Add Uplink Adapters

You can associate multiple adapters to a single vSwitch to provide NIC teaming. The team can share traffic and provide failover. Procedure Log in to the vSphere Client and select the host from the inventory panel. Click the Configuration tab and click Networking. Select a vSwitch and click Properties. Click the Network Adapters tab. Click Add to launch the Add Adapter wizard. Select one or more adapters from the list and click Next.
(Optional) To reorder the NICs into a different category, select a NIC and click Move Up and Move Down.
Option Active Adapters Standby Adapters Description Adapters that the vSwitch uses. Adapters that become active if one or more of the active adapters fails.
Click Next. Review the information on the Adapter Summary page, click Back to change any entries, and click Finish. The list of network adapters reappears, showing the adapters that the vSwitch now claims.
Click Close to exit the vSwitch Properties dialog box. The Networking section in the Configuration tab shows the network adapters in their designated order and categories.

Cisco Discovery Protocol

Cisco Discovery Protocol (CDP) allows ESXi administrators to determine which Cisco switch port is connected to a given vSwitch. When CDP is enabled for a particular vSwitch, you can view properties of the Cisco switch (such as device ID, software version, and timeout) from the vSphere Client. In ESXi, CDP is set to listen, which means that ESXi detects and displays information about the associated Cisco switch port, but information about the vSwitch is not available to the Cisco switch administrator.
View Cisco Switch Information on the vSphere Client
When CDP is set to listen or both, you can view Cisco switch information. Procedure 3 Log in to the vSphere Client and select the host from the inventory panel. Click the Configuration tab and click Networking. Click the info icon to the right of the vSwitch.
Basic Networking with vNetwork Distributed Switches

Configure dvPort Settings
Use the Port Settings dialog box to configure general dvPort properties such as the port name and description. Procedure 5 Log in to the vSphere Client and display the vNetwork Distributed Switch. On the Ports tab, right-click the port to modify and select Edit Settings. Click General. Modify the port name and description. Click OK.

Private VLANs

Private VLANs are used to solve VLAN ID limitations and the waste of IP addresses for certain network setups. A private VLAN is identified by its primary VLAN ID. A primary VLAN ID can have multiple secondary VLAN IDs associated with it. Primary VLANs are promiscuous so that ports on a private VLAN can communicate with ports configured as the primary VLAN. Ports on a secondary VLAN can be either isolated, communicating only with promiscuous ports, or community, communicating with both promiscuous ports and other ports on the same secondary VLAN. To use private VLANs between an ESXi host and the rest of the physical network, the physical switch connected to the ESXi host needs to be private VLAN-capable and configured with the VLAN IDs being used by ESXi for the private VLAN functionality. For physical switches using dynamic MAC+VLAN ID based learning, all corresponding private VLAN IDs must be first entered into the switchs VLAN database. To configure dvPorts to use private VLAN functionality, you must first create the necessary private VLANs on the vNetwork Distributed Switch that the dvPorts are connected to.

Create a Private VLAN

You can create a private VLAN for use on a vNetwork Distributed Switch and its associated dvPorts. Procedure 5 In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch. From the Inventory menu, select vNetwork Distributed Switch > Edit Settings. Select the Private VLAN tab. Under Primary Private VLAN ID, click [Enter a Private VLAN ID here], and enter the number of the primary private VLAN. Click anywhere in the dialog box, and then select the primary private VLAN that you just added. The primary private VLAN you added appears under Secondary Private VLAN ID. 8 For each new secondary private VLAN, click [Enter a Private VLAN ID here] under Secondary Private VLAN ID, and enter the number of the secondary private VLAN. Click anywhere in the dialog box, select the secondary private VLAN that you just added, and select either Isolated or Community for the port type. Click OK.
Remove a Primary Private VLAN
Remove unused primary private VLANs from the networking inventory view of the vSphere Client. Prerequisites Before removing a private VLAN, be sure that no port groups are configured to use it. Procedure 3 In the vSphere Client, display the Networking inventory view and select the vNetwork Distributed Switch. From the Inventory menu, select vNetwork Distributed Switch > Edit Settings. Select the Private VLAN tab.

Remove an Uplink from a vNetwork Distributed Switch
An uplink that is associated with a vNetwork Distributed Switch cannot be added to a vSwitch or another vNetwork Distributed Switch. Procedure Log in to the vSphere Client and select a host from the inventory panel. Click the Configuration tab and click Networking. Select the vNetwork Distributed Switch view. Click Manage Physical Adapters. Click Remove for the uplink to remove. Click OK.
Managing Virtual Network Adapters
Virtual network adapters handle host network services over a vNetwork Distributed Switch. You can configure VMkernel virtual adapters for an ESXi host through an associated vNetwork Distributed Switch either by creating new virtual adapters or migrating existing virtual adapters.
Create a VMkernel Network Adapter on a vNetwork Distributed Switch
Create a VMkernel network adapter for use as a VMotion interface or an IP storage port group. Procedure 9 Log in to the vSphere Client and select the host from the inventory panel. Click the Configuration tab and click Networking. Select the vNetwork Distributed Switch view. Click Manage Virtual Adapters. Click Add. Select New virtual adapter, and click Next. Select VMkernel, and click Next. Under Network Connection, select the vNetwork Distributed Switch and the associated port group, or select the standalone port to which to add this virtual adapter. Select Use this virtual adapter for VMotion to enable this port group to advertise itself to another ESXi host as the network connection where VMotion traffic is sent. You can enable this property for only one VMotion and IP storage port group for each ESXi host. If this property is not enabled for any port group, migration with VMotion to this host is not possible. Choose whether to use this virtual adapter for fault tolerance logging. Choose whether to use this virtual adapter for management traffic, and click Next. Under IP Settings, specify the IP address and subnet mask. Click Edit to set the VMkernel default gateway for VMkernel services, such as VMotion, NAS, and iSCSI. On the DNS Configuration tab, the name of the host is entered by default. The DNS server addresses and domain that were specified during installation are also preselected.

