Guide for Deploying a Software-Defined Data Center (SDDC) with Solutions from Lenovo, VMware, and Intel

Transcription

1 Guide for Deploying a Software-Defined Data Center (SDDC) with Solutions from Lenovo, VMware, and Intel Installation Guide Intel Builders Lenovo vsan ReadyNodes Deploying a Software-Defined Data Center (SDDC) with Solutions from Lenovo, VMware, and Intel A step-by-step guide for simplifying data center transformation by deploying VMware vsan and VMware NSX on Lenovo vsan ReadyNodes, powered by Intel technologies Table of Contents Overview Solution Installation Appendix A: Hardware Details Appendix B: Additional Resources Introduction Lenovo vsan ReadyNodes, powered by Intel technologies, can serve as the foundation for an easily supported software-defined data center (SDDC) solution that is simple to deploy. A Lenovo vsan ReadyNodes appliance combines industry-leading hyperconverged solutions from VMware with Lenovo s enterprise server platforms featuring Intel Xeon processors. This document provides guidance on setting up a small-scale, but fully functional, SDDC deployment that technical implementers can customize for their specific SDDC needs. This document will also pull design concepts from a VMware Validated Design (VVD) document to familiarize implementers with some of VMware s best practices for deploying an SDDC. This guide can serve as an introduction to details of SDDC deployments for IT decision makers who manage remote or multiple data center locations and who are tasked with scoping the complexity of implementing an SDDC deployment. Finally, this document can be used to configure a small SDDC implementation as a proof of concept or for evaluation purposes. The included setup instructions are optimized for the hardware described, but not for a particular workload. As a result, readers who complete the steps detailed in this document will have a fully functional SDDC deployment that demonstrates virtualized storage, networking, and compute on a small scale; readers can subsequently customize this deployment to meet their specific SDDC needs.

2 Table of Contents Introduction...1 Overview...3 Preconfigured Software...3 Installations and Configurations Covered in This Guide...3 Hardware Used in This Deployment...3 Assumptions...4 Exceptions to General Best Practices Employed in This Guide...5 Solution Installation...5 Connect to VMware vcenter...5 Create the Compute Cluster Object...6 Add the First VMware ESXi Host to the Compute Cluster Object...7 Create a Distributed Virtual Switch for VMware ESXi Management Traffic...9 Create the Main Distributed Virtual Switch and Distributed Virtual Port Groups for VM, VMware vsan, and VMware vsphere vmotion Traffic Migrating All Management Cluster Hosts and Compute Hosts to the Distributed Virtual Switch Enable NTP Service on the Compute Host Making a Host Profile for the Compute Cluster Configure VMware vsan on the Compute Cluster Connecting VMware vcenter to the Microsoft Active Directory* Directory Service Connecting VMware NSX Manager Virtual Appliance to a VMware vcenter Instance and Configuring SSO Apply the VMware NSX License Deploying VMware NSX Controller Nodes Add VMware vcenter Server Appliance to the Firewall Exclusion List Prepare Hosts for VMware NSX Configure VXLAN, Segment IDs, and Transport Zones Configure Logical Switches Create a Distributed Logical Router Create a VMware NSX Edge Services Gateway Appliance Configure Routing between the Distributed Logical Router and the VMware NSX Edge Services Gateway Deploy and Configure VMware vrealize Operations Manager Deploy the VMware vrealize Automation Virtual Appliance Connect to the vrealize Automation Virtual Appliance Deploy and Configure the IaaS Server Validate the IaaS Host Configuration and Configure Microsoft SQL Server* Software Finalize Installation of the vrealize Automation Virtual Appliance Create a New vrealize Automation Tenant Connect the vrealize Automation Tenant to Active Directory Add a VMware vcenter Endpoint to vrealize Automation and Configure the Fabric Group Add a VMware vrealize Orchestrator Endpoint to the vrealize Automation Tenant Configure Machine Prefixes and Groups Create Network Profiles and Reservations Adding Custom Branding to the vrealize Automation Environment Install vrealize Log Insight Configure vrealize Log Insight VMware vcenter Integration Configure vrealize Log Insight and vrealize Operations Integration Install vrealize Log Insight and VMware vsan Content Pack Install and Configure the Lenovo XClarity Administrator Virtual Appliance Install and Configure the Lenovo XClarity Integrator Appliance Configuring Lenovo XClarity Administrator and vrealize Log Insight Integration Configuring Lenovo XClarity Integrator, vrealize Automation, and vrealize Orchestration Integration Example Blueprint Deployment vrealize Automation and Microsoft SharePoint 2013* Portal Blueprint Appendix A: Hardware Details Appendix B: Additional Resources Lenovo Documentation and Help VMware Documentation and Help Intel Resources

3 Overview Lenovo SDDC infrastructure ships VMware vsan ready. Lenovo vsan ReadyNodes, powered by Intel technologies, are servers that have been pre-configured, tested, and certified for VMware hyper-converged infrastructure software. Lenovo vsan ReadyNodes, powered by Intel technologies, are configured for VMware vsan software with the required amount of CPU, memory, network, input/ output (I/O) controllers, and storage to support SDDC deployments. The SDDC infrastructure showcased in this guide is designed for simple host setup. However, you will still need to install and configure some components. Before you begin the step-by-step installation and configuration process, review the following sections detailing: The components that come preinstalled and preconfigured with Lenovo vsan ReadyNodes, powered by Intel technologies The installation and configuration steps that this guide will cover Hardware used in this deployment Assumptions made by this guide Exceptions to general best practices necessitated by the hardware used in this deployment Preconfigured Software Lenovo vsan ReadyNodes, powered by Intel technologies, ship with the following software components installed and preconfigured to manage the underlying SDDC stack: VMware ESXi 6.5 installed on all hosts BIOS settings configured for an SDDC environment on all hosts Static IP addresses defined on all hosts Integrated Management Module (IMM) configured with static assignments on all hosts VMware vcenter Server Appliance deployed to the management cluster VMware vsan preconfigured on the management cluster Switching infrastructure in place Installations and Configurations Covered in This Guide The first section of this installation guide describes the steps required to complete configuration of VMware vcenter 6.5. The rest of the guide covers installation of the following software: VMware NSX VMware vrealize Automation 7.2 VMware vrealize Log Insight VMware vrealize Operations Manager 6.5 Lenovo XClarity Administrator Lenovo XClarity Integrator for VMware vcenter Hardware Used in This Deployment This environment consists of three management nodes, three compute nodes, a top-of-rack switch, and a management switch. Key components include: Lenovo System x3550 M5 rack servers, powered by the Intel Xeon processor E v4 product family. The Intel Xeon processor family is ideal for SDDC deployments because it supports increased scalability, automation, and orchestration capabilities across compute, storage, and networking workloads. Built-in features also deliver performance based on workload demands, which helps improve resource utilization. The Intel Solid-State Drive (SSD) Data Center (DC) Family with Non-Volatile Memory Express* (NVMe*) is ideal for running demanding, simultaneous workloads, which can increase system utilization for greater responsiveness in the cache tier. In addition, the deployment used SanDisk* 3.84 TB-capacity optimized SSDs for the capacity tier. The Intel Ethernet Converged Network Adapter X710 family is designed to scale as bandwidth demands increase over time. These adapters also boost data center agility by supporting a high density of virtual machines (VMs) per server, and they provide the ability to consolidate existing hardware. Lenovo RackSwitch G8272 Network switch is a cost-effective, enterprise class 10/40 gigabit Ethernet (GbE) solution that provides 48 ports of 10 GbE SFP+ and 6 ports of 40 GbE QSFP connectivity, enterprise-class layer-2 and layer-3 functionality, and Lenovo s Cloud Network Operating System (CNOS) in an open, programmable cloud-scale software-defined Ethernet solution. For a complete list of hardware used in this guide, see Appendix A. 3

4 Solution Design Philosophy In keeping with the aims of this document to provide instructions on how to deploy a small-scale SDDC solution, the solution was designed with a number of key points in mind: 1. The solution should be as self-contained as possible, requiring minimal external resources to provide functionality. Therefore, this solution was designed as an SDDC evaluation pod containing all of the basic parts required to implement a small-scale SDDC environment. 2. The solution should be small enough that, for a minimal hardware and software licensing investment, one can deploy and evaluate a full-featured SDDC solution. To that end, the components were chosen so that one could implement this solution and still be able to evaluate the core components of VMware s SDDC solution and Lenovo s hardware and systems management stack. 3. The solution should be modular enough that, though small, it could scale to allow for implementing additional VMware SDDC components that are out of scope for this document. Assumptions While this guide strives to provide detailed installation and configuration guidance for this SDDC deployment, it is not intended to be exhaustive. This installation guide makes a number of assumptions about the reader s knowledge, IT environment, and software on hand. Reader Knowledge This installation guide assumes a baseline level of reader knowledge in order to follow the steps described. Skills assumed on the part of the reader include: 1. A basic knowledge of layer-2 and layer-3 networking 2. Familiarity with how to install and configure VMware ESXi and deploy the VMware vcenter Server Appliance 3. A pre-existing understanding of how to deploy the Windows Server 2012* operating system in a virtual environment IT Environment In order to follow the steps in this document, the installation guide assumes that readers have the following components in their environments: 1. A current Microsoft Active Directory* directory service deployment for authentication 2. A functioning Dynamic Host Configuration Protocol (DHCP) server 3. A Domain Name Server (DNS) with forward and reverse lookup services (either on premises or on the Internet) 4. A Network Time Protocol (NTP) server (either on premises or on the Internet) 5. Access to a network switch that supports q virtual LAN (VLAN) tagging Note: This guide includes specific settings that might differ from those in your environment. In all such cases, the guide highlights settings specific to the configuration used in this deployment. Software and Licenses on Hand This installation guide also assumes that readers have installation files and valid licenses for the following software: VMware ESXi 6.5 VMware vcenter 6.5 VMware vsan VMware vrealize Automation 7.2 VMware vrealize Log Insight VMware vrealize Operations Manager 6.5 VMware NSX 6.2 Lenovo XClarity Administrator Lenovo XClarity Integrator Lenovo Integrator for vrealize Automation 1.2 Lenovo Integrator for VMware vrealize Orchestrator Lenovo Integrator for vrealize Log Insight 1.2 Lenovo Networking Plug-in for vrealize Orchestrator Lenovo Networking Content Pack for VMware vrealize Log Insight 1.1 Microsoft SQL Server 2014 SP2* software (or any version from SQL Server 2012 or later) Windows Server 2012 R2 4

5 Exceptions to General Best Practices Employed in This Guide This deployment is meant to provide a hands-on demonstration of an SDDC. Though fully functional, it is not meant to serve as a production SDDC deployment, and, as such, it does not employ some best practices that should always be adhered to in production environments. As an example, best practices dictate implementing a VMware vsan cluster with at least four nodes per cluster. Principal exceptions to best practices in this deployment include: Not implementing high availability and disaster recovery/backup technologies Using virtual switches (vswitches) instead of exclusively using distributed virtual switches (to simplify the manageability of a self-contained VMware vcenter deployment) Deployment of VMware vcenter Server Appliance onto a node that it is managing Deploying a VMware vcenter Server Appliance into a VMware vsan cluster that has not yet been managed by VMware vcenter Using self-signed certificates Solution Installation The following sections describe how to deploy and configure VMware vcenter software. Connect to VMware vcenter This solution uses a management cluster that has been created and configured with a VMware vcenter Server Appliance already deployed; however, you will need to create the compute cluster. To do so, first connect to the VMware vcenter server: 1. In a web browser, navigate to the VMware vcenter Server Appliance IP address (or host name, if configured) and log on; in this example: Address: Username: administrator@lci.local Note: Settings in your environment will likely differ from these. Figure 1. VMware vsphere Web Client console As seen above, the ThinkAgile data center object was created to host the architecture for this guide. 5

6 Create the Compute Cluster Object Next, create the compute cluster and import the first node: 1. In the Navigator pane of the vsphere Web Client console, right-click the ThinkAgile data center object, and then select New Cluster. Figure 2. Adding a new cluster to an existing data center object in vsphere Web Client 2. Create a new cluster in the window with the settings detailed in Table 1 (leaving default values for anything not mentioned in Table 1). Table 1. Summary of settings and values to enter in the New Cluster dialog SETTING Name DRS Automation Level EVC VALUE SDDC-Compute ON Fully Automated Intel Broadwell Generation 6

7 Figure 3. The completed New Cluster dialog Note: Do not enable VMware vsan at this point; it will be added at a later stage. 3. Click OK to confirm the cluster details. The cluster will appear under the ThinkAgile data center object when the window closes. Add the First VMware ESXi Host to the Compute Cluster Object Next, add a compute node to the compute cluster you just created and configure that node so that it can be used to define a host profile for the other two compute nodes. 1. Right-click the SDDC-Compute Cluster object, and then select Add Host. 2. On the Name and location screen, enter the Fully Qualified Domain Name (FQDN) or IP Address of one of the compute nodes, and then click Next. Note: Based on the system configuration you are working with, your compute node s host name will differ from the one shown in Figure 4 and Table On the Connection settings screen, enter the user name root and the associated password, and then click Next. Note: If you are using the Lenovo custom VMware ESXi image, the default password is blank. Note: If you are prompted with a Security Alert window regarding the certificate of the host you are adding, click Yes to proceed to the next step. 4. On the Host summary screen, click Next. 5. On the Assign license screen, ensure a license is assigned to the host you are adding, and then click Next. 6. On the Lockdown mode screen, keep the default values and click Next. 7

8 7. On the Resource pool screen, keep the default values and click Next. 8. On the Ready to complete screen, use the default values, and then click Finish to complete adding the host to the cluster. Figure 4. The Ready to complete screen of the Add Host wizard 9. The host will be added to the cluster using either the host name or the IP address specified. Table 2 summarizes the options for this wizard. Table 2. Summary of sample settings and values entered in the New Host wizard SETTING FQDN or IP Address User name Password Lockdown mode VALUE X3550m5B-j10p5d.lci.lab Root password Disabled After you have added your first host to the compute cluster, you will then configure and capture a host profile to use later to deploy the same configuration to the other nodes in the compute cluster. 8

