crete nd Apply the Host Profile for the Shred Edge nd Compute Cluster Host Profiles mintin onfigurtion onsisteny nd orretness ross your shred edge nd ompute luster. 13 Use the UMDS Shred Repository s the Downlod Soure in Updte Mnger Configure Updte Mnger to use the vsphere Updte Mnger Downlod Servie (UMDS) shred repository s entrlized soure for downloding ESXi pthes, extensions, nd notifitions. Deploy the Compute vcenter Server Instne for the Shred Edge nd Compute Cluster Drft omment filepth: GUID-B420ABEA-118B F7C-DABCC61873AE.xml To mnge nd onfigure the ESXi hosts in the dditionl worklod domin nd to provision tennt worklods from entrlized node, you must instll nd onfigure vcenter Server on the mngement luster of Region A. You onnet this vcenter Server instne to the Pltform Servies Controller pir tht is ville in the region to tke dvntge of the high vilility of nd to join the single vcenter Single Sign-on domin onfigured on the pir. VMwre, In. 15

16 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 To e le to deploy nother vcenter Server instne, disle the lokdown mode on the sfo01m01esx01.sfo01.rinpole.lol ESXi host in the mngement luster. In the Nvigtor, lik Hosts nd Clusters nd expnd the sfo01m01v01.sfo01.rinpole.lol tree. Under the sfo01-m01-mgmt01 luster, selet sfo01m01esx01.sfo01.rinpole.lol nd lik the Configure t. Under the System setion, selet Seurity Profile nd lik Edit. d In the sfo01m01esx01.sfo01.rinpole.lol-lokdown Mode dilog ox, selet Disled nd lik OK. 3 Strt the vcenter Server Appline Deployment wizrd. Browse to the.iso file of the vcenter Server Appline. Run the dvd-drive:\vs-ui-instller\win32\instller.exe pplition file. 4 To perform the first stge of the instlltion, omplete the vcenter Server Appline Deployment wizrd. Clik Instll. On the Introdution pge, lik Next. d e On the End user liense greement pge, selet the I ept the terms of the liense greement hek ox nd lik Next. On the Selet deployment type pge, under Externl Pltform Servies Controller, selet the vcenter Server (Requires Externl Pltform Servies Controller) rdio utton nd lik Next. On the Appline deployment trget pge, enter the following settings nd lik Next. ESXi host or vcenter Server nme sfo01m01v01.sfo01.rinpole.lol HTTPS Port 443 User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword VMwre, In. 16

17 f g h i In the Certifite Wrning dilog ox, lik Yes to ept the host ertifite. On the Selet folder pge, selet sfo01-m01fd-mgmt nd lik Next. On the Selet ompute resoure pge, selet the sfo01m01esx01.sfo01.rinpole.lol host nd lik Next. On the Set up ppline VM pge, enter the following settings, nd lik Next. VM nme Root pssword Confirm root pssword sfo01w02v01 ompv_root_pssword ompv_root_pssword j k l On the Selet deployment size pge, selet Lrge vcenter Server nd lik Next. On the Selet dtstore pge, selet the sfo01-m01-vsn01 dtstore, selet the Enle Thin Disk Mode hek ox, nd lik Next. On the Configure network settings pge, enter the following settings nd lik Next. Network IP version IP ssignment FQDN sfo01-m01-vds01-mngement IPv4 stti sfo01w02v01.sfo01.rinpole.lol IP Address Sunet msk or prefix length Defult gtewy DNS servers , HTTP 80 HTTPS 443 m On the Redy to omplete stge 1 pge, review the onfigurtion nd lik Finish. The deployment is strted. n After the deployment finishes, to proeed to the seond stge of the instlltion, lik Continue. VMwre, In. 17