In nonpromiscuous mode, a guest adapter listens only to traffic forwarded to own MAC address. In promiscuous mode, it can listen to all the frames. By default, guest adapters are set to nonpromiscuous mode.
Edit the Layer 2 Security Policy on a vSwitch
You can control how inbound and outbound frames are handled by editing Layer 2 security policies. Procedure Log in to the VMware vSphere Client and select the host from the inventory panel. Click the Configuration tab, and click Networking. Click Properties for the vSwitch to edit. In the Properties dialog box, click the Ports tab. Select the vSwitch item and click Edit. In the Properties dialog box, click the Security tab. By default, Promiscuous Mode is set to Reject, and MAC Address Changes and Forged Transmits are set to Accept. The policy applies to all virtual adapters on the vSwitch, unless the port group for the virtual adapter specifies a policy exception. 7 In the Policy Exceptions pane, select whether to reject or accept the security policy exceptions.
Option Promiscuous Mode - Reject Promiscuous Mode - Accept MAC Address Changes - Reject Description Has no effect on which frames are received by the guest adapter. The guest adapter detects all frames passed on the vSwitch that are allowed under the VLAN policy for the port group that the adapter is connected to. If the guest OS changes the MAC address of the adapter to anything other than what is in the.vmx configuration file, all inbound frames are dropped. If the guest OS changes the MAC address back to match the MAC address in the.vmx configuration file, inbound frames are sent again. MAC Address Changes - Accept Forged Transmits -Reject Forged Transmits - Accept If the MAC address from the guest OS changes, frames to the new MAC address are received. Outbound frames with a source MAC address that is different from the one set on the adapter are dropped. No filtering is performed, and all outbound frames are passed.
Edit the Layer 2 Security Policy Exception on a Port Group
Control how inbound and outbound frames are handled by editing Layer 2 Security policies. Procedure 5 Log in to the VMware vSphere Client and select the host from the inventory panel. Click the Configuration tab, and click Networking. Click Properties for the port group to edit. In the Properties dialog box, click the Ports tab. Select the port group item and click Edit.
In the Properties dialog box for the port group, click the Security tab. By default, Promiscuous Mode is set to Reject. MAC Address Changes and Forged Transmitsare set to Accept. The policy exception overrides any policy set at the vSwitch level.
In the Policy Exceptions pane, select whether to reject or accept the security policy exceptions.

VMFS Datastores

ESXi can format SCSI-based storage devices as VMFS datastores. VMFS datastores primarily serve as repositories for virtual machines. You can store multiple virtual machines on the same VMFS volume. Each virtual machine, encapsulated in a set of files, occupies a separate single directory. For the operating system inside the virtual machine, VMFS preserves the internal file system semantics, which ensures correct application behavior and data integrity for applications running in virtual machines. In addition, you can use the VMFS datastores to store other files, such as virtual machine templates and ISO images. VMFS supports the following file and block sizes, enabling your virtual machines to run even the most dataintensive applications, including databases, ERP, and CRM, in virtual machines:
Maximum virtual disk size: 2TB with 8MB block size Maximum file size: 2TB with 8MB block size Block size: 1MB (default), 2MB, 4MB, and 8MB
Creating and Increasing VMFS Datastores
You can set up VMFS datastores on any SCSI-based storage devices that your ESXi host discovers. After you create the VMFS datastore, you can edit its properties. You can have up to 256 VMFS datastores per system, with a minimum volume size of 1.2GB. NOTE Always have only one VMFS datastore for each LUN. If your VMFS datastore requires more space, you can increase the VMFS volume. You can dynamically add new extents to any VMFS datastore and grow the datastore up to 64TB. An extent is a LUN or partition on a physical storage device. The datastore can stretch over multiple extents, yet appear as a single volume. Another option is to grow the existing datastore extent if the storage device where your datastore resides has free space. You can grow the extent up to 2 TB.
Sharing a VMFS Volume Across ESXi Hosts
As a cluster file system, VMFS lets multiple ESXi hosts access the same VMFS datastore concurrently. You can connect up to 32 hosts to a single VMFS volume. Figure 7-2. Sharing a VMFS Volume Across Hosts

host A host B host C

VMFS volume disk1 disk2 disk3 virtual disk files
To ensure that the same virtual machine is not accessed by multiple servers at the same time, VMFS provides on-disk locking. Sharing the same VMFS volume across multiple hosts offers the following advantages:

Select the initiator to view. The default details for the initiator appear, including the model, iSCSI name, iSCSI alias, IP address, and target and paths information.
Click Properties. The iSCSI Initiator Properties dialog box appears. The General tab displays additional characteristics of the initiator.
You can now configure your hardware initiator or change its default characteristics.
Change Name and IP Address for Hardware Initiators
When you configure your hardware iSCSI initiators, make sure that their names and IP addresses are formatted properly. Procedure Log in to the vSphere Client, and select a host from the inventory panel. Click the Configuration tab and click Storage Adapters in the Hardware panel. Select the initiator to configure and click Properties > Configure. To change the default iSCSI name for your initiator, enter the new name. Make sure the name you enter is worldwide unique and properly formatted or some storage devices might not recognize the hardware iSCSI initiator. 5 (Optional) Enter the iSCSI alias. The alias is a name that you use to identify the hardware iSCSI initiator. 6 Change the default IP settings. You must change the default IP settings so that they are configured properly for the IP SAN. Work with your network administrator to determine the IP setting for the HBA. 7 Click OK to save your changes.
If you change the iSCSI name, it is used for new iSCSI sessions. For existing sessions, new settings are not used until logout and re-login.
Setting Up Software iSCSI Initiators
With the software-based iSCSI implementation, you can use standard network adapters to connect your ESXi host to a remote iSCSI target on the IP network. The software iSCSI initiator that is built into ESXi facilitates this connection by communicating with the network adapter through the network stack. Before you configure the software iSCSI initiator, you must perform the following tasks: 3 Create a VMkernel port for physical network adapters. Enable the software iSCSI initiator. If you use multiple network adapters, activate multipathing on your host using the port binding technique. For more information on port binding, see the iSCSI SAN Configuration Guide. 4 If needed, enable Jumbo Frames. Jumbo Frames must be enabled for each vSwitch through the vSphere CLI. Also, if you use an ESX host, you must create a VMkernel network interface enabled with Jumbo Frames. See the Networking section for more information.

Delayed ACK

Configure Advanced Parameters for iSCSI
The advanced iSCSI settings control such parameters as header and data digest, ARP redirection, delayed ACK, and so on. Generally, you do not need to change these settings because your ESXi host works with the assigned predefined values. CAUTION Do not make any changes to the advanced iSCSI settings unless you are working with the VMware support team or otherwise have thorough information about the values to provide for the settings. Procedure 5 Log in to the vSphere Client, and select a host from the inventory panel. Click Configuration tab and click Storage Adapters. Select the iSCSI initiator to configure and click Properties. To configure advanced parameters at the initiator level, on the General tab, click Advanced. Proceed to Step 6. Configure advanced parameters at the target level. At the target level, advanced parpameters can be configured only for software iSCSI. a b 6 Select either the Dynamic Discovery tab or Static Discovery tab. From the list of available targets, select a target to configure and click Settings > Advanced.
Enter any required values for the advanced parameters you want to modify and click OK to save your changes.
Storage Refresh and Rescan Operations
The refresh operation updates the datastore lists and storage information, such as the datastore capacity, displayed in the vSphere Client. When you make changes in your ESXi host or SAN configuration, you need to use the rescan operation. You can rescan all adapters on your host. If the changes you make are isolated to a specific adapter, rescan only this adapter. If your vSphere Client is connected to a vCenter Server system, you can rescan adapters on all hosts managed by the vCenter Server system. Perform a rescan each time you make one of the following changes.
Create new LUNs on a SAN. Change the path masking on a host.
Reconnect a cable. Make a change to a host in a cluster.
IMPORTANT Do not rescan when a path is unavailable. If one path fails, another takes over and your system continues to be fully functional. If, however, you rescan at a time when a path is not available, the host removes the path from its list of paths to the device. The path cannot be used by the host until the next time a rescan is performed while the path is active.

When you perform datastore resignaturing, consider the following points:
Datastore resignaturing is irreversible. The LUN copy that contains the VMFS datastore that you resignature is no longer treated as a LUN copy. A spanned datastore can be resignatured only if all its extents are online. The resignaturing process is crash and fault tolerant. If the process is interrupted, you can resume it later. You can mount the new VMFS datastore without a risk of its UUID colliding with UUIDs of any other datastore, such as an ancestor or child in a hierarchy of LUN snapshots.
Resignature a VMFS Datastore Copy
Use datastore resignaturing if you want to retain the data stored on the VMFS datastore copy. Prerequisites To resignature a mounted datastore copy, first unmount it. Before you resignature a VMFS datastore, perform a storage rescan on your host so that the host updates its view of LUNs presented to it and discovers any LUN copies. Procedure 5 Log in to the vSphere Client and select the server from the inventory panel. Click the Configuration tab and click Storage in the Hardware panel. Click Add Storage. Select the Disk/LUN storage type and click Next. From the list of LUNs, select the LUN that has a datastore name displayed in the VMFS Label column and click Next. The name present in the VMFS Label column indicates that the LUN is a copy that contains a copy of an existing VMFS datastore. Under Mount Options, select Assign a New Signature and click Next. In the Ready to Complete page, review the datastore configuration information and click Finish.
What to do next After resignaturing, you might have to do the following:
If the resignatured datastore contains virtual machines, update references to the original VMFS datastore in the virtual machine files, including.vmx,.vmdk,.vmsd, and.vmsn. To power on virtual machines, register them with vCenter Server.
Using Multipathing with ESXi
To maintain a constant connection between an ESXi host and its storage, ESXi supports multipathing. Multipathing is a technique that lets you use more than one physical path for transferring data between the ESXi host and the external storage device. In case of a failure of an element in the SAN network, such as an HBA, switch, or cable, ESXi can fail over to another physical path. In addition to path failover, multipathing offers load balancing, which redistributes I/O loads between multiple paths, thus reducing or removing potential bottlenecks.