9 Create a Distributed Virtual Switch for VMware ESXi Management Traffic Next, set up distributed virtual switches to allow for efficient, centralized management of network traffic on the compute cluster. 1. From the vsphere Web Client Home menu, navigate to Networking. 2. Once in the networking tab, in the Navigator pane of the vsphere Web Client console, right-click the ThinkAgile data center object, and then select Distributed Switch > New Distributed Switch. Figure 5. Adding a new distributed virtual switch from the vsphere Web Client console a. On the Name and location screen, in the Name field, enter dvswitch-esxmgmt, and then click Next. b. On the Select version screen, select Distributed switch 6.5.0, and then click Next. c. One the Edit settings screen, in Number of uplinks, select 2, and then click Next. Note: This installation guide uses two uplinks because these systems use two of the four included 1 GbE links on the compute node hosts for VMware ESXi management. 9

10 d. On the Ready to complete screen, click Finish. Figure 6. Ready to complete screen of the New Distributed Switch wizard 3. To create a new distributed port group: a. In the vsphere Web Client console, from the Navigator pane, right-click on the distributed virtual switch that you created previously. b. In the New Distributed Port Group wizard, on the Select name and location screen, in the Name field, enter dvpg-esxmgmt, and then click Next. c. On the Configure settings screen, leave the default settings and click Next. d. On the Ready to complete screen, click Finish. Figure 7. Ready to complete screen of the New Distributed Port Group wizard 10

11 4. In the vsphere Web Client console, under the Networking tab, right-click dvswitch-esxmgmt, and then select Add and Manage Hosts. Figure 8. Adding a new host from the Navigator pane of the Networking section of the vsphere Web Client console a. In the Add and Manage Hosts wizard, on the Select task screen, select Add hosts. b. On the Select hosts screen, click New hosts (the large green plus sign). c. When the Select new hosts window opens, select the SDDC-Compute node that you previously added, and then click OK. Figure 9. Selecting a new host within the Add and Manage Hosts wizard 11

12 d. After the window closes, in the Add and Manage Hosts wizard, click Next. Figure 10. Example of a new host selected within the Add and Manage Hosts wizard e. On the Select network adapter tasks screen, select Manage physical adapters and Manage VMkernel adapters, and then click Next. f. On the Manage physical network adapters screen, assign the VM network interface controllers (NICs) to uplinks on the distributed virtual switch: i. Select vmnic0, and then click Assign uplink. Note: The vmnics in your environment might be enumerated in a different order from what is shown in Figure 11. It is important that you note the numeric assignments and the throughput of the NICs on your hardware. Figure 11. Selecting a vmnic for assignment to an uplink in the Add and Manage Hosts wizard 12

13 ii. In the Select an Uplink for vmnic0 window, select Uplink 1, and then click OK. Figure 12. Pairing vmnic0 to Uplink 1 in the Add and Manage Hosts wizard iii. Repeat this process for vmnic1, assigning it to Uplink 2. iv. After both vmnics are assigned to uplinks, click Next. Figure 13. Both vmnics assigned to their appropriate uplink in the Add and Manage Hosts wizard 13

14 g. On the Manage VMkernel network adapters screen, select vmk0, and then click Assign port group. Figure 14. Selecting a VMkernel for assignment to a port group in the Add and Manage Hosts wizard i. In the Assign destination port group window, select dvpg-esxmgmt, and then click OK. Figure 15. Assigning VMkernel vmk0 to the dvpg-esxmgmt port group in the Add and Manage Hosts wizard 14

15 ii. After the window closes, on the Manage VMkernel network adapters screen, click Next. Figure 16. vmk0 successfully assigned to dvpg-esxmgmt in the Add and Manage Hosts wizard h. On the Analyze impact screen, click Next. i. On the Ready to complete screen, click Finish. Note: The vswitch will now be transitioned over to a distributed virtual switch for management network traffic. Because VMware vcenter is running on a single VM on the management cluster, it is simpler architecturally to recover the management capability of the nodes in that cluster using the pre-existing vswitches. In the event of a loss of communication with VMware vcenter, the vswitches enable restarting the management nodes. 15

16 Create the Main Distributed Virtual Switch and Distributed Virtual Port Groups for VM, VMware vsan, and VMware vsphere vmotion Traffic Now create the second distributed virtual switch. This one will handle the main VM, VMware vsan, and VMware vsphere vmotion traffic types. This installation guide uses a separate distributed virtual switch because VMware vcenter is hosted on a single VM; the management cluster uses the built-in vswitch for simplified manageability in a minimized deployment. 1. In the vsphere Web Client console, from the Navigator pane, right-click the ThinkAgile data center object, and then select Distributed Switch > New Distributed Switch. Figure 17. Adding a new distributed switch from the Navigator pane of the Networking section of the vsphere Web Client console a. In the New Distributed Switch wizard, on the Name and Location screen, in the Name field, enter dvswitch-sddc, and then click Next. b. On the Select Version screen, select Distributed Switch: 6.5.0, and then click Next. c. On the Edit Settings screen, in the Number of uplinks field, select 4, and then click Next. Note: This setting will provide one uplink for each 10 GbE port on the hosts. 16

17 d. On the Ready to complete screen, click Finish. Figure 18. Summary of the distributed switch settings for dvswitch-sddc in the New Distributed Switch wizard 2. In the vsphere Web Client console, from the Navigator pane, right-click dvswitch-sddc, and then select Distributed Port Group > New Distributed Port Group. Figure 19. Adding a new distributed port group from the Navigator pane of the Networking section of the vsphere Web Client console a. In the New Distributed Port Group wizard, on the Select name and location screen, in the Name field, enter dvpg-vmotion, and then click Next. b. On the Configure settings screen, select VLAN for VLAN type, and then select the appropriate VLAN ID (this example uses VLAN 610). c. Click Next. 17

18 d. On the Ready to complete screen, click Finish. Figure 20. Summary of the distributed port group settings for dvpg-vmotion in the New Distributed Switch wizard 3. Complete the instructions in step 2 (above) five more times to make additional distributed virtual port groups with the settings given in Table 3. Table 3. Summary of settings for additional distributed virtual port groups DISTRIBUTED VIRTUAL PORT GROUP NAME VLAN ID dvpg-vsan-mgmt 900 dvpg-vsan-compute 612 dvpg-vm-mgmt <blank, (native VLAN)> dvpg-vm-compute 614 dvpg-public <blank, (native VLAN)> Note: Because the management and public port groups use the native VLAN, they are assigned the default VLAN ID (in this example, 600). Migrating All Management Cluster Hosts and Compute Hosts to the Distributed Virtual Switch You now need to migrate all of the hosts to the distributed virtual switch you created to handle VM, vsan, and vmotion traffic (in this deployment, dvswitch-sddc). Add Hosts to the Distributed Virtual Switch 1. In the vsphere Web Client, navigate to the Home menu, and then navigate to Networking. 18

19 2. In the Navigator pane, right-click dvswitch-sddc, and then select Add and Manage Hosts. Figure 21. Adding a host to the distributed virtual switch 3. In the Add and Manage Hosts wizard, on the Select task screen, select Add hosts. 4. In the Select new hosts window, add all four current hosts in the environment (all three management hosts and the compute host), and then click OK. Figure 22. Adding hosts (the existing four nodes) to the distributed virtual switch Note: By performing this migration on the single compute host now, all settings will propagate to the new compute hosts through the host profile you will create later. 5. After the Select new hosts dialog box closes, on the Select hosts screen, click Next. 19

20 6. On the Select network adapter tasks screen, select Manage physical adapters and Manage VMkernel adapters from task list, and then click Next. Figure 23. Selecting network adapter tasks in the Add and Manage Hosts wizard Map vmnics to Physical Network Adapters You will now need to map the vmnics to physical NICs. 1. On the Manage physical network adapters screen, you will manually assign vmnics 4 7 to distributed virtual switch uplinks 1 4 on each of the four hosts (a total of 16 operations). a. For each host in the Host/Physical Network Adapters list, select a vmnic (starting with vmnic 4), and then click Assign uplink. b. In the Select an Uplink window, select the appropriate uplink to map to the vmnic, and then click OK. Note: While you can assign uplinks to vmnics in any order, Figure 24 shows this process completed for the uplinks in sequential order. c. When you have completed mapping each of the 16 vmnics to their appropriate uplinks, click Finish. 20

21 Figure 24. Assigning vmnics to uplinks in the Add and Manage Hosts wizard Note: In the example configuration used in this guide, these vmnics correspond to the 10 GbE Intel Ethernet Converged Network Adapters. 2. On the Manage VMkernel network adapters screen, for each of the three hosts in the management cluster, migrate the existing management cluster VMware vsan VMkernel to the distributed virtual port group that you created (in this example configuration, this is dvpg-vsan-mgmt). a. For each host in turn, select the vsan VMkernel (in this this deployment, vmk2 on each server) and click Assign port group. Figure 25. Assigning VMware vsan VMkernels to the management vsan distributed virtual port group b. In the Assign destination port group window, select the vsan management distributed virtual port group (in this example configuration, this is dvpg-vsan-mgmt), and then click OK. 21

22 3. Next, create VMware vsphere vmotion networking. Note: You will perform this process a total of four times, once for each of the three management nodes and once for the compute node, which you will later use to create the host profile. a. Begin this process by selecting the first management node (in this example, x3550m5b-j10ky3b.lci.lab) and clicking New adapter. b. In the Add Networking wizard for the selected node, on the Select target device screen, select Select an existing network, and then click Browse. c. Choose dvpg-vmotion, and then click Next. Figure 26. dvpg-vmotion network for the first node d. On the Port properties screen, in the Enabled services list, select vmotion, and then click Next. e. On the IPv4 settings screen, select Use static IPv4 settings, enter the appropriate values from Table 4, and then click Next. Table 4. Sample IPv4 settings for the distributed virtual port group VMware vsphere vmotion network IPV4 SETTING VALUE IPv4 address Subnet mask f. On the Ready to complete screen, click Finish. 4. Add VMkernel adapters to the remaining three hosts the two remaining management nodes and the compute node using the procedure in step 3 (above) with the configuration parameters laid out in Table 5, and then click Finish. 22

23 Table 5. Sample VMkernel configuration parameters for the remaining three hosts (two management and one compute) HOST PORT GROUP TRAFFIC TYPES IPV4 ADDRESS NETWORK MASK Management 2 dvpg-vmotion vmotion Management 3 dvpg-vmotion vmotion Compute 1 dvpg-vmotion vmotion Next, create networking for VMware vsan on the single compute host. Do so according to the method detailed in step 3 (above) and using the settings shown in Table 6. Note: Because the compute node requires both VMware vsan and VMware vsphere vmotion network traffic, be careful to select the correct Traffic Type in this step. Table 6. VMkernel configuration parameters for the remaining three hosts (two management and one compute) HOST PORT GROUP TRAFFIC TYPES IPV4 ADDRESS NETWORK MASK Compute 1 dvpg-vsan-compute VSAN DHCP Not applicable Warning: Check your configuration carefully before proceeding, especially the VMware vsan configuration on the management nodes. If the configuration is not done correctly, the management hosts could become isolated and would then require recovery using IMM! When complete, the configuration for the VMkernel adapters should align with the values in Table 7. Note: Values in red in Table 7 refer to settings from the configuration summary that you do not change. You do not migrate vswitch0 due to the self-hosted design of the environment. 23

24 Table 7. Summary VMkernel adapter settings for all four nodes (three management and one compute) HOST/VMKERNEL ADAPTER IN USE BY SWITCH SOURCE PORT GROUP DESTINATION PORT GROUP X3550m5b-j10ky3b.lci.lab vmk2 vswitch-vsan PG-vSwitch-VSAN dvpg-vsan-mgmt vmk1 (new) dvswitch-sddc dvpg-vmotion vmk0 vswitch0 Management Network Do not migrate X3550m5b-j10ky3c.lci.lab vmk2 vswitch-vsan PG-vSwitch-VSAN dvpg-vsan-mgmt vmk1 (new) dvswitch-sddc dvpg-vmotion vmk0 vswitch0 Management Network Do not migrate X3550m5b-j10ky3d.lci.lab vmk2 vswitch-vsan PG-vSwitch-VSAN dvpg-vsan-mgmt vmk1 (new) dvswitch-sddc dvpg-vmotion vmk0 vswitch0 Management Network Do not migrate X3550m5b-j10vp5d3b.lci.lab vmk1 (new) dvswitch-sddc dvpg-vmotion vmk2 dvswitch-sddc dvpg-vsan-compute vmk0 dvswitch-esxmgmt dvpg-esxmgmt Do not migrate 6. In the Add and Manage Hosts wizard, on the Analyze impact screen, click Next. 7. On the Ready to complete screen, click Finish. 8. Once the distributed virtual switch has been created, right-click the distributed virtual switch, and then select Edit > Edit Settings. 9. From the menu on the left, select Advanced, change the MTU value to 9000, enable IGMP Snooping, and then click OK to confirm. Note: If your network does not have jumbo frames enabled, you will need to leave the MTU value at All subsequent MTU values in this guide will also have to be 1600 to accommodate your network. Distributed virtual switches are now configured. Enable NTP Service on the Compute Host To ensure time synchronization for VMware NSX, enable the NTP client on the compute host. 1. From the vsphere Web Client Home menu, navigate to Hosts and Clusters. 2. In the Navigator pane, select the compute host. 3. In the middle pane, select the Configure tab. 4. Scroll down; under System, select Time Configuration. 5. In the top-right of the central pane, click Edit. 24

25 6. In the Edit Time Configuration window: a. Select Use Network Time Protocol. b. Beside NTP Service Status, click Start. c. From Startup Policy, select Start and stop with host. d. In the NTP Server field, enter the IP address or addresses of the NTP host(s) on the network. e. Click OK. Figure 27. Edit the Time Configuration window with deployment-specific information 25

26 Making a Host Profile for the Compute Cluster With one of the compute cluster hosts set up in the configuration desired for the others, you can create a host profile to apply the configuration to the other nodes. After creating the host profile, you will import the remaining compute hosts and apply the profile to all three. 1. From the Home menu of the vsphere Web Client, navigate to Hosts and Clusters. Extract the Host Profile 2. In the Navigator pane, right-click the sole compute node (in this example configuration, x3550c5b-j10vp5d.ici.lab), and then select Host Profiles > Extract Host Profile. Figure 28. Extracting host profiles a. In the Extract Host Profile wizard, on the Name and Description screen, in the Name field, enter SDDC-Compute- HostProfile, and then click Next. b. On the Ready to complete screen, click Finish. 26

27 Remove Storage Configuration from the Host Profile Because you will configure VMware vsan manually, you must remove it so that it will not be included in the host profile. 3. From the Home menu of the vsphere Web Client, navigate to Policies and Profiles. Figure 29. Navigating to Policies and Profiles from the vsphere Web Client Home menu 4. In the Navigator pane, select Host Profiles. Figure 30. Selecting host profiles 27