18 5 Complete the Instll - Stge 2: Set Up vcenter Server Appline wizrd to omplete the seond stge of the instlltion. On the Introdution pge, lik Next. On the Appline onfigurtion pge, enter the following settings nd lik Next. Time synhroniztion mode NTP servers (omm-seprted list) SSH ess Synhronize time with NTP servers ntp.sfo01.rinpole.lol Enled On the SSO onfigurtion pge, enter the following settings nd lik Next. Pltform Servies Controller sfo01ps01.sfo01.rinpole.lol HTTPS port 443 SSO domin nme SSO pssword vsphere.lol sso_pssword d e f On the Redy to omplete pge, review the onfigurtion nd lik Finish. In the Wrning dilog ox, lik OK. On the Complete pge, lik Close. 6 Enle lokdown mode on sfo01m01esx01.sfo01.rinpole.lol. Bk in the vsphere Client, expnd the sfo01-m01-mgmt01 luster. Selet sfo01m01esx01.sfo01.rinpole.lol nd lik the Configure t. Under the System setion, selet Seurity Profile nd lik Edit. d In the sfo01m01esx01.sfo01.rinpole.lol-lokdown Mode dilog ox, selet Norml nd lik OK. Reple the Certifite of the Compute vcenter Server Drft omment filepth: GUID-F7606F18-89E B5D E3115D.xml To estlish trusted onnetion to the other SDDC mngement omponents, you reple the defult SSL ertifite on the vcenter Server instne in the worklod domin with ustom ertifite tht is signed y the ertifite uthority (CA) on the prent Ative Diretory (AD) server. Use the following ertifite files to reple the ertifite on the Compute vcenter Server: VMwre, In. 18

19 Tle 4 1. Certifite-Relted Files on the vcenter Server Instne vcenter Server FQDN Files for Certifite Replement sfo01w02v01.sfo01.rinpole.lol sfo01w02v01.1.key sfo01w02v01.1.er Root64.er 1 Log in to vcenter Server y using Seure Shell (SSH) lient. Open n SSH onnetion to the sfo01w02v01.sfo01.rinpole.lol virtul mhine. Log in y using the following redentils. User nme Pssword root venter_server_root_pssword 2 To enle seure opy (sp) onnetions for the root user, swith from the ppline shell to the Bsh shell. shell hsh -s "/in/sh" root 3 Copy the ertifites tht you generted y using the CertGenVVD utility to the vcenter Server Appline. Run the following ommnd to rete new temporry folder. mkdir -p /root/erts Copy the ertifite files sfo01w02v01.1.er, sfo01w02v01.key, nd Root64.er to the /root/erts folder. You n use n sp softwre suh s WinSCP. 4 Reple the CA-signed ertifite on the vcenter Server instne. Run the vsphere Certifite Mnger utility on the vcenter Server instne. /usr/li/vmwre-vm/in/ertifite-mnger Selet Option 1 (Reple Mhine SSL ertifite with Custom Certifite), enter the defult vcenter Single Sign-On user nme dministrtor@vsphere.lol nd vsphere_dmin_pssword. VMwre, In. 19

20 When prompted for the Infrstruture Server IP, enter the VIP ddress of the Pltform Servies Controller pir in Region A. Infrstruture server IP d e Selet Option 2 (Import ustom ertifite(s) nd key(s) to reple existing Mhine SSL ertifite). When prompted, provide the full pth to the ustom ertifite, the root ertifite file, nd the key file tht you opied over erlier, nd onfirm the import with Yes (Y). Custom ertifite for Mhine SSL Custom key for Mhine SSL Signing ertifite of the Mhine SSL ertifite /root/erts/sfo01w02v01.1.er /root/erts/sfo01w02v01.key /root/erts/root64.er 5 After the sttus is 100% Completed, wit severl minutes until ll vcenter Server servies re restrted. 6 Restrt the vmi-lighttp servie to updte the ertifite on the virtul ppline mngement interfe (VAMI) nd to remove the ertifite files. servie vmi-lighttp restrt d /root/erts/ rm sfo01w02v01.1.er sfo01w02v01.key Root64.er Set the SDDC Deployment Detils on the Compute vcenter Server Drft omment filepth: GUID-C688CBFE-7F6E-4E9A-B47B-E3F5C99788EE.xml Updte the identity of your SDDC deployment on the Compute vcenter Server in the worklod domin. You n use this identity s lel in tools for utomted SDDC deployment. 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 From the Home menu, selet Hosts nd Clusters. VMwre, In. 20