VM4 vSwitch vSwitch

Switch 1 VM6 Host 3 VM7 VM8 VLAN B Broadcast Domain B

vSwitch VM9 VM10 VM11

Switch 2
Host 4 vSwitch VM12 VLAN B VM13 VLAN A VM14 VLAN B
Multiple VLANs on the same virtual switch Broadcast Domains A and B
In this configuration, all employees in the accounting department use virtual machines in VLAN A and the employees in sales use virtual machines in VLAN B. The router forwards packets containing accounting data to the switches. These packets are tagged for distribution to VLAN A only. Therefore, the data is confined to Broadcast Domain A and cannot be routed to Broadcast Domain B unless the router is configured to do so. This VLAN configuration prevents the sales force from intercepting packets destined for the accounting department. It also prevents the accounting department from receiving packets intended for the sales group. The virtual machines serviced by a single virtual switch can be in different VLANs.
Security Considerations for VLANs
The way you set up VLANs to secure parts of a network depends on factors such as the guest operating system and the way your network equipment is configured. ESXi features a complete IEEE 802.1q-compliant VLAN implementation. VMware cannot make specific recommendations on how to set up VLANs, but there are factors to consider when using a VLAN deployment as part of your security enforcement policy.
VLANs as Part of a Broader Security Implementation
VLANs are an effective means of controlling where and how widely data is transmitted within the network. If an attacker gains access to the network, the attack is likely to be limited to the VLAN that served as the entry point, lessening the risk to the network as a whole. VLANs provide protection only in that they control how data is routed and contained after it passes through the switches and enters the network. You can use VLANs to help secure Layer 2 of your network architecture the data link layer. However, configuring VLANs does not protect the physical layer of your network model or any of the other layers. Even if you create VLANs, provide additional protection by securing your hardware (routers, hubs, and so forth) and encrypting data transmissions. VLANs are not a substitute for firewalls in your virtual machine configurations. Most network configurations that include VLANs also include software firewalls. If you include VLANs in your virtual network, be sure that the firewalls that you install are VLAN-aware.

Properly Configure VLANs

Equipment misconfiguration and network hardware, firmware, or software defects can make a VLAN susceptible to VLAN-hopping attacks. VLAN hopping occurs when an attacker with authorized access to one VLAN creates packets that trick physical switches into transmitting the packets to another VLAN that the attacker is not authorized to access. Vulnerability to this type of attack usually results from a switch being misconfigured for native VLAN operation, in which the switch can receive and transmit untagged packets. To help prevent VLAN hopping, keep your equipment up to date by installing hardware and firmware updates as they become available. Also, follow your vendors best practice guidelines when you configure your equipment. VMware virtual switches do not support the concept of a native VLAN. All data passed on these switches is appropriately tagged. However, because other switches in the network might be configured for native VLAN operation, VLANs configured with virtual switches can still be vulnerable to VLAN hopping. If you plan to use VLANs to enforce network security, disable the native VLAN feature for all switches unless you have a compelling reason to operate some of your VLANs in native mode. If you must use native VLAN, see your switch vendors configuration guidelines for this feature.

Understanding vpxuser Permissions The vpxuser permission is used for vCenter Server when managing activities for the host. The vpxuser is created when an ESXi host is attached to vCenter Server. vCenter Server has Administrator privileges on the host that it manages. For example, vCenter Server can move virtual machines to and from hosts and perform configuration changes needed to support virtual machines. The vCenter Server administrator can perform most of the same tasks on the host as the root user and also schedule tasks, work with templates, and so forth. However, the vCenter Server administrator cannot directly create, delete, or edit users and groups for ESXi hosts. These tasks can only be performed by a user with Administrator permissions directly on each ESXi host. CAUTION Do not change vpxuser in any way and do not change its permissions. If you do so, you might experience problems in working with ESXi hosts through vCenter Server. Assigning dcui User Permissions The dcui user runs on hosts and acts with Administrator rights. This users primary purpose is to configure hosts for lockdown mode from the direct console. This user acts as an agent for the direct console and must not be modified or used by interactive users. CAUTION Do not change the dcui user in any way and do not change its permissions. If you do so, you might experience problems in working with the ESXi host through the local user interface.

Understanding Roles

vCenter Server and ESXi grant access to objects only to users who are assigned permissions for the object. When you assign a user or group permissions for the object, you do so by pairing the user or group with a role. A role is a predefined set of privileges. ESXi hosts provide three default roles, and you cannot change the privileges associated with these roles. Each subsequent default role includes the privileges of the previous role. For example, the Administrator role inherits the privileges of the Read Only role. Roles you create yourself do not inherit privileges from any of the default roles. You can create roles and set permissions through a direct connection to the ESXi host. Because most users create roles and set permissions in vCenter Server, see Basic System Administration for information on working with permissions and roles. Assigning the No Access Role Users assigned the No Access role for an object cannot view or change the object in any way. New users and groups are assigned this role by default. You can change the role on an object-by-object basis. A user with a No Access role for a particular object can select the vSphere Client tabs associated with the object, but the tab displays no content. The root user and vpxuser permissions are the only users not assigned the No Access role by default. Instead, they are assigned the Administrator role. You can delete the root users permissions altogether or change its role to No Access as long as you first create a replacement permission at the root level with the Administrator role and associate this role with a different user. Assigning the Read Only Role Users assigned the Read Only role for an object are allowed to view the state of the object and details about the object. With this role, a user can view virtual machine, host, and resource pool attributes. The user cannot view the remote console for a host. All actions through the menus and toolbars are disallowed.