28 5. In the Objects tab, right-click SDDC-Compute-HostProfile, and then select Edit Settings. a. In the Edit Host Profile wizard, press Next to advance to the Edit host profile screen. b. On the Edit host profile screen, clear the check box for Storage configuration, and then click Finish. Figure 31. Detail of deselecting the storage configuration from the host profile Import the Remaining Compute Hosts into the Cluster 6. From the Home menu of the vsphere Web Client, navigate to Hosts and Clusters. 7. In the Navigator pane, right-click the compute cluster (in this example configuration, SDDC-Compute), and then select Add Host. a. In the Add Host wizard, on the Name and location screen, in the Host name or IP address field, enter the name of the compute node (in this example, x3550c5b-j10vp5d.lci.lab), and then click Next. b. On the Ready to complete screen, click Finish. c. Repeat the procedure in steps 7a and 7b to import the remaining compute cluster VMware ESXi servers using the host name, user name, and password you ve assigned. (Otherwise, use the default options.) Attach Unconfigured Hosts to the Profile 8. From the Home menu of the vsphere Web Client, navigate to Policies and Profiles. 9. In the Navigator pane, select Host Profiles. 10. In the Objects tab of the Host Profiles pane, select the SDDC-Compute HostProfile Host Profile. 28

29 11. Click Select Attach/Detach Hosts. a. In the SDDC-Compute-HostProfile - Attach/Detach Hosts and Clusters wizard, on the Select hosts/cluster screen, select the compute node (SDDC-Compute in this example), click Attach, then click Next. b. On the Customize hosts screen, right-click any column header, and then select Show/Hide Columns. Figure 32. Editing column names on the Customize hosts screen c. In order to make adding the IP address and netmask information to remaining hosts easier, customize this screen. Select the Host property, clear the check box for the Required property, and then click OK. Figure 33. Show the host name in order to more easily finish customizing host information for attached hosts 29

30 d. In the Value column, add the IP address and netmask information to remaining hosts such that all hosts have IP addresses for both management and VMware vsphere vmotion VMkernels. e. Click Finish. Update Hosts via Remediation 12. In the Objects tab of the Host Profiles pane, click Check Hosts. 13. Wait for the results to be collected. Note: This process can take several minutes. 14. The Not Compliant Hosts column should indicate that all three hosts are non-compliant. 15. Right-click the host profile line item (in this example configuration, SDDC-Compute-HostProfile), and then select Remediate. Figure 34. Opening the host-remediation wizard a. In the Remediate Hosts Based on Host Profiles wizard, on the Select hosts screen, select all three compute cluster hosts, and then click Next. Figure 35. Host selection for remediation 30

31 b. On the Ready to complete screen, click Pre-check Remediation. Note: This process will check for remediation issues on the selected hosts. Some of the nodes will be put in maintenance mode and rebooted after remediation. c. Leave the Reboot hosts which require it option selected, and then click Finish. 16. Wait for configurations to apply and all reboots to complete. 17. All hosts are now compliant and have the same configuration as the original host. Figure 36. Confirmation that the remediated hosts now have the same configuration as the original host for the profile Configure VMware vsan on the Compute Cluster 1. From the vsphere Web Client Home menu, select Hosts and Clusters. 2. In the Navigator pane, select Compute Cluster. 3. In the central pane, select the Configure tab. 4. Under the Virtual SAN task group, select General, and then click the Configure button in the top right. Figure 37. Configure button for the virtual SAN 31

32 a. In the Configure Virtual SAN wizard, on the Virtual SAN capabilities screen, perform the following actions: i. In the Add disks to storage drop-down menu, select Manual. ii. Under Deduplication and Compression, select Enable. iii. Click Next. b. On the Network validation screen, verify that the VMkernel adapters are correctly addressed from dvpg-vsan-compute, which you previously created, and then click Next. c. On the Claim disks screen, change the sorting method in the Group by drop-down menu to Host. d. For each host, set the disk-tier values in the Claim For column to correspond with the VMware vsan configuration you desire. Note: In this example deployment, which uses an all-flash configuration, only one of the high-performance solid-state drives (SSDs) is selected for Cache, and the rest are set to Capacity. For additional guidance on disk-tiering, refer to the VMware vsan Design and Sizing Guide at To assign a particular disk s tier, click the line item for that disk, and then select Cache, Capacity, or Not Claimed from the drop-down menu in the Claim For column. Click Next when you are done. Figure 38. Assigning physical disks to disk tiers in the Configure Virtual SAN wizard e. On the Ready to complete screen, click Finish to complete the VMware vsan configuration. f. From the vsphere Web Client Home menu, navigate to Storage. 32

33 g. In the Navigator pane, under the ThinkAgile data center object, right-click the newly created vsandatastore object, and then select Rename. Figure 39. Renaming the VMware vsan data store h. In the Rename dialog box, enter a meaningful name for the data store, and then click OK. Note: This example deployment uses the name vsandatastore-compute. i. From the Navigator pane, select the renamed VMware vsan data store, and then select the Configure tab in the central pane. j. Select Device Backing, and then confirm that the disk configuration is as you expected. 33

34 Connecting VMware vcenter to the Microsoft Active Directory* Directory Service Next, you will connect VMware vcenter to Active Directory so that you can use Active Directory user accounts for authentication. Note: Using Active Directory for user accounts is not necessary, but it does make management simpler, and it allows users to make use of existing security groups in their organizations. 1. From the vsphere Web Client Home menu, navigate to Administration. Figure 40. Navigating to the Administration screen from the vsphere Web Client Home menu 2. In the Navigator pane, under the Deployment task group, select System Configuration Figure 41. The System Configuration screen accessed from the Deployment task group Connect the Management Cluster to Active Directory 3. On the System Configuration screen, select Nodes in the Navigator pane, and then select the configured node (in the configuration example in this guide, this is lci-sddc-vcsa.lci.lab). 34

35 4. After you have selected the node (in this case, the vcenter Server Appliance), from the middle pane, navigate to the Manage tab, and then, under the Settings task group, select Active Directory. Click Join at the top right of the middle pane. Figure 42. The Join button for a node Note: This example deploys VMware vcenter Server Appliance with an embedded Platform Services Controller (PSC). If you are running an external PSC in your environment, you would need to select the node hosting PSC. a. Enter the details necessary to connect to your Active Directory domain: Domain Name Organizational unit User name Password b. Once you have entered the connection details, click OK. 5. Once the settings have been applied, you will need to reboot the node for the changes to take effect. From the toolbar at the top of the window, click the Reboot node button. Clicking the Reboot node button opens the Reboot dialog box, which warns you that doing so will cause you to temporarily lose contact with VMware vcenter. Additionally, the Reboot dialog will require you to enter a reason for the restart. In this case, simply enter something like Joining to Active Directory, and then click OK. Figure 43. Dialog box with warning and record of reason for rebooting a node in order to join it to Active Directory 35

36 Note: This process should take a few minutes. When the reboot has completed, reconnect to the vsphere Web Client. In the case of this example configuration, the host name is 6. Once you are able to reconnect to the host, return to the Administration > Deployment > System Configuration page, and then reselect the node (which will return you to the page you were on before the reboot). Notice that the Domain field lists the domain to which you joined the machine. Figure 44. Node-configuration page documenting that the node is now joined to Active Directory Add Active Directory as an Identity Source 7. Now that VMware vcenter is joined to Active Directory, you can configure VMware vcenter to use Active Directory user accounts. From the vsphere Web Client Home menu, navigate to Administration. 8. In the Navigator pane, under the Single Sign On task group, select Configuration. 9. In the SSO Configuration for [node] pane (middle of the screen), select the Identity Sources tab, and then click the plus (+) button. a. In the Add identity source wizard, on the Select Identity Source Type screen, select Active Directory (Integrated Windows Authentication), and then click Next. b. On the Configure identity source page, the domain name should be pre-populated for you; if it is not, enter the domain name required. Select Use machine account, and then click Next. c. On the Ready to Complete screen, click Finish. Note: You will notice that your domain has now been added to the list of identity sources. 10. Finally, now that you have added your Active Directory domain as an identity source, you can associate user accounts to this deployment and assign them roles (such as users and administrators). Naturally, you can use any group or user accounts you wish for this step, but this example will demonstrate how to grant administrative privileges to an Active Directory group. 36

37 Add an Active Directory User as an Administrator 11. From the vsphere Web Client Home menu, select Administration. 12. In the Navigator pane, under the Single Sign-On task group, select Users and Groups. 13. In the vcenter Users and Groups pane in the middle of the screen, select the Groups tab, and then select Administrators. Figure 45. Current members of the Administrators group for a domain in Active Directory 14. In the Group Members pane at the bottom of the screen, note the administrator user already present. Click the Add Member button to add a new user or group account to the Administrators group. a. In the Add Principals window, select the domain to which you have connected VMware vcenter from the Domain drop-down menu. b. In the Users and Groups section, search and select the users or groups you want to add to the Administrators group, then click Add for each entry. c. When you are done adding users and groups, click OK. Figure 46. Adding members to the domain administrators group 37

38 The Active Directory users or groups will now be listed under the Group Members for Administrators. Figure 47. Updated domain administrators group membership Note: To test that the process is working, close your current vsphere Web Client window and attempt a log on using the newly added administrators member. Installing the VMware NSX Manager Virtual Appliance In this section, you will configure VMware NSX. To do so, you need to first deploy the VMware NSX Manager virtual appliance on the management cluster. 1. From the vsphere Web Client Home menu, select Hosts and Clusters. 2. To begin installing the NSX Manager virtual appliance, in the Navigator pane, right-click the SDDC-Mgmt cluster, and then select Deploy OVF Template. a. In the Deploy OVF Template wizard, on the Select template screen, select Local file, click Browse to locate the VMware NSX.ova file needed to deploy the template, and then click Next. Note: You can deploy either OVF (Open Virtualization Format) or OVA (open virtualization appliance) files here. The primary difference between the two file types is that the OVF is a package containing a manifest, description, and VM-state files (such as VMDK files) for a virtual appliance, whereas OVA is simply a single-file distribution of a virtual appliance in TAR file format. Because this example configuration uses an OVA file, it supplies some configuration information to vsphere that would normally already be encapsulated in an OVF file. b. On the Select name and location screen, in the Name field, enter a name for the virtual appliance, select the data center object to which to deploy it, and then click Next. Note: This example deployment uses the ThinkAgile data center object and the name SDDC-NSX-Manager for the virtual appliance. c. On the Select a resource screen, select the management cluster (SDDC-Mgmt in this example), and then click Next. d. On the Review details screen, click Next. e. On the Accept license agreements screen, click Accept, and then click Next. f. On the Select storage screen, verify that the vsandatastore-mgmt data store is selected, and then click Next. g. On the Select networks screen, select the port group that you previously created (dvpg-vm-mgmt in this example), and then click Next. h. On the Customize template screen, various values must be configured before deploying the virtual appliance. Refer to Table 8 for guidance on entering these values, and enter them in accordance with your environment if there are differences. 38

39 Table 8. Sample OVA file template customization values for the SDDC-NSX-Manager virtual appliance PROPERTY VALUE DNS Server List , Domain Search List lci.local, lci.lab Default IPv4 Gateway Host name sddc-nsx-mgr Network 1 IPv4 Address Network 1 Netmask NTP Server List CLI Admin User Password CLI Privilege Mode Password secure password secure password i. Click Next when you have entered all the required properties. j. From the Ready to complete screen, click Finish, and then wait for the VM to be instantiated. Connecting VMware NSX Manager Virtual Appliance to a VMware vcenter Instance and Configuring SSO Now you will connect the VMware NSX Manager virtual appliance and configure single sign-on (SSO). SSO will enable use of VMware NSX Manager directly from the vsphere Web Client console rather than having to switch between interfaces. Connect VMware NSX Manager to VMware vcenter 1. From the vsphere Web Client Home menu, navigate to Hosts and Clusters. 2. In the Navigator pane, under the Management cluster (in this example, SDDC-Mgmt), you should now see the new VMware NSX Manager virtual machine. Right-click that VM (in this example, SDDC-NSX-Manager), and then click the Power On button at the top of the central pane in order to start the VM. Figure 48. Turning on the VMware NSX Manager virtual machine 39

40 3. In a web browser, navigate to the host name you specified when you deployed the VM. 4. Log on using the user name admin and the password you specified at the time of deployment, and then click Login. Note: In this example, the host name is Figure 49. Logon screen for VMware NSX Manager 5. From the VMware NSX Manager home screen, select Manage vcenter Registration. Figure 50. Navigating to Manage vcenter Registration from the VMware NSX Manager home screen 40

41 6. In the vcenter Server subsection of the NSX Management Service, click the Edit button on the right. Figure 51. Navigating to edit the VMware vcenter Server information for registration 7. In the vcenter Server window, enter the VMware vcenter Server, User Name, and Password. The values used in this example deployment are as follows: VMware vcenter Server: lci-sddc-vcsa.lci.lab User Name: Password: password 8. Click OK to proceed. 9. On the Trust Certificate? prompt, click Yes. 10. After connecting to the VMware vcenter Server, log off, and then log back on to the vsphere Web Client. 11. After logging back on to the VMware vcenter Server, the Networking and Security menu item will be present in the Inventories subsection of the Home tab, verifying that you successfully connected VMware NSX Manager to VMware vcenter. Figure 52. Confirmation that VMware vcenter registered with VMware NSX Manager Note: You can also check the status of the VMware vcenter registration from the page where you entered the connection details in the VMware NSX Manager NSX Management Service screen. 41

42 Configure SSO 12. Next, to configure VMware NSX Manager for SSO, log on to the VMware NSX Manager web user interface (UI) using the previously used address or host name, and on the VMware NSX Manager home page select Manage vcenter Registration. Note: Before completing this step, it is important to have completed the NTP service enablement on the compute host. 13. In the Lookup Service URL subsection, under NSX Management Service, click Edit. Figure 53. Navigating to edit the Lookup Service information for SSO 14. In the Lookup Service URL window, enter the details corresponding to your configuration. This example deployment uses the following values: Lookup Service Host: lci-sddc-vcsa.lci.lab Lookup Service Port: 443 SSO Administrator User Name: Password: password 15. Click OK. 16. When prompted to trust the VMware vcenter Server Appliance server s Secure Sockets Layer (SSL) certificate, click Yes. 17. If you are using a self-signed certificate, you might encounter a message at this point stating that the initialization of the Admin Registration Service Provider failed (Root Cause: Invalid Credentials). If you encounter this screen, simply click Yes twice to proceed (this error message will open once again after you click Yes the first time). Figure 54. Warning message for self-signing certificates 42