21 3 In the inventory tree, selet the sfo01m01v01.sfo01.rinpole.lol vcenter Server ojet nd lik the Configure t. 4 Under the s setion, selet Advned s. 5 Lote the onfig.sddc.deployed.instneid setting nd write down its vlue. 6 In the Hosts nd Clusters inventory tree, selet the sfo01w02v01.sfo01.rinpole.lol vcenter Server ojet nd lik the Configure t. 7 Under the s setion, selet Advned s nd lik Edit. 8 In the Edit Advned vcenter Server s dilog ox, set the following vlue pirs one y one, liking Add fter eh entry, nd lik OK. Nme onfig.sddc.deployed.type onfig.sddc.deployed.flvor VVD Stndrd onfig.sddc.deployed.version 5.0 onfig.sddc.deployed.workloddomin onfig.sddc.deployed.method ShredEdgeAndCompute DIY onfig.sddc.deployed.instneid otined in Step 5. Add vsphere Lienses nd Assign Liense to the Compute vcenter Server Drft omment filepth: GUID-275C1588-AA BD9C-D5B389E1A854.xml Assign liense key to the Compute vcenter Server for the worklod domin to use its fetures in prodution. If the pity of the lienses for vcenter Server nd ESXi is insuffiient to liense the new instnes, dd new lienses to the inventory of the Liense Servie. Author: ikostov Fri Fe 8 11:24:40 UTC Sttus: Rerrnged to over the se when you do hve liense You ssign the host liense to the ESXi hosts when you dd them to the worklod domin. 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword VMwre, In. 21

22 2 From the Menu menu, selet Administrtion. 3 On the Administrtion pge, selet Lienses. 4 If the pity of the ville lienses is not suffiient to liense the nodes of the worklod domin, dd the lienses to the inventory of the Liense Servie. d On the Lienses t, likadd New Lienses. On the Enter liense keys pge, enter the liense keys for vcenter Server nd ESXi on seprte lines, nd lik Next. On the Edit liense nme pge, enter desriptive nme for the liense key, nd lik Next. On the Redy to omplete pge, review your entries, nd lik Finish. 5 Assign the lienses to the Compute vcenter Server for the worklod domin. Clik the Assets t nd lik vcenter Server systems. Selet the sfo01w02v01.sfo01.rinpole.lol vcenter Server instne, nd lik the Assign Liense ion. Selet the liense for the Compute vcenter Server nd lik OK. Add the Compute vcenter Server to the Virtul Mhine Group for vcenter Server Drft omment filepth: GUID-A9B691EC-B538-42AA-AE41-59EEEE28C0D3.xml The Compute vcenter Server for the worklod domin must e memer of the virtul mhine group so tht it is powered on, in group with the other vcenter Server instnes, fter the Pltform Servies Controller pir. In this wy, the servies of the Pltform Servies Controller nodes re ville to the Compute vcenter Server fter vsphere HA migrtion ours. 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 From the Home menu, selet Hosts nd Clusters. 3 In the inventory tree, expnd the sfo01m01v01.sfo01.rinpole.lol tree. 4 Selet the sfo01-m01-mgmt01 luster nd lik Configure. 5 On the Configure pge, lik VM/Host Groups. VMwre, In. 22

23 6 On the VM/Host Groups pge, selet the vcenter Servers VM Group. 7 In the vcenter Servers Group Memers pne, lik Add. 8 In the Add Group Memer dilog ox, selet sfo01w02v01 nd lik OK. Exlude the Compute vcenter Server from the Distriuted Firewll Drft omment filepth: GUID-520F53B0-8E51-4BE C1B.xml To llow network ess to the Compute vcenter Server for the worklod domin, exlude it from ll distriuted firewll rules. 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 Clik Menu nd selet Networking nd Seurity. 3 Clik Firewll s nd selet the Exlusion List t. 4 Selet from the NSX Mnger drop-down menu. 5 Clik the Add utton. 6 Add sfo01w02v01 to the Seleted Ojets list, nd lik OK. Configure the Shred Edge nd Compute Cluster Drft omment filepth: GUID-B5594BFD-34BC-4272-A32F-DA1A09E4F166.xml After you deploy the Compute vcenter Server, you must rete nd onfigure the shred edge nd ompute luster for high vilility of nd resoure usge poliy for virtul mhines, nd for entrl user mngement using Ative Diretory. Author: ikostov Mon Fe 11 16:55:09 UTC Sttus: The proedure is very dense. Think out splitting it. To rete nd onfigure the shred edge nd ompute luster, you perform the following tsks: Crete the luster. Configure vsphere HA nd vsphere DRS. VMwre, In. 23