Assigning the Administrator Role Users assigned the Administrator role for an object are allowed to view and perform all actions on the object. This role also includes all permissions inherent in the Read Only role. If you are acting in the Administrator role on an ESXi host, you can grant permissions to individual users and groups on that host. If you are acting in the Administrator role in vCenter Server, you can grant permissions to any user or group included in the Windows domain list that vCenter Server references. vCenter Server registers any selected Windows domain user or group through the process of assigning permissions. By default, all users who are members of the local Windows Administrators group on vCenter Server are granted the same access rights as any user assigned to the Administrator role. Users who are members of the Administrators group can log in as individuals and have full access. For security reasons, consider removing the Windows Administrators group from the Administrator role. You can change permissions after installation. Alternately, you can use the vSphere Client to delete the Windows Administrators group access permissions, but you must first create another permission at the root level that has a different user assigned to the Administrator role. Direct Console User Interface Access Only users that are assigned the Administrator role can log in to the direct console. To allow access to the direct console, add the user to the local administrators group. Procedure 5 Log in to the host using the vSphere Client. Click the Users & Groups tab and click Users. Right-click the user and click Edit to open the Edit User dialog box. From the Group drop-down menu, select localadmin and click Add. Click OK.
Working with Users and Groups on ESXi Hosts
If you are directly connected to an ESXi host through the vSphere Client, you can create, edit, and delete users and groups. These users and groups are visible in the vSphere Client whenever you log in to the ESXi host, but are not available if you log in to vCenter Server.
View, Sort, and Export a List of Users and Groups
You can view, sort, and export lists of ESXi users and groups to a file that is in HTML, XML, Microsoft Excel, or CSV format. Procedure 3 Log in to the host using the vSphere Client. Click the Users & Groups tab and click Users or Groups. Determine how to sort the table, and hide or show columns according to the information you want to see in the exported file.
To sort the table by any of the columns, click the column heading. To show or hide columns, right-click any of the column headings and select or deselect the name of the column to hide. To show or hide columns, right-click any of the column headings and select or deselect the name of the column to hide.

Limit Log File Numbers and Sizes
To prevent virtual machine users and processes from flooding the log file, which can lead to denial of service, you can limit the number and size of the log files ESXi generates. Procedure Log in to a vCenter Server system using the vSphere Client. On the Summary tab, click Edit Settings. Select Options > General Options and make a record of the path displayed in the Virtual Machine Configuration File text box. Use the vifs command to get a copy of the virtual machine configuration files from the location you noted in Step 3. Virtual machine configuration files are located in the /vmfs/volumes/<datastore> directory, where <datastore> is the name of the storage device on which the virtual machine files reside. For example, if the virtual machine configuration file you obtained from the Virtual Machine Properties dialog box is [vol1]vm-finance/vm-finance.vmx, use this command.
To limit the log size, use a text editor to add or edit the following line to the.vmx file, where <maximum_size> is the maximum file size in bytes.
log.rotateSize=<maximum_size>
For example, to limit the size to around 100KB, enter 100000. 6 To keep a limited number of log files, use a text editor to add or edit the following line to the.vmx file, where <number_of_files_to_keep> is the number of files the server keeps.
log.keepOld=<number_of_files_to_keep>
For example, to keep 10 log files and begin deleting the oldest ones as new ones are created, enter 10. Save your changes and close the file. Use vifs to put your modified copy of the file at the location you noted in Step 3.
Disable Logging for the Guest Operating System
If you choose not to write troubleshooting information into a virtual machine log file stored on the VMFS volume, you can stop logging altogether. If you disable logging for the guest operating system, be aware that you might not be able to gather adequate logs to allow troubleshooting. Further, VMware does not offer technical support for virtual machine problems if logging has been disabled. Procedure 5 Log in to a vCenter Server system using the vSphere Client and select the virtual machine in the inventory. On the Summary tab, click Edit Settings. Click the Options tab and in the options list under Advanced, select General. In Settings, deselect Enable logging. Click OK to close the Virtual Machine Properties dialog box.

Managing Host Profiles

The host profiles feature creates a profile that encapsulates the host configuration and helps to manage the host configuration, especially in environments where an administrator manages more than one host or cluster in vCenter Server. Host profiles eliminates per-host, manual, or UI-based host configuration and maintain configuration consistency and correctness across the datacenter by using host profile policies. These policies capture the blueprint of a known, validated reference host configuration and use this to configure networking, storage, security, and other settings on multiple hosts or clusters. You can then check a host or cluster against a profiles configuration for any deviations. This chapter includes the following topics: n Host Profiles Usage Model, on page 179

Access Host Profiles View, on page 180 Creating a Host Profile, on page 180 Export a Host Profile, on page 181 Import a Host Profile, on page 181 Edit a Host Profile, on page 182 Manage Profiles, on page 183 Checking Compliance, on page 186
Host Profiles Usage Model
This topic describes the workflow of using Host Profiles. You must have an existing vSphere installation with at least one properly configured host. 1 Set up and configure the host that will be used as the reference host. A reference host is the host from which the profile is created. Create a profile using the designated reference host. Attach a host or cluster with the profile.
Check the host's compliance against a profile. This ensures that the host continues to be correctly configured. Apply the host profile of the reference host to other hosts or clusters of hosts.
NOTE Host profiles is only supported for VMware vSphere 4.0 hosts. This feature is not supported for VI 3.5 or earlier hosts. If you have VI 3.5 or earlier hosts managed by your vCenter Server 4.0, the following can occur if you try to use host profiles for those hosts:
You cannot create a host profile that uses a VMware Infrastructure 3.5 or earlier host as a reference host. You cannot apply a host profile to any VI 3.5 or earlier hosts. The compliance check fails. While you can attach a host profile to a mixed cluster that contains VI 3.5 or earlier hosts, the compliance check for those hosts fails.
As a licensed feature of vSphere, Host Profiles are only available when the appropriate licensing is in place. If you see errors, please ensure that you have the appropriate vSphere licensing for your hosts.
Access Host Profiles View
The Host Profiles main view lists all available profiles. Administrators can also use the Host Profiles main view to perform operations on host profiles and configure profiles. The Host Profiles main view should be used by experienced administrators who wish to perform host profile operations and configure advanced options and policies. Most operations such as creating new profiles, attaching entities, and applying profiles can be performed from the Hosts and Clusters view. Procedure
Select View > Management > Host Profiles.
Any existing profiles are listed on the left side in the profiles list. When a profile is selected from the profile list, the details of that profile are displayed on the right side.