43 18. The Lookup Service should now be connected, and the status in the VMware NSX Management Service window will show Connected. Figure 55. Confirmation screen showing that the Lookup Service is connected to VMware NSX Manager for SSO Apply the VMware NSX License Next, apply your VMware NSX license to the deployment. This is a necessary prerequisite to deploying the controller nodes. Add the License 1. Navigate to the vsphere Web Client and log on using any administrator-level account. 2. From the vsphere Web Client Home menu, select Administration. 3. In the Navigator pane, under the Licensing task group, select Licenses. 4. In the central pane, click the plus (+) button in the toolbar to create a new license. 5. In the New Licenses wizard, on the Enter license keys screen, copy and paste a valid NSX license key, and then click Next. 6. On the Edit license names screen, enter a meaningful name for the license, such as NSX 6 License 16 CPU, and then click Next. 7. On the Ready to complete screen, click Finish to close the wizard and complete adding the new license. You will now see the new license and the name you applied to it earlier in the main window with a small grey! icon overlaying the certificate icon. This indicates that you need to assign the license. 43

44 Apply the License 8. Navigate to the Assets tab in the Licenses pane, and then click Solutions. You should see NSX for vsphere listed using the default NSX for vshield Endpoint (CPUs) license. 9. Right-click the NSX for vsphere line item, and then select Assign License. Figure 56. Assigning a license to an instance of VMware NSX 10. In the Assign License window, select the license you just added, and then click OK. The VMware NSX license is now applied. Deploying VMware NSX Controller Nodes In this section, you will deploy the VMware NSX Controller nodes. VMware NSX Controller nodes provide control-plane functions for VMware NSX logical switching and routing functions. Because they serve as the central control point for all logical switches within a network, VMware NSX Controller nodes are necessary to deploy distributed logical routers, which you will do later in this guide. Note: No matter the size of the VMware NSX deployment, VMware requires that each VMware NSX Controller cluster contain three controller nodes, so you will deploy a total of three controller nodes. (Having a different number of controller nodes is not supported.) 44

45 1. From the vsphere Web Client Home menu, select Networking & Security. Figure 57. Navigating to Networking & Security from the vsphere Web Client Home menu 2. In the Navigator pane, select Installation. In the central pane, under the Management tab, in the NSX Managers section, you should see VMware NSX Manager connected to your VMware vcenter server. 3. In the NSX Controller nodes section, click the plus (+) button. 4. In the Add Controller window, add settings for the first VMware NSX controller node. Settings for the deployment documented in this guide are given in Tables 9 and 10. Table 9. Summary of settings for the first VMware NSX Controller node for this deployment FIELD Name NSX Manager Datacenter Cluster/Resource Pool Datastore Host Folder Connected To SETTING sddc-nsx-ctrl1 prepopulated ThinkAgile SDDC-Mgmt vsandatastore-mgmt x3550m5b-j10ky3d.lci.lab SDDC-Infrastructure dvpg-vm-mgmt IP Pool Click Select, and then click New IP Pool; use the settings given in Table 10. Password password 45

46 Table 10. Summary of static IP pool settings used for the VMware NSX Controller nodes in this deployment FIELD Name SETTING nsx-controllers Gateway Prefix Length 22 Primary DNS Secondary DNS DNS Suffix lci.local, lci.lab Static IP Pool Note: The static IP pool needs to contain three IP addresses: one for each VMware NSX Controller node. Figure 58. Overview of settings for the first VMware NSX Controller node for this deployment 5. In the Add Static IP Pool window, click OK. 6. In the Select IP Pool window, select nsx-controllers, and then click OK. 7. In the Add Controller window, click OK to begin the deployment of the first controller node. 8. After the first node has successfully completed deploying, deploy two other nodes using the IP Pool created above. In this example, the final configuration is given in Table 11. Table 11. Summary of VMware NSX Controller IP addresses for this deployment HOST NAME IP Address sddc-nsx-ctrl sddc-nsx-ctrl sddc-nsx-ctrl Note: All VMware NSX configurations must contain three controller nodes in order to operate. 46

47 9. After all three nodes have been deployed, they will be listed in the NSX Controller Nodes section of the central pane of the vsphere Web Client with two peers each. Figure 59. VMware NSX Controller nodes with peer-nodes displayed Note: Getting the deployed nodes to display might require you to refresh your browser. Add VMware vcenter Server Appliance to the Firewall Exclusion List Next, add the VMware vcenter Server Appliance to the VMware NSX Manager exclusion list. This is to avoid any firewall issues for VMware NSX. 1. From the vsphere Web Client Home menu, select Networking & Security. 2. In the Navigator pane, under the Networking & Security Inventory task group, select NSX Managers. 3. In the Navigator pane, from the list of NSX Managers displayed, select the IP address of your VMware NSX Manager. 4. In the central pane, select the Manage tab, and then select Exclusion List from the tab menu at the top of the pane. 5. Click the plus (+) button to add an exclusion. 6. In the Virtual Machine Selector window, select the VMware vcenter Server Appliance from the Available Objects list, and then move it to the Selected Objects list using the right-arrow button. Click OK. 7. The VMware vcenter Server Appliance will now be present in the Exclusion List. Figure 60. The VMware vcenter Server Appliance successfully added to the virtual machine exclusion list 47

48 Prepare Hosts for VMware NSX Next, prepare all the participating hosts for VMware NSX networking usage by installing agents on the cluster nodes. 1. From the vsphere Web Client Home menu, select Networking & Security. 2. From the Navigator pane, under the Networking & Security task group, select Installation. 3. In the central pane, select the Host Preparation tab. Note: Both your management and compute clusters should be listed with an Installation Status of Not Installed. 4. Select the management cluster (in this example, SDDC-Mgmt). 5. Click the Actions toolbar above the list of clusters, and then select Install. Figure 61. Actions > Install highlighted in the VMware NSX installation interface 6. When the Install dialog box opens asking if you want to continue with the install, click Yes. Note: This will enable installation of the VMware NSX agent on all hosts in this cluster. This process could take several minutes. 7. Repeat the same process detailed in steps 4 6 with your compute cluster (in this example, SDDC-Compute). Note: Once VMware NSX agent installation is complete for all hosts, the host preparation is completed. Configure VXLAN, Segment IDs, and Transport Zones Next, you need to configure the Virtual Extensible LAN (VXLAN) and assign IP addresses to the Virtual Tunnel Endpoints (VTEP) for VMware NSX traffic. Like a transparent bridge in other networking contexts, VTEP composes a forwarding table in order to ensure that network-traffic frames arrive at the correct VMs. In this section you will populate the VTEP forwarding table with the necessary IP addresses and configure the VXLAN to send frames across the logical network segments. 1. From the vsphere Web Client Home menu, select Networking & Security. 2. From the Navigator pane, under the Networking & Security task group, select Installation. 3. In the central pane, select the Host Preparation tab. Configure VXLAN 4. In the central pane, in the VXLAN column and the row for the management cluster (in this example, SDDC-Mgmt), click Not Configured. Note: This will begin the VXLAN configuration. 48

49 5. Enter options for the management cluster. Note: The settings detailed here are particular to this example deployment. Settings for your environment might differ significantly. Table 12. Summary of VXLAN settings for the management cluster in the example deployment FIELD Switch SETTING dvswitch-sddc VLAN 0 MTU 9000 VMKNic IP Addressing VMKNic Teaming Policy Select New IP Pool and configure it (details of the pool configured in this deployment are given in Table 13); click OK to create the pool. Load Balance - SRCMAC VTEP 1 Note: If your network does not support jumbo frames, you will need to set MTU to Table 13. Summary of settings for the static IP pool for VXLAN for the management cluster in the example deployment FIELD Name SETTING vxlan-pool Gateway Prefix Length 22 Primary DNS Secondary DNS DNS Suffix lci.local, lci.lab Static IP Pool Note: The static IP pool requires 24 addresses because NIC teaming on the six hosts requires four NICs per host. a. Click OK to complete the VXLAN configuration. Note: In the VXLAN column, the status for the management cluster (in this example, SDDC-Mgmt) cluster should now read Configured. 6. Now complete the VXLAN configuration for the compute cluster (in this example, SDDC-Compute) detailed in steps 4 and 5 above. 49

50 Configure Segment ID Range Next, configure an NSX Segment ID range, which is used to define the logical segments of your VXLAN. 7. In the central tab, select the Logical Network Preparation tab. 8. From the tab menu at the top of the central pane, select Segment ID. 9. Under the Segment IDs & Multicast Addresses allocation section, click the Edit button. Figure 62. Editing the VXLAN segment IDs and multicast addresses allocation a. In the Edit Segment IDs and Multicast Addresses Allocation window, in the Segment ID pool field, enter b. Select Enable Multicast Addressing. c. For the Multicast Address range, enter d. Click OK to proceed. Figure 63. VXLAN segment ID pool and multicast address settings 50

51 Configure Transport Zones 10. In the central pane, select the Transport Zones tab. 11. Click the plus (+) button to add a new transport zone. Figure 64. Add New Transport Zone button highlighted in the VMware NSX installation interface 12. In the New Transport Zone windows, in the list of clusters under Select clusters that will be part of the Transport Zone, select both the management and compute clusters (in this example, SDDC-Mgmt and SDDC-Compute), and then click OK. Configure Logical Switches 1. In the Navigator pane, select Logical Switches. 2. In the main pane, click the plus (+) button and perform the following actions in the Edit window to create a new logical switch: a. In the Name field, enter a name for the switch (such as Test Lab in this example). b. Leave the other options at their default values and click OK. 3. Repeat the same procedure detailed in step 2 four more times to create the following set of logical switches: Tier 1 (for vrealize Automation) Tier 2 (for vrealize Automation) Transit (for transmission of VMware NSX traffic) Create a Distributed Logical Router 1. In the Navigator pane on the left, under Networking & Security, select NSX Edges. 2. In the center pane, click the plus (+) button to create a new edge appliance. a. In the New NSX Edge wizard, on the Name and Description screen, select the following options, and then click Next: Install Type: Logical (Distributed) Router Name: SDDC-NSX-DLR Hostname: sddc-nsx-dlr Select Deploy Edge Appliance. b. On the Settings screen, enter the following settings and then click Next: User Name: admin Password: password Select Enable SSH access. 51

52 c. On the Configure deployment screen, click the plus (+) button to deploy an NSX edge appliance with the following settings, and then click Next: Cluster: SDDC-Mgmt Datastore: vsandatastore-mgmt Folder: SDDC-Infrastructure d. On the Configure interfaces screen: i. Under HA Interface Configuration, in the Connected to field, click Change. Select the dvpg-mgmt network, and then provide an accessible address. (In this example deployment, the Primary IP Address is and the Subnet Prefix Length is 22.) ii. Click the plus (+) button to add an interface. In the Add Interface window, supply the following details and then click OK. Name: To-Edge Type: Uplink Connected To: Transit Connectivity Status: Connected Primary IP Address: Subnet Prefix Length: 24 MTU: 9000 Note: If your network does not support jumbo frames, set this to iii. Add a second interface with the following settings: Name: Tier 1 Type: Internal Connected to: Tier 1 Connectivity Status: Connected Primary IP Address: Subnet Prefix Length: 24 MTU: 9000 Note: If your network does not support jumbo frames, set this to iv. Create a third interface on the Tier 2 network ( ) with an otherwise similar configuration to the Tier 1 interface. v. When all three NSX Edge interfaces are configured, click Next. Figure 65. All distributed logical router interfaces successfully configured 52

53 e. On the Default Gateway settings screen, enter the following settings and then click Next: Select Configure Default Gateway. vnic: To-Edge Gateway IP: MTU: 9000 Admin Distance: 1 f. On the Ready to complete screen, click Finish. Create a VMware NSX Edge Services Gateway Appliance Note: Best practice in a production environment is to deploy two VMware NSX Edge services gateway appliances to provide high availability. Because this deployment is meant to provide a hands-on demonstration of an SDDC deployment, this guide will lead you through deploying one VMware NSX Edge services gateway appliance only in this section. For a more comprehensive list of exceptions to best practices and reasons for them see Exceptions to General Best Practices Employed in This Guide. 1. In the Navigator pane, select NSX Edges. 2. Click the plus (+) button to create a new edge appliance. a. In the New NSX Edge wizard, on the Name and description page, perform the following actions: i. For Install Type, select Edge Services Gateway. ii. In the Name field, enter Public Edge Gateway. iii. In the Hostname field, enter sddc-nsx-edge.lci.local. iv. Select Deploy NSX Edge. v. Click Next. b. On the Settings screen, enter the following settings: User Name: admin Password: password Select SSH Access. Select Enable auto-rule generation. c. Click Next. d. On the Configure deployment screen, for Appliance size, select Large, click the plus (+) button, and then perform the following actions in the Add NSX Edge Appliance window: i. In the Cluster/Resource Pool drop-down menu, select SDDC-Mgmt. ii. In the Datastore drop-down menu, select vsandatastore-mgmt. iii. Leave Host blank. iv. In the Folder drop-down menu, select SDDC-Infrastructure. v. Click OK. e. Click Next. f. On the Configure interfaces screen, click the plus (+) button, and then perform the following actions in the Add NSX Edge Interface window: i. In the Name field, enter Public Interface. ii. For Type, select Uplink. iii. In the Connected To field, enter dvpg-vm-compute. iv. In the Primary IP Address field, enter v. In the MTU field, enter vi. Click OK. g. Click Next. 53

54 h. Click the plus (+) button, and then perform the following actions in the Add NSX Edge Interface window to add a second interface: i. In the Name field, enter Transit Interface. ii. For Type, select Internal. iii. In the Connected To field, enter Transit. iv. In the Primary IP Address field, enter v. In the Subnet Prefix Length field, enter 24. vi. In the MTU field, enter vii. Click OK. i. Click Next. j. On the Default Gateway Settings screen, enter the following values: vnic: Public Interface Gateway IP: MTU: 9000 k. Click Next. l. On the Firewall and HA settings screen, perform the following actions: i. Select Configure Firewall default policy. 1. For Default Traffic Policy, select Accept. 2. For Logging, select Enable. ii. Click Next. m. On the Ready to complete screen, click Finish to deploy the VMware NSX Edge services gateway appliance. Note: In the steps above, if your network does not support jumbo frames, you will need to set the MTU values to Configure Routing between the Distributed Logical Router and the VMware NSX Edge Services Gateway Configure the Distributed Logical Router 1. In the Navigator pane on the left, under Networking & Security, select NSX Edges. 2. In the center pane, double-click the entry for the Logical Router that you made in the previous section, Create a VMware NSX Edge Services Gateway Appliance. Figure 66. Selecting the logical router for configuration Note: Do not select the VMware NSX Edge services gateway. 3. In the center pane, click the Manage tab, and then select the Routing sub-tab. 4. On the Global Configuration screen, in the Dynamic Routing section, click Edit. 54