24 Add the ESXi hosts to the luster. Add the ESXi hosts to the Ative Diretory domin. Crete resoure pools for the NSX-T edge devies nd for the tennt worklods. Crete folders for the virtul pplines of the NSX-T Edge devies for inound nd outound network trffi in the worklod domin. 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 Crete dt enter ojet. From the Home menu, selet Hosts nd Clusters. In the inventory tree, right-lik the sfo01w02v01.sfo01.rinpole.lol vcenter Server instne nd selet New Dtenter. In the New Dtenter dilog ox, enter sfo01-w02d nd lik OK. 3 Crete the shred edge nd ompute luster. In the inventory tree, right-lik the sfo01-w02d dt enter nd selet New Cluster. In the New Cluster wizrd, enter the following vlues nd lik OK. Nme DRS Turn ON Author: ikostov Mon Fe 11 14:40:46 UTC Sttus: To IX: Why tgging ws used inside tle? Other DRS options sfo01-w02-shred01 Seleted Defult vlues vsphere HA Turn ON Deseleted EVC Set the EVC mode to the highest ville seline tht is supported for the lowest CPU rhiteture on the hosts in the luster vsan Turn ON Deseleted VMwre, In. 24

25 4 Add the ESXi hosts to the shred edge nd ompute luster. Right-lik the sfo01-w02-shred01 luster, nd selet Add Hosts. On the Add hosts pge, selet Use sme redentils for ll hosts, enter the following informtion, nd lik Next. IP Address or FQDN Usernme Pssword sfo01w02esx01.sfo01.rinpole.l ol root esxi_root_user_pssword sfo01w02esx02.sfo01.rinpole.l ol sfo01w02esx03.sfo01.rinpole.l ol sfo01w02esx04.sfo01.rinpole.l ol In the Seurity Alert dilog ox, selet ll ESXi hosts, nd, to onfirm the vlidity of the host ertifites, lik OK. A trusted onnetion etween vcenter Server nd the ESXi hosts is estlished using the host ertifites for SSL hndshke. d e f g On the Host summry pge, review the host informtion nd lik Next. On the Redy to omplete pge, review the onfigurtion nd lik Finish. On the Hosts t for the luster, selet ll ESXi hosts, right-lik, nd selet Mintenne Mode > Exit Mintenne Mode. Selet ll ESXi hosts, right-lik, selet Assign Liense, selet the ESXi liense from the inventory of the Liense Servie, nd lik OK. 5 Add n ESXi host to the Ative Diretory domin d e In the inventory tree, expnd the entire sfo01w02v01.sfo01.rinpole.lol tree. Selet the sfo01w02esx01.sfo01.rinpole.lol host. On the Configure t, under System, selet Authentition Servies. On the Authentition Servies pge, lik the Join Domin utton. In the Join Domin dilog ox, enter the following settings nd lik OK. Domin User nme Pssword sfo01.rinpole.lol sv-domin-join@rinpole.lol sv-domin-join_pssword 6 Set the Ative Diretory servie to strt nd stop with host. Author: ikostov Mon Fe 11 17:20:02 UTC VMwre, In. 25

26 Sttus: Why doing it on one host only? On the Configure t for the host, under System, selet Servies. Selet the Ative Diretory servie, lik Edit Strtup Poliy, selet Strt nd stop with host, nd lik OK. 7 Crete the resoure pools for the shred edge nd ompute luster. You rete resoure pools for the following omponents: NSX-T Edge devies tht ontrol the network trffi in nd out of the worklod domin Tennt worklods in the worklod domin NSX-T Edge devies tht provide networking servies to the tennt worklods in the worklod domin Right-lik the sfo01-w02-shred01 luster nd selet New Resoure Pool. In the New Resoure Pool dilog ox, enter the vlues for the sfo01-w02rp-sdd-edge resoure pool nd lik OK. Resoure Pool 1 Resoure Pool 2 Resoure Pool 3 Nme sfo01-w02rp-sdd-edge sfo01-w02rp-user-edge sfo01-w02rp-user-vm CPU-Shres High Norml Norml CPU-Reservtion CPU-Reservtion Type Expndle seleted Expndle seleted Expndle seleted CPU-Limit Unlimited Unlimited Unlimited Memory-Shres Norml Norml Norml Memory-Reservtion 32 GB 0 0 Memory-Reservtion type Expndle seleted Expndle seleted Expndle seleted Memory-Limit Unlimited Unlimited Unlimited Repet the step to dd the remining resoure pools. 8 Crete folder for the virtul mhines of the NSX-T Edge devies for the inound nd outound trffi in the worklod domin. d From the Home menu, selet VMs nd Templtes. In the inventory tree, expnd the sfo01w02v01.sfo01.rinpole.lol tree. Right-lik the sfo01-w02d dt enter nd selet New Folder > New VM nd Templte Folder. In the New Folder dilog ox, enter sfo01-w02fd-nsx nd lik OK. VMwre, In. 26