Creating a Host Profile

You create a new host profile by using the designated reference host's configuration. A host profile can be created from the Host Profiles main view or the host's context menu in the Hosts and Clusters.

ESX and vCenter Server Installation Guide
ESX 4.0 vCenter Server 4.0
This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www.vmware.com/support/pubs.

EN-000104-03

You can find the most up-to-date technical documentation on the VMware Web site at: http://www.vmware.com/support/ The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: docfeedback@vmware.com
Copyright 20092011 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.
VMware, Inc. 3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com

VMware, Inc.

Contents
Updated Information 7 About This Book 9
1 Introduction to VMware vSphere System Requirements 13
ESX Hardware Requirements 13 vCenter Server and the vSphere Client Hardware Requirements vCenter Server Software Requirements 17 vSphere Client Software Requirements 18 Support for 64-Bit Guest Operating Systems 18 Requirements for Creating Virtual Machines 18 Required Ports 18 Supported Remote Management Firmware Versions 19
3 Introduction to Installing ESX 21
Prerequisites for Installing ESX 21 About the esxconsole.vmdk 22 Options for Accessing the Installation Media, Booting the Installer, and Running the Installer 22 About ESX Evaluation Mode 23 ESX Installation Options 23
4 Location of the ESX Installation Media 25
Download the ESX ISO Image and Burn the Installation DVD 25 Creating a Media Depot 25
5 Booting the ESX Installer 27
Bootstrap Commands 27 Boot the ESX Installer from the Installation DVD 28 PXE Booting the ESX Installer 29
6 Installing VMware ESX 39
Install ESX Using the Graphical Mode 39 Install ESX Using the Text Mode 42 Installing ESX Using Scripted Mode 45

7 ESX Partitioning 61

Required Partitions 61 Optional Partitions 62
8 Post-Installation Considerations for ESX 63
Download the vSphere Client 63 Licensing the Host 63 Set an ESX/ESXi Host to Evaluation Mode 64
9 Installing, Removing, and Updating Third-Party Extensions 65
About Patching Hosts with vSphere Host Update Utility 65 About the vihostupdate Command-Line Utility 66 Update an ESX/ESXi Host Using Offline Bundles with the vihostupdate Utility 66 Update an ESX/ESXi Host Using a Depot with the vihostupdate Utility 67 Remove Custom Packages on ESX Using the Service Console 68 Remove Selected Custom Packages on ESX/ESXi Using the vSphere Command Line 68
10 Preparing the vCenter Server Databases 71
vCenter Server Database Patch and Configuration Requirements 71 Create a 32-Bit DSN on a 64-Bit Operating System 72 Configure vCenter Server to Communicate with the Local Database After Shortening the Computer Name to 15 Characters or Fewer 73 About the Bundled Microsoft SQL Server 2005 Express Database Package 74 Maintaining a vCenter Server Database 74 Configure Microsoft SQL Server Databases 74 Configure Oracle Databases 79
11 Introduction to Installing vCenter Server 85
vCenter Server Prerequisites 85 Using a User Account for Running vCenter Server with SQL Server 86 About Installing vCenter Server on IPv6 Machines 87 Configure the URLs on a Standalone vCenter Server System 87 Running the vCenter Server and vSphere Client Installers from a Network Drive vCenter Server Components 88 Required Data for Installing vCenter Server 88
12 Installing vCenter Server 91
Download the vCenter Server Installer 91 Install vCenter Server in a Virtual Machine 91 Install vCenter Server 92
13 Postinstallation Considerations for vCenter Server 95
Install the vSphere Client 96 Install the vSphere Host Update Utility 97 Uninstall VMware vSphere Components 98
14 Creating vCenter Server Linked Mode Groups 99
Linked Mode Prerequisites 99 Linked Mode Considerations 100 Configure the URLs on a Linked Mode vCenter Server System 100 Joining to a Linked Mode Group During and After Installation 101 Join a Linked Mode Group After Installation 101
Isolate a vCenter Server Instance from a Linked Mode Group 102 Linked Mode Troubleshooting 103
15 Install Additional Modules 105
Install VMware vCenter Guided Consolidation 105 Install VMware vCenter Update Manager 106 Install VMware vCenter Converter 107

16 Managing ESX/ESXi and vCenter Server Licenses 109
About License Key Capacity 110 About vSphere and vCenter Server License Keys 110 About Using a License Server to Manage ESX 3.x/ESXi 3.5 Hosts 110 About the License Portal 111 About License Inventories 112 Controlling License Permissions 113 View License Information 113 Add a License Key to the License Inventory and Assign It to an Asset 114 Add Multiple License Keys to the License Inventory 115 Assign a License Key to Multiple Assets 115 Export Report Data 116 License a Host Without vCenter Server 117 License a Host When Adding It to the vCenter Server Inventory 117 View Which Features Are Licensed on a Host 117 Set an ESX/ESXi Host to Evaluation Mode 118 Troubleshooting Licensing 118