55 Figure 67. Editing dynamic routing in Global Configuration a. In the Edit Dynamic Routing Configuration window, in the Router ID drop-down, select the pre-populated naming suggestion, To-Edge , and then click OK. Note: In order for any changes to take effect, click Publish changes at the top of the screen, and after all subsequent steps, to ensure your working configuration is current. Figure 68. The Publish Changes button 55

56 5. Once the Router ID has been assigned, in the section list on left, under Global Configuration, select OSPF. Figure 69. Area definition and area-interface mapping in OSPF a. In the Area Definition section, click the plus (+) button. In the New Area Definition window, enter the following values, and then click OK: Area ID: 1 Type: Normal Authentication: None b. Click Publish Changes before proceeding. c. In the Area to Interface Mapping section, click the plus (+) button. In the New Area to Interface Mapping window, enter the following values, and then click OK: vnic: To-Edge Area: 1 Accept all remaining default values. d. Click Publish Changes before proceeding. e. In the OSPF Configuration section, click Edit. In the OSPF Configuration window, enter the following values, and then click OK: Select Enable OSPF. Protocol Address: Forwarding Address: Select Enable Graceful Restart. Note: In this example, is the IP address for the distributed logical router. f. Click Publish Changes before proceeding. 56

57 Configure the VMware NSX Edge Services Gateway for Traffic from the Distributed Logical Router With the distributed logical router s routing configured, you will now make a corresponding configuration on the VMware NSX Edge Services Gateway. 6. In the Navigator pane on the left, above the public edge gateway object (in this example, SDDC-NSX-Edge), click Back. Figure 70. The Back button in the Navigator pane 7. In the Navigator pane, under Networking & Security, select NSX Edges. 8. In the center pane, double-click the entry for the edge services gateway (in this example, NSX Edge) that you created in the previous section, Create a VMware NSX Edge Services Gateway Appliance. 9. In the center pane, click the Manage tab, and then select the Routing sub-tab. 10. On the Global Configuration screen, in the Dynamic Routing section, click Edit. a. In the Edit Dynamic Routing Configuration window, in the Router ID drop-down, select the pre-populated naming suggestion, and then click OK. b. Click Publish Changes before proceeding. 11. Once the Router ID has been assigned, in the section list on left, under Global Configuration, select OSPF. a. In the Area Definition section, click the plus (+) button. In the New Area Definition window, enter the following values, and then click OK: Area ID: 1 Type: Normal Authentication: None b. Click Publish Changes before proceeding. c. In the Area to Interface Mapping section, click the plus (+) button. In the New Area to Interface Mapping window, enter the following values, and then click OK: vnic: Transit Interface Area: 1 Accept all remaining default values. d. Click Publish Changes before proceeding. e. In the OSPF Configuration section, click Edit. In the OSPF Configuration window, perform the following actions, and then click OK: Select Enable OSPF. Select Enable Graceful Restart. Select Enable Default Originate. f. Click Publish Changes before proceeding. 12. In the section list on left under Global Configuration, select Route Redistribution. a. In the Route Redistribution Rules section, click Edit. In the New Redistribution criteria window, enter the following values, and then click OK: Prefix Name: Any Learner Protocol: OSPF Allow Learning From: Connected Action: Permit b. Click Publish Changes before proceeding. 57

58 At this point you now have the following configuration: 1. A VMware NSX Edge services gateway appliance that can be incorporated into the existing switching infrastructure 2. A distributed logical router that is connected to the VMware NSX Edge services gateway via the transit network 3. Two networks that can communicate with each other attached to the distributed logical router (Tier 1 and Tier 2) This is a sample configuration designed for simple networking scenarios that can be modified to suit your organization s needs. Refer to the VMware NSX Installation and Administration Guides in Appendix B for more advanced configuration information. Deploy and Configure VMware vrealize Operations Manager VMware vrealize Operations Manager enables you to manage both the physical and virtual components of your environment. Deploy vrealize Operations Manager 1. From the vsphere Web Client Home menu, navigate to Hosts and Clusters. 2. In the Navigator pane, under the ThinkAgile data center object, right-click the management cluster (in this example, SDDC-Mgmt), and then select Deploy OVF Template. Figure 71. Deploy OVF Template selection highlighted in the vsphere Web Client interface a. In the Deploy OVF Template wizard, on the Select template screen, select Local file, and then click Browse. b. Locate the.ova file for vrealize Operations Manager, select it, and then click Next to proceed. c. On the Select name and location screen, in the Name field, enter a meaningful name for the vrealize Operation Manager appliance (in this example, SDDC-vROpsMgr), and then click Next. d. On the Select a resource screen, under the Browse tab, select the management cluster (in this example, SDDC-Mgmt), and then click Next. e. On the Review details screen, click Next. f. On the Accept license agreements screen, click Accept, and then click Next. g. On the Select configuration screen, in the Configuration drop-down menu, select Small, and then click Next. h. On the Select storage screen, accept the default settings, and then click Next. i. On the Select networks screen, select the port group you created earlier in this guide (dvpg-vm-mgmt), and then click Next. 58

59 j. On the Customize template screen, enter the following settings: DNS: , Default Gateway: Network 1 IP Address: Network 1 Netmask: k. Click Next. l. On the Ready to complete screen, click Finish. This will deploy the vrealize Operations Manager appliance. Configure vrealize Operations Manager 3. Next, select the newly created vrealize Operations Manager virtual machine in the Hosts and Clusters Navigator pane. 4. In the tool bar at the top of central pane (above the Summary tab), click the Power on the selected virtual machines button. Figure 72. Power-on button for virtual machines highlighted for VMware vrealize Operations Manager virtual appliance 5. After the VM has powered on, in a separate browser tab, navigate to the IP address used when creating the VM (in this example, ). 6. On the Get Started screen, click New Installation. Figure 73. Details of the New Installation button in the VMware vrealize Operations Manager initial setup 59

60 a. In the vrealize Operations Manager Initial Setup wizard, on the Getting Started screen, click Next. b. On the Set Administrator Password screen, enter a password for the default admin account, confirm it, and then click Next. c. On the Choose Certificate screen, select Use the default certificates, and then click Next. d. From the Deployment Settings screen, in the Cluster Master Node field, enter a name (in this example, sddc-vrops-master). e. In the NTP Server Address field, enter the NTP server for your network, and then click Add. f. Once your NTP server is present in the NTP Servers list, click Next. g. On the Ready to Complete screen, click Finish. 7. After initial setup has completed, you will be presented with the vrealize Operations Manager Administration interface. Click Start vrealize Operations Manager. Figure 74. Detail of the Start vrealize Operations Manager button 8. In the Confirm First Application Startup dialog, click Yes. 9. You will then be directed to the VMware vrealize Operations Manager logon page. To log on, use the admin user account with the previously configured password and click Login. 10. You will be presented with the vrealize Operations Manager Configuration wizard. a. On the Welcome screen, click Next. b. On the Accept EULA screen, select I accept the terms of the license agreement, and then click Next. c. On the Enter Product License Key screen, select Product Key, enter your license key for vrealize Operations Manager in the associated field, and then click Validate License Key. When the key has been validated, click Next. d. On the Customer Experience Improvement Program screen, select whether or not to join the program, and then click Next. e. On the Ready to Complete screen, click Finish. 11. After configuration completes, you will be presented with the vrealize Operations Manager administration interface. Connect VMware vrealize Operations Manager to VMware vcenter 12. From the Home menu, navigate to Administration. 13. In the left pane, select Solutions. 60

61 14. In the central pane under Solutions, select VMware vsphere, and then click the Configure icon in the toolbar. Figure 75. Detail of the Configure vsphere button in VMware vrealize Operations Manager a. In the Manage Solution window, in the Display Name field, enter a name for the solution (in this example, SDDC vcenter Server). b. In the vcenter Server field, enter the host name of the VMware vcenter Server Appliance server in FQDN format for your deployment (in this deployment, the name is lci-sddc-vcsa.lci.lab). c. To the right of the Credential drop-down menu, click the plus (+) button to create a new credential set. d. In the Manage Credential window, in the Credential name field, enter a name for the credential set (in this example, VCSA Administrator) and the user name and password of the local administrator account on the VMware vcenter Server Appliance, and then click OK. e. If presented with a Review and Accept Certificate dialog, click OK to accept the certificate and proceed. f. After the credentials have been added, click the Test Connection button to verify connectivity. If everything is configured correctly, a dialog box with the message Test was successful will appear. Click OK to close. g. Click Save Settings to save the solution adapter s settings. Another dialog will confirm the adapter instance s creation was successful; close it by clicking OK. h. After the adapter has been saved, click Close. 61

62 15. Wait a moment for the configuration to be applied, and note the status of the VMware vcenter adapter in the lower pane. Once the adapter has been deployed, the adapter status will show the values Collecting under Collection State and Data receiving under Collection Status. Figure 76. VMware vcenter adapter successfully configured Note: Using similar procedures, it is also possible to use vrealize Operations Manager management packs to collect data from other components in this deployment. For more information on vrealize Operations Manager management packs, see vrealize Operations Manager 6.6 Help > Configuring > Connecting to Data Sources on the VMware vrealize Operations Manager 6.6 Information Center at You can also find vrealize Operations Manager management packs on the VMware Solution Exchange at Deploy the VMware vrealize Automation Virtual Appliance Next, deploy the vrealize Automation virtual appliance. 62

63 1. From the vsphere Web Client Home menu, navigate to Hosts and Clusters. 2. In the Navigator pane on the left, under the ThinkAgile data center object, right-click the management cluster (in this example, SDDC-Mgmt), and then select Deploy OVF Template. Figure 77. Deploying an OVA to the management cluster from Hosts and Clusters 3. In the Deploy OVF Template wizard, on the Select template screen, select Local file, and then browse to the OVA file. After you have selected the appropriate OVA, click Next. 4. On the Select name and location screen, in the Name field, enter a name for the OVF (in this example, SDDC-VRA), and then select SDDC-Infrastructure for the deployment location. Click Next. 5. On the Select a resource screen, select the management cluster (in this example, SDDC-Mgmt), and then click Next. 6. On the Review details screen, click Next. 7. On the Accept license agreements screen, select Accept, and then click Next. 8. On the Select storage screen, select the management cluster data store (in this example, vsandatastore-mgmt), and then click Next. 9. On the Select networks screen, select the Distributed Virtual Port Group for the management cluster (in this example, dvpg-vm-mgmt), and then click Next. 10. On the Customize template screen, enter the values from Table 14 into the appropriate fields, and then click Next. 63

64 Table 14. Summary of OVA template settings for the VMware vrealize Automation virtual appliance FIELD Hostname Initial root password VALUE sddc-vra-lci.lab password Default Gateway Domain Name lci.lab Domain Name Servers , Domain Search Path lci.lab, lci.local Network 1 IP Address Network 1 Netmask On the Ready to complete screen, click Finish to deploy the vrealize Automation virtual appliance. 12. When the virtual appliance has been deployed, click the Power On button from the vsphere Web Client interface to start it. Figure 78. Start the VMware vrealize Automation virtual appliance Connect to the vrealize Automation Virtual Appliance 1. In a browser window, navigate to the address of the vrealize Automation virtual appliance using HTTPS on port 5480 (in this example, 2. Log on with the user name root and the password you created while deploying the appliance. 3. When the vrealize Automation Installation Wizard opens, click Next to begin. 4. On the End User License Agreement screen, select I accept the terms of this agreement, and then click Next. 5. On the Deployment Type screen, select Minimal Deployment, leave Install Infrastructure as a Service selected, and then click Next. Note: Pause your work on the vrealize Automation virtual appliance here and switch over to configure the infrastructure-as-aservice (IaaS) server. 64

65 Deploy and Configure the IaaS Server The vrealize Automation virtual appliance and the IaaS server are mutually dependent. To compensate for this interdependency, each of these VMs is deployed in stages. Deploy the IaaS Server 1. From the vsphere Web Client Home menu, navigate to Hosts and Clusters. 2. In the Navigator pane, under the ThinkAgile data center object, right-click the management cluster (in this example, SDDC-Mgmt), and then select New Virtual Machine > New Virtual Machine. Figure 79. Creating a new virtual machine to host the IaaS server 3. In the New Virtual Machine wizard, on the Select a creation type screen, select Create a new virtual machine, and then click Next. 4. On the Select a name and folder screen, enter a name for the VM (in this example, SDDC-IaaS), and then click Next. 5. On the Select a compute resource screen, select the management cluster (in this example, SDDC-Mgmt), and then click Next. 6. On the Select storage screen, select the management cluster data store (in this example, vsandatastore-mgmt), and then click Next. 7. On the Select compatibility screen, in the Compatible with drop-down menu, select ESXi 6.5 and later, and then click Next. 8. On the Select a guest OS screen, select Microsoft Windows Server 2012 (64-bit), and then click Next. 9. On the Customize hardware screen, enter the configuration details from Table 15 in the appropriate fields, and then click Next. Table 15. Summary of IaaS server VM settings FIELD CPU 2 VALUE Memory New Hard disk New Network New CD/DVD Drive 8,192 MB 60 GB dvpg-vm-mgmt (dvswitch-sddc) (Ensure the virtual adapter type is VXNET3, and then select Connect.) Windows 2012* ISO file (Select Connect.) 65

66 10. On the Ready to complete screen, click Finish. 11. When the IaaS VM has been deployed, click the Power On button from the vsphere Web Client interface to start it. Figure 80. Starting the IaaS VM Configure the IaaS Server 12. On the IaaS server VM, complete the following routine configuration tasks: a. Install VMware tools on the VM. b. Assign the VM a static IP address and host name. c. Connect to your environment s domain. d. Add local administrators to the VM. e. Turn off Windows Firewall*. Install the vrealize Automation Management Agent 13. In an Internet browser on the IaaS server VM, navigate to the address for the vrealize Automation appliance s installer web page (in this example, On the vrealize Automation IaaS Installation screen, click Download the Management Agent Installer. Figure 81. Downloading the vrealize Automation management agent 66