27 Crete vsphere Distriuted Swith for the Shred Edge nd Compute Cluster Drft omment filepth: GUID-09494E29-274E-4BD7-9CCB-39D795EFE7E1.xml After you dd ll ESXi hosts in the worklod domin to the luster, you n rete the vsphere Distriuted Swith for the system trffi. This swith hndles trffi until you migrte the hosts to the N-VDS instne for the luster. 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 Crete vsphere Distriuted Swith for the shred edge nd ompute luster. From the Home menu, selet Networking. In the inventory tree, expnd the sfo01w02v01.sfo01.rinpole.lol tree. Right-lik the sfo01-w02d dt enter nd selet Distriuted Swith > New Distriuted Swith. The New Distriuted Swith wizrd ppers. d e f On the Nme nd lotion pge, enter sfo01-w02-vds01 s the nme nd lik Next. On the Selet version pge, verify tht the Distriuted swith version: rdio utton is seleted nd lik Next. On the Configure settings pge, enter the following vlues nd lik Next. Numer of uplinks 2 Network I/O Control Crete defult port group Enled Deseleted g On the Redy to omplete pge, review the onfigurtion nd lik Finish. 3 Enle jumo frmes on the sfo01-w02-vds01 distriuted swith. Right-lik the sfo01-w02-vds01 distriuted swith nd selet s > Edit s. On the Advned t, enter 9000 s MTU (Bytes) vlue nd lik OK. VMwre, In. 27

28 4 Crete the port groups for the system trffi on the sfo01-w02-vds01 distriuted swith. Right-lik the sfo01-w02-vds01 distriuted swith, nd selet Distriuted Port Group > New Distriuted Port Group. Crete the sfo01-w02-vds01-mngement port group with the following settings nd lik Next. Port Group Nme Port Binding Port Allotion Numer of Ports VLAN Type VLAN ID sfo01-w02-vds01-mngement Ephemerl Elsti 8 VLAN 1641 sfo01-w02-vds01-vmotion Ephemerl Elsti 8 VLAN 1642 sfo01-w02-vds01-vsn Ephemerl Elsti 8 VLAN 1643 sfo01-w02-vds01-nfs Ephemerl Elsti 8 VLAN 1625 d On the Redy to omplete pge, review the onfigurtion nd lik Finish. Repet this step for the other port groups. 5 Connet the sfo01w02esx01.sfo01.rinpole.lol ESXi host to the sfo01-w02-vds01 distriuted swith. Right-lik the sfo01-w02-vds01 distriuted swith, nd selet Add nd Mnge Hosts. The Add nd Mnge Hosts wizrd ppers. d e f g On the Selet tsk pge, selet Add hosts nd lik Next. On the Selet hosts pge, lik New hosts. In the Selet new hosts dilog ox, selet sfo01w02esx01.sfo01.rinpole.lol, lik OK, nd lik Next. On the Mnge physil network dpters pge, lik vmni1, nd lik Assign uplink. In the Selet n Uplink for vmni1 dilog ox, selet Uplink2 nd lik OK. On the Mnge physil network dpters pge, lik Next. 6 Configure the VMkernel network dpters. d e f On the Mnge VMkernel network dpters pge, lik vmk0 nd lik Assign port group. Selet sfo01-w02-vds01-mngement nd lik OK. On the Mnge VMkernel network dpters pge, lik Next. On the Migrte VM Networking pge, lik Next. On the Anlyze impt pge, lik Next. On the Redy to omplete pge, review your entries nd lik Finish. 7 Crete dditionl VMkernel network dpters. From the Home menu, selet Hosts nd Clusters. In the inventory tree, expnd the sfo01w02v01.sfo01.rinpole.lol tree Selet the sfo01w02esx01.sfo01.rinpole.lol host. VMwre, In. 28