Index 121

Updated Information
This ESX and vCenter Server Installation Guide is updated with each release of the product or when necessary. This table provides the update history of the ESX and vCenter Server Installation Guide.
Revision EN-000104-03 Description
In the topic vCenter Server Software Requirements, on page 17, added a link to the vSphere Compatibility Matrixes guide. In the topic vSphere Client Software Requirements, on page 18, added a link to the vSphere Compatibility Matrixes guide. In the introduction to Chapter 10, Preparing the vCenter Server Databases, on page 71, added a link to the vSphere Compatibility Matrixes guide. In vCenter Server Database Patch and Configuration Requirements, on page 71, Table 10-1 now contains information that the patch version is updated to 10.2.0.4 for Oracle 10g database. vCenter Server Prerequisites, on page 85 now contains information that to use vCenter LinkedMode, multiple vCenter Server systems should be added to a domain. Required Partitions, on page 61 now contains information that the only required VMFS3 partition is for the esxconsole.vmdk. Minor revisions.

EN-000104-02

EN-000104-01

EN-000104-00

Initial release.

About This Book

The Installation Guide describes how to install new configurations of VMware vCenter and ESX. It does not include setup or installation information for ESXi.

Intended Audience

This book is intended for anyone who needs to install vCenter Server and install ESX 4.0. The information is written for experienced Windows or Linux system administrators who are familiar with virtual machine technology and datacenter operations.

Document Feedback

VMware welcomes your suggestions for improving our documentation. If you have comments, send your feedback to docfeedback@vmware.com.
VMware vSphere Documentation
The vSphere documentation consists of the combined VMware vCenter Server and ESX/ESXi documentation set.
Technical Support and Education Resources
The following technical support resources are available to you. To access the current version of this book and other books, go to http://www.vmware.com/support/pubs. Online and Telephone Support To use online support to submit technical support requests, view your product and contract information, and register your products, go to http://www.vmware.com/support. Customers with appropriate support contracts should use telephone support for the fastest response on priority 1 issues. Go to http://www.vmware.com/support/phone_support.html. Support Offerings VMware Professional Services To find out how VMware support offerings can help meet your business needs, go to http://www.vmware.com/support/services. VMware Education Services courses offer extensive hands-on labs, case study examples, and course materials designed to be used as on-the-job reference tools. Courses are available onsite, in the classroom, and live online. For onsite pilot programs and implementation best practices, VMware Consulting

Installation and Storage

SCSI disk, Fibre Channel LUN, or RAID LUN with unpartitioned space. In a minimum configuration, this disk or RAID is shared between the service console and the virtual machines. For hardware iSCSI, a disk attached to an iSCSI controller, such as the QLogic qla405x. Software iSCSI is not supported for booting or installing ESX. Serial attached SCSI (SAS). For Serial ATA (SATA), a disk connected through supported SAS controllers or supported on-board SATA controllers. SATA disk drives connected behind supported SAS controllers or supported on-board SATA controllers. Supported SAS controllers include:

n n n n n

LSI1068E (LSISAS3442E) LSI1068 (SAS 5) IBM ServeRAID 8K SAS controller Smart Array P400/256 controller Dell PERC 5.0.1 controller
Supported on-board SATA controllers include:
Intel ICH9 Nvidia MCP55 ServerWorks HT1000
When installing ESX on SATA drives, consider the following:
Ensure that your SATA drives are connected through supported SAS controllers or supported onboard SATA controllers. Do not use SATA disks to create VMFS datastores shared across multiple ESX hosts.
ATA and IDE disk drives ESX supports installing and booting on either an ATA drive or ATA RAID is supported, but ensure that your specific drive controller is included in the supported hardware. IDE drives are supported for ESX installation and VMFS creation.
Chapter 2 System Requirements
Recommendations for Enhanced ESX Performance
There are several things you can do to enhance ESX performance, including using multiple physical disks, such as SCSI disks, Fibre Channel LUNs, and RAID LUNs. Following are some recommendations for enhanced performance:
RAM The ESX host might require more RAM for the service console if you are running third-party management applications or backup agents. Network adapters for virtual machines Dedicated Gigabit Ethernet cards for virtual machines, such as Intel PRO 1000 adapters, improve throughput to virtual machines with high network traffic. Disk location For best performance, store all data used by your virtual machines on physical disks allocated to virtual machines. These physical disks should be large enough to hold disk images used by all the virtual machines. Processors Faster processors improve ESX performance. For certain workloads, larger caches improve ESX performance. Hardware compatibility Use devices in your server that are supported by ESX 4.0 drivers. See the Hardware Compatibility Guide at http://www.vmware.com/resources/compatibility.