67 15. Once the installer has been downloaded, run the installer file. a. In the VMware vrealize Automation Management Agent Setup Wizard, on the Welcome screen, click Next. b. On the End-User License Agreement screen, select I accept the terms of this agreement, and then click Next. c. On the Destination Folder screen, choose a path to install or use the default, and then click Next. d. On the Management Site Service screen, enter the details of the vrealize Automation appliance: i. vrealize Automation appliance address: ii. Root user name: root iii. Password: password iv. Next to the Management Site Service certificate SHA1 fingerprint field, click Load, and then select I confirm the fingerprint matches the Management Site Service SSL certificate. Click Next. e. On the Management Agent Account Configuration screen, enter a user name and password for the agent with local administrative rights. This example used an Active Directory service account (IC\iaas-svc) created for the IaaS service and VM. Once entered, click Next. f. On the Ready to install screen, click Install. g. When the management agent installation has completed, click Finish to close the wizard. Validate the IaaS Host Configuration and Configure Microsoft SQL Server* Software Next, run the required configuration tasks on the IaaS server automatically from the vrealize Automation installation wizard and confirm the configuration vbefore proceeding. Validate the IaaS Host Configuration 1. Return to the vrealize Automation appliance (or navigate to it in a web browser, if previously closed; in this example this is, 2. Resume the vrealize Automation Installation wizard on the Installation Prerequisites screen. a. Ensure the host that the management agent has been installed on is showing in the Discovered Hosts section (in this example, the IaaS server host, sddc-iaas.lci.lab, is present). b. Select Use Time Server, and then add the address of the time server (in this example, ). Figure 82. Discovered hosts and NTP server c. Click Next. 67

68 3. On the Prerequisite Checker screen, click Run to perform the necessary configuration checks on the Windows Server 2012 platform, which will run the IaaS components for vrealize Automation. a. Because the VM is still largely unconfigured for its role as IaaS server, there will be many issues with the configuration. Click Fix to automate the correction of these errors and bring the machine into a valid configuration. This might take several minutes, and the status of the procedure will be shown on the Prerequisite Checker screen. Figure 83. Problems with the Windows Server 2012 platform discovered by the prerequisite checker b. Once the prerequisites have been remediated, there will be a green checkmark and the word OK in the Status column. Figure 84. Configured hosts on the Prerequisite Checker screen Note: If you wish to see the details of what configuration tasks were carried out during the automated configuration, click Show Details. 68

69 c. When ready, click Next to proceed. 4. On the vrealize Automation Host screen, select Enter Host, enter the FQDN of the vrealize Automation appliance (in this example, sddc-vra.lci.lab), and then click Next. 5. On the Single Sign-On screen, enter a password for SSO that is, a password to assign system administrator credentials to the default tenant account and then click Next. Note: This vrealize Automation deployment can support multiple tenants but the default installation will deploy a generic vsphere.local tenant. This default tenant account is the environment in which additional tenants and their constituent resources will be apportioned and consumed. 6. On the IaaS Host screen, enter the details of the IaaS server your created in the previous section: a. IaaS Web Address: sddc-iaas.lci.lab b. Install IaaS Components on: sddc-iaas.lci.lab c. User name: ic\iaas-srv d. Password: password e. esecurity Passphrase: password 7. Click Next. Configure SQL Server on the IaaS Server Next, deploy SQL Server on the IaaS server to serve as the database for the vrealize Automation components. 8. In vsphere Web Client, right-click the IaaS server, and then select Edit Settings on the IaaS VM. 9. From the Edit Settings menu, under CD/DVD drive 1, expand the menu, and then select a SQL Server ISO from your data store to be used. This will mount the ISO for installation in the VM. 10. Log on to the VM either by using the vsphere Web Client console or a remote management tool such as Microsoft Remote Desktop*. 11. Navigate to the SQL Server ISO in the CD/DVD drive of the VM, and then run setup.exe. 12. In the SQL Server Installation Center, on the Installation screen, click New SQL Server stand-alone installation. 13. In the SQL Server 2014 Setup wizard, on the Product Key screen, select Enter the product key, and then enter your key. Click Next. 14. On the License Terms screen, click I accept the license terms, and then click Next. 15. On the Microsoft Update screen, select Use Microsoft Update to check for updates, and then click Next. 16. On the Setup Role screen, select SQL Server Feature Installation, and then click Next. 69

70 17. On the Feature Selection screen, under the Features menu, ensure the following options are selected, and then click Next. Database Engine Services Management Tools - Basic Management Tools - Complete Figure 85. Microsoft SQL Server features to select 18. On the Instance Configuration screen, select Default instance (or enter a meaningful name for your environment), and then click Next. 19. On the Server Configuration screen in the Service Accounts tab, enter a user in your domain (in this example, IC\iaas-svc) as the user for SQL Server Agent and SQL Server Database Engine, and then change the startup type of all services to Automatic. Click Next. Figure 86. Microsoft SQL Server service configuration 70

71 20. On Database Engine Configuration screen, in the Server Configuration tab, under Authentication Mode, select Mixed Mode, and then add the service account used previously, in addition to any other administrative accounts you wish, to the SQL Administrators section. Click Next. Figure 87. Microsoft SQL Server administrators added to the configuration Note: Using mixed-mode authentication is customary as it permits user authentication using both domain and SQL Server credentials. 21. On the Ready to Install screen, click Install. 22. On the Complete screen, once the SQL Server installation has finished, click Close. If you wish to use SSL to connect to SQL Server, a best practice for production SDDC deployments, use the following steps. If not, skip to Finalize Installation of the vrealize Automation Appliance. 71

72 Configure SQL Server for SSL Communication Note: To set up a basic, self-signed certificate for this deployment, follow this procedure. For a production environment, follow the VMware guide and best practices. 23. On the IaaS server, navigate to the Internet Information Services Manager via the Start menu or by running the command inetmgr. a. In the left pane, select the server node; in the center pane, double-click Server Certificates. b. In Server Certificates console, in the right pane under Actions, click Create Self-Signed Certificate. c. In the Create Self-Signed Certificate window, enter a meaningful name for the certificate (in this example, SDDC-SQL-IaaS); in the Select a certificate store for the new certificate drop-down menu, select Personal. Click OK. 24. From the IaaS server Start menu, open the Microsoft Management Console app via the menus or by running the command mmc. a. From the menu, select File > Add/Remove snap-in. b. From the available snap-ins section on the left, select Certificates, and then click the Add button. c. When prompted, select Computer account, and then click Finish. d. Click OK to add the snap-in. e. In the left pane, under Console Root, expand the Certificates (Local Computer) > Personal > Certificates node on the left. f. Right-click the self-signing certificate you created in the previous step (in this example, SDDC-SQL-IaaS), and then select All Tasks > Manage Private Keys. Figure 88. Managing private keys in Microsoft SQL Server g. In the private-keys permissions window in the Security tab, click Add, and then select the service account user used for SQL Server (in this example, IC\IaaS-srv). 72

73 h. In the Select Users, Computers, Service Accounts, or Groups window, click Check Names, and then click OK once verified. Figure 89. Selecting the Microsoft SQL Server service account i. Ensure the service account user has the Full control permission selected, and then click OK. 25. From the Start menu, launch the SQL Server Configuration Manager. a. In the left pane under SQL Server Configuration Manager (local), expand the node entitled SQL Server Network Configuration. b. Right-click Protocols for MSSQLSERVER, and then select Properties. Figure 90. Editing Microsoft SQL Server protocols 73

74 c. In the Protocols for MSSQLSERVER Properties window, select the Certificates tab; from the drop-down menu, select the self-signed certificate created in step 23. Figure 91. Selecting the certificate d. Once selected, click Apply, and then click OK. 26. In left pane under SQL Server Configuration Manager (local), select SQL Server Services, right-click the SQL Server service, and then select Restart. SQL Server is now configured for SSL communication. Finalize Installation of the vrealize Automation Virtual Appliance Now return to the vrealize Automation virtual appliance installation wizard to complete vrealize Automation setup. 1. Return to the vrealize Automation virtual appliance web interface (in this example, Note: If you left your session open, it might have timed out. In this case, log back in using the root user name and password. The installation will resume from where it left off when the session timed out. 2. On the Microsoft SQL Server screen of the Installation wizard: a. In the Server name field, enter a name for the server (in this example, sddc-iaas.ic.lab). b. In the Database name, enter a name for the server (in this example, vra). c. Select Create new database. d. Select Default settings. e. If you are using SSL, select Use SSL for database connection. f. Select Windows Authentication. g. Click Next. 3. On the Distributed Execution Managers screen, enter the following details (if not prepopulated), and then click Next. Note: The values provided here are specific to this example deployment; values for your environment might differ. IaaS Host Name: sddc-iaas.ic.lab Instance Name: DEM User name: ic.lab\iaas-svc Password: password Instance Description: DEM 74

75 4. On the Agents screen, enter the following details (if not prepopulated), and then click Next. Note: The values provided here are specific to this example deployment; values for your environment might differ. IaaS host name: sddc-iaas.ic.lab Agent Name: vcenter Endpoint: vcenter Agent Type: vsphere User name: ic.lab\iaas-svc Password: password 5. On the vrealize Appliance Certificate screen: a. If using a self-signed certificate for your deployment, fill out the required fields, and then click Generate Certificate. b. Click Next when you have completed your certificate configuration. 6. On the Web Certificate screen, the same considerations as the previous step apply. Generate or import a valid certificate, and then click Next. 7. On the Validation screen, click Validate. This process will pre-check your environment and ensure all settings, certificates, and accounts are configured correctly. a. The validation process can take several minutes. If any validations steps have failed, you will need to remediate them before continuing, and you must then re-validate. b. Once all checks are passed, click Next to proceed. Figure 92. Example of VMware vrealize Automation installation pre-check and successful validation 75

76 8. On the Create Snapshots screen, pause your vrealize Automation installation process: a. Navigate to Hosts and Clusters from the vsphere Web Client Home menu, and then locate the IaaS and vrealize Automation virtual machines. For both VMs in the Navigator pane, right-click, and then select Snapshots > Take Snapshot. Figure 93. Taking a snapshot of the IaaS server VM b. In the Take VM Snapshot window, provide a descriptive name for the snapshot (such as SDDC-IaaS-Validated in this example), and then click OK. c. Wait for the snapshot to complete, which might take up to 15 minutes. Note: Although optional, it is strongly advised that you take snapshots of both the vrealize Automation appliance and the IaaS server VMs before finishing your vrealize Automation installation. This way, if your installation fails, you will have a last-knowngood configuration to revert back to when you attempt the installation again. 9. Once the snapshots are completed, return to the Create Snapshots screen in the vrealize Automation Installation wizard, and then click Next. 76

77 10. On the Installation Details screen, click Install to finalize the installation. a. This process can take as long as 30 minutes. b. Once the installation has completed, you will be presented with a summary of the success of the installations. Review the results, and then click Next to proceed. Figure 94. Example of VMware vrealize Automation successfully installed 11. On the Licensing screen, enter a vrealize license key, and then click Submit Key. Once the key has been validated, click Next. 12. On the Telemetry screen, either opt in or out of the VMware Customer Experience Improvement Program, and then click Next. 13. On the Post-Installation Options screen, select Continue, and then click Next. 14. On the Congratulations screen, click Finish to complete the installation process. 77

78 With the installation complete, from here on out when you navigate to the address of the vrealize Automation appliance, you will be presented with the vrealize Automation management interface. Figure 95. The VMware vrealize Automation user interface 78

79 Create a New vrealize Automation Tenant 1. In a web browser, navigate to the vrealize Automation virtual appliance (in this example, 2. On the vrealize Automation appliance landing page, click vrealize Automation console. 3. On the vrealize Automation logon page, enter the user name administrator and the password you created during the vrealize Automation installation, and then click Sign in. 4. On the Administration menu, select Tenants in the left pane, and then click the New button at the top of the center pane. Figure 96. Adding new tenants to VMware vrealize Automation 5. In the New Tenant wizard: a. On the General tab, enter a name and URL namespace for the new tenant (in this example, SDDC Tenant and sddc, respectively), and then click Submit and Next. b. On the Local users tab, click the plus (+) button to create a new user; after supplying the information and closing the resulting User Details window, click Next. First name: tenant Last name: admin ta@lci.lab User name: tenantadmin Password: password Click OK. c. On the Administrators tab: i. In the Tenant administrators section, type the name of the new user (in this example, tenantadmin) in the search bar, and then press Enter to resolve. The new user, tenantadmin@vsphere.local, should appear. Click to select the user and add it as a Tenant administrator. ii. Repeat the same process in the IaaS administrators section to ensure that tenantadmin is added to both sections. d. Click Finish. 79

80 Connect the vrealize Automation Tenant to Active Directory 1. Navigate to the vrealize Automation logon screen directly using the new tenant name; in this example, Warning: This step is crucial. If you do not log on using the exact new tenant URL, you will end up editing the default tenant and not your newly created tenant. 2. Logon using the user name and password created above; in this example: User name: tenantadmin Password: password Click Sign in. 3. Verify that you are logged on as the tenant administrator in the top-right area of the screen. As the tenant administrator, you can configure the various components of the tenant including directories, infrastructure, resources, and reservations. Figure 97. Verifying that one is signed in to the correct tenant 4. Navigate to the Administration > Directories. 5. Click Add Directory, and then select Add Active Directory over LDAP/IWA. 80

81 a. On the Add Directory screen, perform the following steps: i. In the Directory name field, enter the name for your directory (in this example, ic.lab). ii. From the Sync Connector drop-down menu, select the name of the vrealize Automation appliance (in this example, sddc-vra). Note: This value should be prepopulated. iii. Under Authentication, select Yes. iv. Under Serve Location, select This Directory supports DNS Service Location. v. Under Bind User Details in the Base DN field, enter the distinguished name (DN) of the container in which the user accounts to be used reside (in this example, OU=SDDC-Project,DC=ic,DC=lab). vi. In the Bind DN field, enter the DN of the user account that is performing the join (in this example, CN=Directory SVC,OU=SDDC-Project,DC=ic,DC=lab). vii. In the Bind DN Password field, enter the bind-user s password. viii. Click Test Connection to check the connection and remedy any issues if they occur. ix. Click Save & Next. Figure 98. Example of a directory added the VMware vrealize Automation tenant 81