29 d e f g h On the Configure t, lik VMkernel dpters. Clik the Add Networking utton nd selet VMKernel Network Adpter nd lik Next. On the Selet trget devie pge, lik Selet n existing network, selet the sfo01-w02- vds01-vmotion port group, lik OK, nd lik Next. On the Port properties pge, selet vmotion from the TCP/IP stk drop-down menu nd lik Next. On the IPv4 settings pge, onfigure the following settings nd lik Next. Use stti IPv4 settings Seleted IPv4 ddress Sunet msk i Clik Finish. 8 Configure the vmotion TCP/IP stk. Under Networking, lik TCP/IP onfigurtion. Selet vmotion nd lik the Edit ion. On the Routing pge, enter for the VMkernel gtewy, nd lik OK. 9 Migrte the lst physil dpter from the stndrd swith to the sfo01-w02-vds01 distriuted swith. d e Selet sfo01w02esx02.sfo01.rinpole.lol ESXi host. On the Configure t, lik Virtul Swithes nd expnd vswith0. From the ellipsis menu, selet Remove nd lik Yes in the Remove Stndrd Swith wrning dilog ox. Expnd sfo01-w02-vds01 nd lik Mnge Physil Adpters. In the Uplink ports pne, lik the Add utton, selet vmni0, lik OK, nd lik OK gin. Enle vsphere HA on the Shred Edge nd Compute Cluster Drft omment filepth: GUID-6184AE C-A5C4-9B17514AE234.xml vsphere High Avilility protets virtul mhines hrdwre nd operting system outges. VMwre, In. 29

30 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 In the Hosts nd Clusters inventory, expnd the sfo01w02v01.sfo01.rinpole.lol tree. 3 Selet the sfo01-w02-shred01 luster. 4 On the Configure t, selet Servies > vsphere Avilility. 5 Clik Edit. 6 In the Edit Cluster s dilog ox, enle vsphere HA. 7 On the Filures nd responses t, onfigure the following settings. Enle Host Monitoring Host Filure Response Response for Host Isoltion Dtstore with PDL Dtstore with APD VM Monitoring Seleted Restrt VMs Power off nd restrt VMs Disled Disled VM Monitoring Only 8 On the Admission Controlt, onfigure the following settings nd lik OK. Host filures luster tolertes 1 Define host filover pity y Override lulted filover pity Cluster resoure perentge Deseleted Performne degrdtion VMs tolerte 100% VMwre, In. 30

31 Configure SSH, NTP, nd Advned Options on the First ESXi Host in the Shred Edge nd Compute Cluster Drft omment filepth: GUID-CF50F096-01F7-49F2-A84B-ACCBD xml Time synhroniztion issues n result in serious prolems with your environment. Configure the Network Time Protool (NTP) settings on eh of your ESXi hosts in the shred edge nd ompute lusters. To hieve greter levels of seurity, hnge the defult ESX Admins group nd remove known dministrtive ess point. 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 Enle SSH. d e In the Hosts nd Clusters inventory, expnd the sfo01w02v01.sfo01.rinpole.lol tree. Selet the sfo01w02esx01.sfo01.rinpole.lol host. On the Configure t, selet System > Servies. Selet SSH nd lik the Strt utton. Clik the Edit Strtup Poliy utton, selet Strt nd stop with host, nd lik OK. 3 Configure the NTP Demon (ntpd) options. On the Configure t, selet System > Time Configurtion. Clik Edit. In the Edit Time Configurtion dilog ox, onfigure the following settings nd lik OK. Use Network Time Protool (Enle NTP lient) NTP Servers Strt NTP Servie NTP Servie Strtup Poliy Seleted ntp.sfo01.rinpole.lol,ntp.lx01.rinpole.lol Seleted Strt nd stop with host VMwre, In. 31

32 4 Chnge the defult ESX Admins group. d On the Configure t, selet System > Advned System s. Clik Edit. In the Filter text ox, enter esxadmins. Chnge the vlue of Config.HostAgent.plugins.hostsv.esxAdminsGroup to SDDC-Admins. 5 Disle the SSH wrning nner. In the Filter text ox, enter ssh. Chnge the vlue of UserVrs.SuppressShellWrning to 1 nd lik OK. Configure Syslog on the Shred Edge nd Compute Cluster Drft omment filepth: GUID-C2D06254-F963-44A4-9DCA-87810D311B72.xml To mintin entrlized logging, enle the syslog servie on the ESXi hosts in the shred edge nd ompute luster. The syslog servie provides stndrd mehnism for logging messges from the VMkernel nd other system omponents. 1 Log in to the vrelize Log Insight user interfe. Open We rowser nd go to Log in using the following redentils. User nme Pssword dmin deployment_dmin_pssword 2 Clik the onfigurtion drop-down menu ion nd selet Administrtion. 3 Under Integrtion, lik vsphere. VMwre, In. 32