82 b. On the Select the Domains screen, ensure your domain is selected, and then click Next. c. On the Map User Attributes screen, click Next to accept the default user-attribute mapping. d. On the Select the groups (users) you want to sync screen, if you are synchronizing groups, ensure they are selected, and then click Next. Note: Synchronizing a group requires you to also synchronize its constituent users for it to function properly. Figure 99. Example of groups added for synchronization e. On the Select the groups (users) you want to sync screen, adjust the DN to include all users you want to synchronize, and then click the plus (+) button on the right side. Continue to add DNs until you have included all users you wish to synchronize; click Next when you have added all users you wish to synchronize. f. On the Review screen, check which users and groups will be synchronized. Additionally, if desired, you can adjust the frequency with which new users or groups are synchronized. When you are finished, click Sync Directory. Note: An initial sync will begin and complete shortly afterward. If you want to use Active Directory users as tenant administrators, follow these steps: 1. Log off of the tenant administrator account. 2. Log on using the adminstrator@vsphere.local account. 3. Edit the custom tenant s Tenant Administrator and IaaS Administrator groups to include Active Directory accounts. 4. When completed, log off and log back on as an Active Directory account with tenant administrator privileges. Warning: Ensure that you navigate directly to the custom tenant s URL. 82

83 Add a VMware vcenter Endpoint to vrealize Automation and Configure the Fabric Group Add a VMware vcenter Endpoint to vrealize Automation 1. Log on to the vrealize Automation Console as a tenant administrator of the tenant you created in the previous section, and then navigate to Infrastructure > Endpoints. 2. Click the New drop-down menu, and then select Virtual > vsphere (vcenter). 3. In the New Endpoint vsphere (vcenter) screen, perform the following steps: a. In the Name field, enter the name of the agent created during vrealize Automation setup (in this example, vcenter). Warning: Ensure that the name entered here matches the name of the agent created during vrealize Automation setup or the endpoint creation will fail. b. In the Address field, enter the URL of the VMware vcenter Server Appliance (in this example, Warning: Make sure to append /sdk to the end of the URL in order for endpoint creation to succeed. c. Next to the Credentials field, click the More Option button ( ) to add new credentials. i. In the Select Credentials window, click New to create new credentials with the following details: Name: vcenter Admin User name: local vcenter administrator (in this example, administrator@lci.lab) Password: password ii. Click OK when you are done. d. Select Specify manager for network and security platform. i. In the Address field, enter the URL of the VMware NSX server (in this example, ii. Next to the Credentials field, click the More Option button ( ) to add new credentials. 1. In the Select Credentials window, click New to create new credentials with the following details: Name: NSX Manager Admin User name: admin Password: password 2. Click OK when you are done. Figure 100. Adding a VMware NSX Manager for the VMware vcenter endpoint 83

84 e. Click OK to add the VMware vcenter endpoint. Configure the Fabric Group Figure 101. Example of final values for a VMware vcenter endpoint Configure the Fabric Group 4. In the vrealize Automation Console, navigate to the Infrastructure > Fabric Groups. 5. Click New. a. In the New Fabric Group console, in the Name field, enter a name for the fabric group (in this example, FG-Compute). b. Add any users you wish to enable to administer the fabric group, including tenantadmin. c. In the Compute resources list, select only the compute cluster (in this example, SDDC-Compute). d. Click OK. Figure 102. Example settings for a new fabric group 84

85 6. In order to see the newly added and polled compute resources, log off and log back on to the vrealize Administration Console, ensuring that you log back on as a user with fabric administrator rights to the fabric group you just created. 7. When logged back on, under the Infrastructure tab, note the new Compute Resources and Reservations nodes. Figure 103. The compute cluster successfully added to the fabric group Add a VMware vrealize Orchestrator Endpoint to the vrealize Automation Tenant 1. In the vrealize Automation Console, navigate to the Infrastructure > Endpoint. Note: Ensure that you are logged on to the correct tenant if you have logged off. 2. On the Endpoints screen, from the New drop-down menu, select Orchestration > vrealize Orchestrator. 3. In the New Endpoint vrealize Orchestrator screen, perform the following steps: a. In the Name field, enter vrealize Orchestrator (Embedded). b. In the Address field, enter the URL of the vrealize appliance (in this example, sddc-vra.lci.lab/vco). c. Next to the Credentials field, click the More Option button ( ) to add new credentials. i. In the Select Credentials window, click New to create new credentials with the following details: Name: vro Admin User name: local vcenter administrator (in this example, administrator@vsphere.local) Password: password ii. Click OK when you are done. 85

86 d. In the Custom Properties table, click New. i. For the Custom Property, you must enter the following values: Name: VMware.VCenterOrchestratorPriority Value: 1 Encrypted: No e. Click OK to complete the addition of the orchestration endpoint. Figure 104. Example of a setting for a VMware vrealize Orchestrator endpoint Configure Machine Prefixes and Groups Next, complete the vrealize Automation setup by configuring the remaining networking settings to be used in deploying blueprints. 1. Log on to the custom tenant s vrealize Automation web console using tenant administrator privileges (in this example, using the tenantadmin user). 2. Navigate to Infrastructure > Administration > Machine Prefixes. 3. Click New to create a new machine prefix. a. On the Machine Prefixes screen, enter the following values: Name: ops- Number of digits: 4 Next number: 1 b. Create a similar group with the name dev-. Figure 105. ops- and dev- machine prefixes successfully added 86

87 4. Next, navigate to Administration > Directory Users and Groups > Custom Groups. 5. Click New to create a new user group. a. In the New Group screen on the General tab, perform the following tasks: i. In the Name field, enter Super Users. ii. In the Add Roles to this Group list, select all check boxes. Note: You might wish to note the privileges afforded by each role and make user groups according to their environments afterward. iii. Click Next. b. On the Members screen, add the tenantadmin user to the group. Additionally, add other appropriate users to this group. This group can include Active Directory groups and users. Note: This group will have complete administrative control over the vrealize deployment, so in production settings it should be used carefully. c. Click Finish to complete the group creation. 6. Under Directory Users and Groups in the left pane, select Business Groups, and then click New. Figure 106. Adding a new business group 7. In the New Business Group wizard, on the General screen, perform the following tasks: a. In the Name field, enter BG-Ops. b. In the Send manager s to field, enter ops@lci.lab. c. Click Next. 8. On the Members screen, perform the following tasks: a. In the Group manager role field, search for tenantadmin@vsphere.local. b. In the Support role field, search for Super Users. c. In the User role field, search for Super Users. d. Click Next. 9. On the Infrastructure screen, perform the following tasks: a. In the Default machine prefix drop-down menu, select ops-. b. Click Finish. 87

88 10. Repeat steps 7 9 in order to create a second business group named BG-dev with appropriate users for your environment. Figure 107. Example of business groups successfully added Create Network Profiles and Reservations 1. If not already logged on, connect to the custom tenant s vrealize Automation web console using tenant administrator privileges (in this example, using the tenantadmin user). 2. Navigate to Infrastructure > Reservations > Network Profiles. 3. From the New drop-down menu, select External to create a new network profile. a. In the New Network Profile - External window, on the General tab, enter the following values to make a network profile to match the pre-existing NSX logical switch Transit: Name: NSX Transit ( ) Subnet Mask: Gateway: b. On the Network Ranges tab, click New, and then enter the following values: Name: NSX Transit Range Start IP: End IP: c. Click Apply to create the network profile. 4. Click the Reservations tab. 5. From the New drop-down menu, select vsphere (vcenter) to create a new reservation. a. In the New Reservation vsphere (vcenter) window on the General tab, enter the following values: Name: Operations Tenant: sddc Business group: BG-Ops Priority: 1 Select Enable this reservation. b. On the Resources tab, enter the following values: Compute resource: SDDC-Compute (vcenter) Memory, This Reservation: 512 Storage: Select vsandatastore-compute. This Reservation Reserved:

89 c. On the Network tab, perform the following tasks: i. In the Network list, select the VMware NSX dvswitch with the label matching the transit network s segment ID and the name used when it was created in VMware NSX (in this example, vxw-dvs-135-virtualwire-11-sid-5000-transit). ii. In the Network Profile column of the Network list, select NSX Transit ( ). iii. Under Advanced Settings in the Transport zone drop-down menu, select Global Transport Zone. Figure 108. Example of network reservation settings d. On the Alerts tab, perform the following tasks: i. For Capacity alerts, select On. ii. In the Recipients field, enter values for which addresses should be alerted if the reservation nears resource limits; alternatively, leave the field blank to have s sent to the business group s pre-defined group manager. Figure 109. Example alert configuration for a VMware vrealize Automation reservation e. Click OK to complete the creation of the reservation. 89

90 Adding Custom Branding to the vrealize Automation Environment You can uniquely identify (brand) individual tenants in order to more quickly identify which tenant environment you are logging on to from the vrealize Automation console. 1. Log on to the vrealize Automation console custom tenant as a user with tenant administrator privileges (in this example, the tenantadmin user). a. From the navigation menu on the left, browse to Administration > Branding > Header and Footer Branding. In this section, you can add an image, color, and name to the tenant in order to uniquely identify it in your deployment. b. Click the Login Screen branding and customize it with additional images if required. Install vrealize Log Insight vrealize Log Insight is a system for centrally collecting and viewing logging and event-based information. Follow these steps to configure it for the SDDC environment. 1. Log on to the VMware vsphere Web Client to deploy the vrealize Log Insight virtual appliance. 2. In the Navigator pane on the left, under the ThinkAgile data center object, right-click the management cluster (in this example, SDDC-Mgmt), and then select Deploy OVF Template. 3. In the Deploy OVF Template wizard, on the Select template screen, select Local file, and then browse to the OVA file. After you have selected the appropriate OVA file, click Next. 4. On the Select name and location screen, in the Name field, enter a name for the OVF (in this example, SDDC-vRLI), and then select SDDC-Infrastructure for the deployment location. Click Next. 5. On the Select a resource screen, select the management cluster (in this example, SDDC-Mgmt), and then click Next. 6. On the Review details screen, click Next. 7. On the Accept license agreements screen, select Accept, and then click Next. 8. On the Select configuration screen, in the Configuration drop-down menu, select Small, and then click Next. 9. On the Select storage screen, select the management cluster data store (in this example, vsandatastore-mgmt), and then click Next. 10. On the Select networks screen, select the distributed virtual port group for the management cluster (in this example, dvpg-vm-mgmt), and then click Next. 11. On the Customize template screen, enter the values from Table 16 into the appropriate fields, and then click Next. Table 16. Summary of OVA template settings for the VMware vrealize Log Insight virtual appliance FIELD VALUE DNS , DNS domain DNS searchpath lci.lab lci.lab, lci.local Default Gateway Hostname sddc-vra-lci.lab Network 1 IP Address Initial root password password 12. On the Ready to complete screen, click Finish to deploy the vrealize Log Insight appliance. 13. When the appliance has been deployed, from the vsphere Web Client interface, click the Power On button to start the appliance. 14. Once the appliance has started up, from a web browser, navigate to it using the host name you provided during deployment (in this example, 90

91 15. Once on the appliance, you will be presented with the Welcome to vrealize Log Insight page. Click Next to begin initial setup. a. From the Choose Deployment Type, select Start New Deployment. b. On the Admin Credentials screen, enter the following values: Username: admin New password: password Note: These values are specific to this example deployment and might differ in your deployment. c. Confirm the password, and then click Save and Continue. d. On the License screen, enter your vrealize Log Insight license key, click Add License, and then click Save and Continue. e. On the General Configuration screen, in the System Notifications To field, enter the address of the account you wish to receive notifications (in this example, and then click Save and Continue. Note: It is entirely optional to opt in to the VMware Customer Experience Improvement Program; the choice will not affect your deployment. f. On the Time Configuration screen, in the Sync Server Time With drop-down menu, select ESX-ESXi host, and then click Save and Continue. g. On the SMTP Configuration screen, enter details relevant to your particular deployment, and then click Send Test to ensure connectivity is functioning correctly. When you have successfully configured the , click Save and Continue. Figure 110. Completed SMTP settings h. On the Setup Complete screen, click Finish. The vrealize Log Insight dashboard page will automatically appear. 91

92 Configure vrealize Log Insight VMware vcenter Integration 1. Log on to the vrealize Log Insight web server (if not already logged on) at the URL supplied during configuration (in this example, using the previously configured administrator account and password. 2. From the main menu on the default dashboard, click Continue vsphere Integration. a. On the vsphere Integration screen, perform the following actions: i. In the Hostname field, enter lci-sddc-vcsa.lci.lab. ii. In the Username field, enter iii. In the Password field, enter password. iv. Select Collect vcenter Server Events. v. Select Configure ESXI hosts to send logs to Log Insight; then, in the configuration window, perform the following actions: 1. Select Configure All ESXi Hosts. 2. For the syslog protocol, select UDP. 3. Click OK. vi. Click Test Connection. Figure 111. VMware vsphere integration settings vii. Click Save to complete the vsphere integration. b. In the dialog box confirming that the configuration was completed successfully, click OK. Configure vrealize Log Insight and vrealize Operations Integration 1. Log on to the vrealize Log Insight web server (if not already logged on) at the URL supplied during configuration (in this example, using the previously configured administrator account and password. 2. From the top right, click the menu icon, and then select Administration. 3. Navigate to the vrealize Operations tab in the left pane. 4. On the vrealize Operations Integration screen, perform the following actions: a. In the Hostname field, enter lci-sddc-vcsa.lci.lab. b. In the Username field, enter root. c. In the Password field, enter password. d. Select Enable alerts integration. e. Select Enable launch in context. f. Click Test Connection. g. Click Save. 92

93 Install vrealize Log Insight and VMware vsan Content Pack 1. Log on to the vrealize Log Insight web server (if not already logged on) at the URL supplied during configuration (in this example, using the previously configured administrator account and password. 2. In the top right, click the menu icon, and then select Content Packs. Figure 112. Accessing the VMware vsan content pack 3. Wait for the list of available content packs to refresh, and then scroll down and select VMware - VSAN. 4. In the pop-up dialog box, select I agree to the terms and conditions, and then click Install. 5. In the Setup Instructions window, click OK. The VMware - VSAN content pack should now be installed. Note: No additional configuration is required because VMware vsan logging data is automatically collected as part of the VMware vsphere integration. Install and Configure the Lenovo XClarity Administrator Virtual Appliance Lenovo XClarity is a hardware systems management application that enables you to deploy, monitor, and manage infrastructure in both traditional and SDDC environments. Install Lenovo XClarity Administrator 1. Log on to the VMware vsphere Web Client (if not already logged on) to deploy the Lenovo XClarity Administrator virtual appliance. 2. In the Navigator pane on the left, under the ThinkAgile data center object, right-click the management cluster (in this example, SDDC-Mgmt), and then select Deploy OVF Template. 3. In the Deploy OVF Template wizard, on the Select template screen, select Local file, and then browse to the OVA file for Lenovo XClarity Administrator. After you have selected the appropriate OVA, click Next. 4. On the Select name and location screen, in the Name field, enter a name for the OVF (in this example, SDDC-LXCA), and then select SDDC-Infrastructure for the deployment location. Click Next. 5. On the Select a resource screen, select the management cluster (in this example, SDDC-Mgmt), and then click Next. 6. On the Review details screen, click Next. 7. On the Accept license agreements screen, select Accept, and then click Next. 8. On the Select storage screen, select the management cluster data store (in this example, vsandatastore-mgmt), and then click Next. 9. On the Select networks screen, select the distributed virtual port group for the management cluster (in this example, dvpg-vm-mgmt), and then click Next. 10. On the Ready to complete screen, click Finish to deploy the vrealize Automation appliance. 11. When the appliance has been deployed, click the Power On button from the vsphere Web Client interface to start it. 93

94 Configure Lenovo XClarity Administrator 1. Once the Lenovo XClarity Administrator appliance has been deployed by following the steps in the previous section, from the vsphere Web Client interface, click the Power On button to start the appliance. a. Note the assigned IP address. You can view it from the vsphere Web Client interface or in a console session. Figure 113. Location of the IP address for the Lenovo XClarity Administrator appliance 2. In a web browser, navigate to the IP address of the appliance (in this example, ). You will be presented with the Lenovo XClarity Administrator Initial Setup page. Figure 114. Lenovo XClarity Administrator setup pages 3. On the Initial Setup page, click Read and Accept Lenovo XClarity License Agreement. a. Review the license, and then click Accept. 4. On the Initial Setup page, click Create User Account. a. On the Local User Management page, click New to create a new supervisor user. b. In the Create New Supervisor User window, enter the following details, and then click Create: Username: administrator Description: LXCA Admin Password: password c. At the bottom-left of the Initial Setup page, click Return to Initial Setup. 94

95 5. On the Initial Setup page, click Configure Network Access. Note: The configuration detailed in this guide uses only one Ethernet adapter. Review the Lenovo documentation linked in Appendix B to decide if this configuration applies to your scenario. a. On the Edit Network Access screen, enter the following details for the IPv4 configuration: IP address: Network Mask: Default Gateway: b. For the IPv6 configuration, select Use stateful address configuration DHCPv6. c. Click Save IP Settings, and then click Save to confirm the changes. d. Click Restart in order to confirm that the changes will take effect. e. When the dialog box informs you that the management interface is restarting, click Close. 6. If you changed the IP address, check the console output of the VM in vsphere Web Client to determine if the machine has completed startup procedures and is ready to be used, and to confirm that the newly created IP address was added to the configuration. a. Navigate to the appliance s web interface using the DNS entry created earlier that corresponds to the static IP that was assigned (in this example, b. Log on using the newly created administrator account. 7. On the Initial Setup page, click Configure Time and Date Preferences. a. On the Edit Date and Time screen, select the time zone relevant to your configuration and the IP address of the NTP server in your environment (in this example, ). b. Click Save. 8. On the Initial Setup page, click Configure Additional Security Settings to add the administrator account to the recovery group in case it is needed later. a. In the left pane, under Users and Groups, select Role Groups. b. On the Role Group Management screen, select LXC-RECOVERY, and then click the Edit button in the toolbar. i. In the Edit Role Group window, in the User List drop-down list, select Administrator, and then click Save. c. In the left pane, under Users and Groups, select LDAP Client. d. On the LDAP Client Settings screen, complete the LDAP client settings using values relevant to your environment. The following configuration values are used in the environment for this deployment: User Authentication Method: Allow local users first, then LDAP users LDAP Security: Disable secure LDAP Forest Name: ic.lab Domain Name: ic.lab Binding Method: Configured Credentials Client Name: ic\directory-svc Password: password Root DN: OU=SDDC-Project,DC=ic,DC=lab User Search attribute: cn Group Search Attribute: memberof e. Click Apply. f. If desired, you can return to the Local Users and Role Groups screens to add Active Directory users. When completed, from the bottom of the left-side navigation, click Return to Initial Setup. 95

96 9. On the Initial Setup page, click Start Managing Systems. a. On the Start Managing Systems screen, click No, don t include Demo Data. b. Lenovo XClarity Administrator will automatically discover relevant devices on your network. Review the list, and if you have any other devices you wish to manage, add them via the Manual Input or Bulk Import options. c. Select all the devices to be managed using the checkbox column on the left, then click Manage Selected. d. In the Manage window, enter details relevant to your environment. In the environment used for this deployment, the details are: i. Specify server management module credentials: USERID password Do not create a recovery account and leave all local users enabled. ii. Switch credentials: admin password Figure 115. Managed-systems settings in Lenovo XClarity Administrator e. When you have entered all of the details, click Manage, and then wait until the management process has completed. When you are finished, a list of the devices and their statuses will be summarized. Review the details of the managed devices, and then click Close. f. Navigate to the Lenovo XClarity Administrator dashboard to view the managed devices. 96

97 Install and Configure the Lenovo XClarity Integrator Appliance Lenovo XClarity Integrator for VMware vcenter provides you with the ability to integrate the management features of Lenovo XClarity Administrator with VMware vcenter. In addition, the Lenovo XClarity Integrator for vrealize Automation provides you with pre-built, reusable service blueprints for infrastructure provisioning and management. These blueprints enable you to deliver end-to-end software and hardware infrastructure, such as hosts, clusters, and virtual resources, as a service. You will deploy a Microsoft SharePoint* portal blueprint later in this guide. Install Lenovo XClarity Integrator 1. Log on to the VMware vsphere Web Client (if not already logged on) to deploy the Lenovo XClarity Integrator virtual appliance. 2. In the Navigator pane, on the left under the ThinkAgile data center object, right-click the management cluster (in this example, SDDC-Mgmt), and then select Deploy OVF Template. 3. In the Deploy OVF Template wizard, on the Select template screen, select Local file, and then browse to the OVA file for Lenovo XClarity Integrator. After you have selected the appropriate OVA, click Next. 4. On the Select name and location screen, in the Name field, enter a name for the OVF (in this example, SDDC-LXCI), and then select SDDC-Infrastructure for the deployment location. Click Next. 5. On the Select a resource screen, select the management cluster (in this example, SDDC-Mgmt), and then click Next. 6. On the Review details screen, click Next. 7. On the Accept license agreements screen, select Accept, and then click Next. 8. On the Select storage screen, select the management cluster data store (in this example, vsandatastore-mgmt), and then click Next. 9. On the Select networks screen, select the distributed virtual port group for the management cluster (in this example, dvpg-vmmgmt), and then click Next. 10. On the Ready to complete screen, click Finish to deploy the vrealize Automation appliance. 11. When the appliance has been deployed, from the vsphere Web Client interface, click the Power On button to start the appliance. Configure Lenovo XClarity Integrator 12. Once you have deployed the Lenovo XClarity Integrator appliance, power on the VM and note the IP address that it is assigned either from the vsphere Web Client interface or by viewing the appliance in a console session. 13. Navigate to the IP address of the appliance in a web browser using the HTTPS protocol. 14. You will be presented with the Lenovo XClarity Integrator for VMware vcenter License Agreement screen. Select I Accept the terms in the license agreement, and then click Next. 15. On the Network Setting page, enter values relevant to your configuration, and then click Next. In the example deployment detailed in this guide, the values are: Host Name: lxci Note: This name cannot contain hyphens. Domain name: lci.lab DNS: Note: This field will only accept one address (not multiple comma-separated values). IP Settings: Eth0: Use a statically assigned IP address IP address: Netmask: Default gateway:

98 16. On the Account Configuration page, add an administrator account, and then click Next: Username: administrator Password: password 17. On the Plug-in Registration page, supply the details used to connect Lenovo XClarity to the VMware vcenter Server Appliance in your environment, and then click Submit. In this example deployment, these details are: Host: lci-sddc-vcsa.lci.lab Username: Password: password 18. As with the Lenovo XClarity Administrator appliance, if you re-assigned the IP address of the primary network interface, you will need to navigate to the appliance again. In the case of this example deployment, the address was registered in DNS for this purpose. 19. From the logon page, use the administrator credentials created during setup, and then click Log in. 20. From the main menu, select XClarity Administrator Connection. 21. On the Registered Lenovo XClarity Administrator screen, click Register. Figure 116. Registering Lenovo XClarity Administrator a. In the new registration window, supply details specific to the Lenovo XClarity Administrator appliance in your environment, and then click OK. For this deployment, the values are: IP: Username: administrator Password: password Port: 443 b. In the View Certificate window, click Trust this certificate. The Lenovo XClarity Administrator server is now registered with Lenovo XClarity Integrator. 98

99 Configuring Lenovo XClarity Administrator and vrealize Log Insight Integration 1. Log on to the vrealize Log Insight web console via the address configured earlier in the guide. (In the environment used for in this example, a. At the top right of the page, click the menu icon, and then select Content Packs. b. In the Content Pack Marketplace menu, select Lenovo - XClarity. c. In the Install Content Pack window, click the checkbox, and then click Install. d. In the XClarity Setup Instructions window, click OK. 2. Navigate to the Lenovo XClarity Administrator console at the address specific to your environment. (In the environment used for in this example, 3. Log on using the administrator account created previously. 4. From the Monitoring menu, select Event Forwarding. Figure 117. Accessing event forwarding a. From the toolbar, click the New icon. In the New Event Recipient wizard, on the General screen, enter the details relevant to your environment, and then click Next. In the environment used in this deployment, these values are: Event recipient type: Syslog Name: Log Insight Integration Host: sddc.lxci.lci.lab Port: 514 Protocol: UDP Status: Enable this recipient b. On the Devices screen, select Match all devices, and then click Next. c. On the Events screen, select the All category for the Critical, Warning, and Informational categories, and then click Next. d. On the Scheduler screen, click Create. The event forwarding profile is now created, and information will be sent to vrealize Log Insight. 99

100 Configuring Lenovo XClarity Integrator, vrealize Automation, and vrealize Orchestration Integration The Lenovo XClarity Integrator for vrealize Automation plugin extends your blueprint design capabilities to: Include Lenovo XClarity components Execute catalog requests directly from the Lenovo XClarity console The plugin can be downloaded from this address: To install and configure the integration of Lenovo XClarity Integrator with vrealize Automation, follow the instructions in this Lenovo installation guide: Example Blueprint Deployment vrealize Automation and Microsoft SharePoint 2013* Portal Blueprint Visit this web site to download a blueprint with a self-contained SharePoint 2013 instance that can be deployed using the SDDC infrastructure in this guide: In addition to the package contents, you will need the following software packages and their corresponding licensing (where appropriate) to deploy this blueprint: Windows Server 2012 SQL Server 2014 SharePoint 2013 VMware vrealize CloudClient 4.4: Additionally, you must perform the following steps before you can use the blueprint: Create a Windows Server 2012 template on the target VMware vcenter Server. Ensure that you have a Windows* or Linux* operating system based platform with the Java Runtime Environment* installed in order to execute and run vrealize CloudClient commands. Extract the contents of SQL Server 2014 and SharePoint 2013 installation media into separate folders on a shared network location accessible to the VM in the blueprint that you are deploying. Complete the deployment and configuration of vrealize Automation as described in this guide, including the following: 1. Target endpoint and a corresponding fabric group 2. Business group with a default machine prefix 3. External network profile and a reservation that utilizes it Next, to import the blueprint and the corresponding software components, follow the steps in the Microsoft SharePoint 2013 VMware Sample Blueprint deployment guide, located under the Resources tab, on the VMware Solution Exchange. To Deploy the Blueprint 1. From the vrealize Automation console, click the Design Blueprint menu item, and then select Edit Item from the toolbar. 2. In the Blueprint Designer, select the Windows Server 2012 component, and then click the Build Information tab. a. In this tab, configure settings appropriate to the environment: i. Blueprint Type: Server ii. Action: Linked Clone iii. Provisioning workflow: CloneWorkflow iv. Clone From: Select the previously mentioned Windows Server 2012 VM with the preparations mentioned above. v. Clone from Snapshot: If you have a snapshot of the server VM in the prepared state, you can use it here. 3. Click the Machine Resources tab. You can design limits on the number of CPUs, the amount of memory, and the size of the attached hard-disk drives (HDDs). 100

101 4. Click the Microsoft SharePoint 2013 subcomponent, and then navigate to the Properties tab. a. Enter values in this tab appropriate for your deployment, including all required fields so that the SharePoint 2013 files can be successfully deployed. Figure 118. Configuring the Microsoft SharePoint 2013 blueprint 5. Follow the same procedure for the SQL Server subcomponent. 6. From the left-hand menu, click the Network & Security category to add networking for the VM. a. From the available options on the left, drag an On-Demand Routed Network to the canvas. b. Select the newly created On-Demand Network, and then, in the General tab, select a Parent Network Profile to be created on demand by VMware NSX. c. Enter an ID for the network. d. Click the DNS/WINS tab, and then enter DNS information relevant to your environment. 101

102 7. Select the Windows 2012 VM component again, and then navigate to the Network tab. a. Click New. b. Enter details to create an adapter on the on-demand network, such as the ones shown in Figure 119. Figure 119. Creating an adapter for an on-demand network 8. Click Save, and then click Finish to finalize changes to the blueprint. 102

103 9. The blueprint is now ready to be requested. Navigate to the Catalog tab, and then click Request on the SharePoint 2013 catalog item. a. From the New Request wizard, enter a Description for the request. b. Next, select the Windows Server 2012 item on the left. i. If you previously made values for the server s CPU, memory, or storage editable in the blueprint, you can customize them here. Figure 120. Requesting a blueprint c. When you are satisfied with your request, click Submit. You will be notified that your request was submitted successfully. d. Because you are logged on as the tenantadmin user, you can bypass the approval process and check the status of your request immediately. Navigate to the Requests tab. e. From the Requests tab, select the request that you submitted, and then click View Details. f. From the resulting details screen, click Execution Information to view details on the steps being performed to deploy the blueprint. Figure 121. Execution information for the blueprint After the blueprint has successfully deployed, you can navigate to the newly created SharePoint instance using the address provided in the blueprint: 103