33 4 In the vcenter Servers pne, enter the onnetion settings for the vcenter Server instne. Enter the host nme, user redentils, nd olletion options for the vcenter Server instne, nd lik Test Connetion. vcenter Server Option Hostnme Pssword Collet vcenter Server events, tsks nd lrms Configure ESXi hosts to send logs to Log Insight Trget sfo01w02v01.sfo01.rinpole.lol sv-vrli-vsphere_user_pssword Seleted Seleted sfo01vrli01.sfo01.rinpole.lol To verify tht you onnet to the orret vcenter Server, lik Advned Options nd exmine the list of ESXi hosts tht re onneted to the vcenter Server instne. In the Advned Options onfigurtion window, selet Configure ll ESXi hosts, selet UDP under Syslog protool, nd lik OK. Crete nd Apply the Host Profile for the Shred Edge nd Compute Cluster Drft omment filepth: GUID-B7FC89E2-E7C7-4B98-B204-3FCBF081B256.xml Host Profiles mintin onfigurtion onsisteny nd orretness ross your shred edge nd ompute luster. 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 Crete host profile from the sfo01w02esx01.sfo01.rinpole.lol ESXi host. In the Hosts nd Clusters inventory, expnd the sfo01w02v01.sfo01.rinpole.lol tree. Right-lik the sfo01w02esx01.sfo01.rinpole.lol ESXi host nd selet Host Profiles > Extrt Host Profile. In the Extrt Host Profile dilog ox, enter sfo01-w02hp-shred01 in the Nme text ox nd lik OK. VMwre, In. 33

34 3 Atth the host profile to the shred edge nd ompute luster. Right-lik the sfo01-w02-shred01 luster nd selet Host Profiles > Atth Host Profile. In the Atth Host Profile dilog ox, selet the sfo01-w02hp-shred01 host profile, nd lik OK. 4 Export host ustomiztion speifition for the hosts in the shred edge nd ompute luster. Right-lik the sfo01-w02-shred01 luster nd selet Host Profiles > Export Host Customiztions In the Export Host Customiztions dilog ox, lik Sve. The sfo01-w02hp-shred01_host_ustomiztions.sv file is downloded. Open the sfo01-w02hp-shred01_host_ustomiztions.sv file in Exel. Author: eivnov Tue Fe 19 18:31:18 UTC Sttus: EXCEL? Any editor should do the trik? Author: ikostov Mon Fe 25 16:30:06 UTC Sttus: Mye n editor tht support.sv files? VMwre, In. 34

35 d Edit the host ustomiztion file using these onfigurtion vlues. NetStk Instne ESXi Host Ative Diretory Configurtion Pssword Ative Diretory Configurtion Usernme defulttpipstk->dns onfigurtion Nme for this host sfo01w02esx01.sfo01.rinpole.lol sv-dominjoin_pssword sfo01w02esx01 sfo01w02esx02.sfo01.rinpole.lol sv-dominjoin_pssword sfo01w02esx02 sfo01w02esx03.sfo01.rinpole.lol sv-dominjoin_pssword sfo01w02esx03 sfo01w02esx04.sfo01.rinpole.lol sv-dominjoin_pssword sfo01w02esx04 ESXi Host Host virtul NIC sfo01-w02- vds01:sfo01-w02-vds01- mngement:mngement->ip ddress settings IPv4 ddress Host virtul NIC sfo01-w02- vds01:sfo01-w01-vds01- mngement:mngement->ip ddress settings SunetMsk sfo01w02esx01.sfo01.rinpole.lol sfo01w02esx02.sfo01.rinpole.lol sfo01w02esx03.sfo01.rinpole.lol sfo01w02esx04.sfo01.rinpole.lol ESXi Host Host virtul NIC sfo01-w02- vds01:sfo01-w02-vds01- vmotion:vmotion->ip ddress settings IPv4 ddress Host virtul NICsfo01-w02- vds01:sfo01-w02-vds01- vmotion:vmotion->ip ddress settings SunetMsk sfo01w02esx01.sfo01.rinpole.lol sfo01w02esx02.sfo01.rinpole.lol sfo01w02esx03.sfo01.rinpole.lol sfo01w02esx04.sfo01.rinpole.lol e Right-lik the sfo01-w02-shred01 luster nd selet Host Profiles > Export Host Customiztions. The Edit Host Customiztions wizrd ppers. f g In the Selet hosts dilog ox, selet ll ESXi hosts nd lik Next Clik Import Host Customiztions, nvigte to the sfo01-w02hpshred01_host_ustomiztions.sv file, lik Open, nd lik Finish. VMwre, In. 35

36 5 Remedite the ESXi hosts in the shred edge nd ompute luster. Nvigte to the Poliies nd Profiles view nd lik Host Profiles. Clik the sfo01-w02hp-shred01 host profile, lik the Monitor t, nd lik Chek Compline. The ompline test shows the first host s Complint nd the remining hosts s Not Complint. Clik Remedite, selet ll non-omplint ESXi hosts from the list nd lik Remedite. All hosts now hve Complint sttus in the Host Profile Compline olumn. 6 Remove the sfo01-w02hp-shred01 host profile from the shred edge nd ompute luster. You must remove the host profile euse Host Profiles re not omptile with NSX-T. In the Hosts nd Clusters inventory, right-lik the sfo01-w02-shred01 luster nd selet Host Profiles > Deth. In the Deth profile dilog ox lik Yes. Use the UMDS Shred Repository s the Downlod Soure in Updte Mnger Drft omment filepth: GUID-3E70B38D-4D6F-4F84-A FFC86F027.xml Configure Updte Mnger to use the vsphere Updte Mnger Downlod Servie (UMDS) shred repository s entrlized soure for downloding ESXi pthes, extensions, nd notifitions. 1 Log in to vcenter Server y using the vsphere Client. Open We rowser nd go to Log in using the following redentils. User nme Pssword dministrtor@vsphere.lol vsphere_dmin_pssword 2 From the Menu, selet Updte Mnger. 3 Selet sfo01w02v01.sfo01.rinpole.lol from the drop-down menu. 4 Clik s nd selet Administrtion s > Pth Setup. 5 Clik Chnge Downlod Soure nd selet Downlod pthes from UMDS shred repository. 6 In the Url text ox, enter nd lik Sve. VMwre, In. 36

37 7 Clik the Updtes t nd lik Downlod Now. A new tsk Downlod pth definitions with Completed sttus ppers in the Reent Tsks pne. VMwre, In. 37

38 Deploy the NSX-T Instne for the Shred Edge nd Compute Cluster 5 Drft omment filepth: GUID-20C1C4A2-534C-4294-B2E0-3DDADD xml NSX-T Mnger implements oth the mngement nd entrl ontrol plnes in n NSX-T system. For dynmi routing etween the tennt worklods in the domin, you deploy pir of NSX-T Edge nodes. NSX-T Mnger lso provides the user interfe nd REST APIs for reting, onfiguring, nd monitoring NSX-T omponents in worklod domin, suh s segments, gtewys, nd seurity poliies. For high vilility of the mngement nd ontrol plnes, you deploy luster of three NSX-T Mnger nodes. 1 Deploy the First NSX-T Mnger Appline To rete luster of NSX-T Mnger nodes, first you deploy one NSX-T Mnger ppline nd onfigure it. After you omplete the onfigurtion of the first node, you dd the other two nodes of the luster. 2 Import the CA-Signed Certifites for the NSX-T Mnger Cluster After you deploy the first NSX-T Mnger ppline nd you generte the ertifites for eh NSX- T Mnger node nd for the virtul IP ddress of the luster, import the ertifites in to the ppline y using the NSX-T Mnger user interfe. Lter, you reple the ertifite on eh node. 3 Reple the Certifite for the First NSX-T Mnger Appline After you deploy the first NSX-T Mnger ppline, reple its defult ertifite to estlish trusted onnetion with the mngement omponents in the SDDC. You reple the existing ertifites using the REST API of NSX-T Mnger. 4 Connet NSX-T Mnger to the vcenter Server Instnes Connet the first NSX-T Mnger ppline to the Compute vcenter Server for the worklod domin so tht tennt worklods n use NSX-T networking omponents nd to Mngement vcenter Server so tht you n ple the remining NSX-T Mnger nodes on the mngement luster lter. 5 Deploy the Remining Nodes of the NSX-T Mnger Cluster To strt implementing high vilility of NSX-T Mnger, deploy the remining two nodes of the NSX-T Mnger luster on the mngement luster. 6 Crete n Anti-Affinity Rule for the NSX-T Mnger Applines Crete VM-Host nti-ffinity rule to ensure tht the NSX-T Mnger virtul mhines run on different ESXi hosts. If n ESXi host is unville, the NSX-T Mnger virtul mhines on the other hosts ontinue to provide support for the NSX-T mngement nd ontrol plnes. VMwre, In. 38