Minimum Requirements for the vSphere Client

n n n n

CPU 1 CPU Processor 266MHz or faster Intel or AMD processor (500MHz recommended). Memory 200MB RAM Disk Storage 1GB free disk space for a complete installation, which includes the following components:
Microsoft.NET 2.0 Microsoft.NET 3.0 SP1 Microsoft Visual J# vSphere Client 4.0 vSphere Host Update Utility 4.0
You must also have 400MB free on the drive that has your %temp% directory. If all of the prerequisites are already installed, 300MB of free space is required on the drive that has your %temp% directory, and 450MB is required for the vSphere Client 4.0.
Networking Gigabit connection recommended.
32-Bit or 64-Bit Operating System for vCenter Server
When you have up to 200 hosts, you can use a 32-bit Windows operating system, but a 64-bit Windows operating system is preferred. When you have 200300 hosts, a 64-bit Windows operating system is required.
Recommendations for Optimal Performance
Depending on the number of ESX hosts and virtual machines in your environment, the following system requirements should be used as guidelines for optimal performance. IMPORTANT The recommended disk sizes assume default log levels. If you configure more granular log levels, more disk space is required. Table 2-3 summarizes the requirements for a medium deployment. Table 2-3. Up to 50 Hosts and 250 Powered-On Virtual Machines
Product vCenter Server vSphere Client CPU Memory 4GB 200MB Disk 3GB 1GB
Table 2-4 summarizes the requirements for a large deployment. Table 2-4. Up to 200 Hosts and 2000 Powered-On Virtual Machines
Product vCenter Server vSphere Client CPU Memory 4GB 500MB Disk 3GB 1GB
Table 2-5 summarizes the requirements for an extra-large deployment. vCenter Server must be hosted on a 64-bit Windows operating system for this configuration. Table 2-5. Up to 300 Hosts and 3000 Powered-On Virtual Machines
Product vCenter Server vSphere Client CPU Memory 8GB 500MB Disk 3GB 1GB
Requirements for Installing vCenter Server on a Custom Drive
If you install vCenter Server on the E:\ drive or on any custom drive, note the following space requirements.
601MB on the custom drive for vCenter Server 1.13GB on the C:\ drive for Microsoft.NET 3.0 SP1, Microsoft ADAM, Microsoft SQL Server 2005 Express (optional), and Microsoft Visual C++ 2005 Redistributable 375MB for the custom drive %temp% directory
vCenter Server Software Requirements
Make sure that your operating system supports vCenter Server. For a list of supported operating systems, see the vSphere Compatibility Matrixes at http://www.vmware.com/pdf/vsphere4/r40/vsp_compatibility_matrix.pdf on the VMware vSphere documentation Web site.
vSphere Client Software Requirements
Make sure that your operating system supports the vSphere Client. The vSphere Client requires the Microsoft.NET 3.0 SP1 Framework. If your system does not have it installed, the vSphere Client installer installs it. For a list of supported operating systems, see the vSphere Compatibility Matrixes at http://www.vmware.com/pdf/vsphere4/r40/vsp_compatibility_matrix.pdf on the VMware vSphere documentation Web site.

BOOTIF gateway=<ip address> ip=<ip address>
ks=cdrom:/<path> ks=file://<path> ks=ftp://<server>/<path>/ ks=http://<server>/<path>
Table 5-1. Bootstrap Commands for ESX Installation (Continued)
Command ks=https://<server>/<path> ks=nfs://<server>/<path> ks=usb Description Performs a scripted installation with a script located at the given URL. Performs a scripted installation with the script located at <path> on a given NFS server. Performs a scripted installation with the ks.cfg script in the root directory of the USB flash drive attached to the host. If multiple flash drives are attached, the installer cycles through each one, mounting and unmounting them until the file named ks.cfg is found. Performs a scripted installation with a script located on the ext partition with the given UUID. Same as netdevice Specifies a domain name server as the nameserver during the install. Tries to use a network adapter <device> when looking for an installation script and installation media. Specify as a MAC address (for example, 00:50:56:C0:00:01). If not specified and files need to be retrieved over the network, the installer defaults to the first discovered network adapter. The IPAPPEND option is also supported if you PXE boot the installer. Specifies subnet mask for the network interface that downloads the installation media. Flags the kernel to use the XTPIC instead of the APIC. Starts the ESX installer in text mode. Looks for the installation media at the specified URL. When you are PXE booting the installer, the url= command only works with earlier versions of SYSLINUX. The command does not work with SYSLINUX/PXELINUX version 3.70 and higher. Configures the VLAN for the network card.
ks=UUID:<partition-UUID>:/<path> ksdevice=<device> nameserver=<ip address> netdevice=<device>
netmask=<subnet mask> noapic text url=<url>

vlanid=<vlanid>

Boot the ESX Installer from the Installation DVD
When you boot the installer from a DVD, you use the local DVD-ROM drive or remote media, such as iLO or DRAC. Prerequisites You must have an ESX installation DVD. See Download the ESX ISO Image and Burn the Installation DVD, on page 25. Procedure Insert the DVD in the DVD-ROM drive. Use the BIOS to set the host to boot from the CD-ROM drive: a b c 3 Reboot the machine. Press a function key or Delete to enter the BIOS setup or boot menu for your machine. Set the CD-ROM drive as the first boot device.
(Optional) When the mode selection page appears, press F2 to enter boot options.

You now have an environment that you can using for PXE booting the ESX installer.
Sample DHCP Configuration
To PXE boot the ESX installer, the DHCP server must send the address of the TFTP server and a pointer to the pxelinux.0 or gpxelinux.0 directory. The DHCP server is used by the target machine to obtain an IP address. The DHCP server needs to know if the target machine is allowed to boot and the location is of PXELINUX binary (which usually resides on a TFTP server). When the target machine first boots, it broadcasts a packet across the network requesting this information to boot itself, and the DHCP server responds. CAUTION Setting up a new DHCP server is not recommended if your network already has one. If multiple DHCP servers respond to DHCP requests, machines can obtain incorrect or conflicting IP addresses, or can fail to receive the proper boot information. Seek the guidance of a network administrator in your organization before setting up a DHCP server. Many DHCP servers are capable of PXE booting hosts. The following samples are for ISC DHCP version 3.0, which is included with many Linux distributions. If you are using a version of DHCP for Microsoft Windows, refer to the DHCP server documentation to determine how to pass the next-server and filename arguments to the target machine.

gPXE Example

This sample shows how to configure the ISC DHCP server to enable gPXE.
allow booting; allow bootp; # gPXE options option space gpxe; option gpxe-encap-opts code 175 = encapsulate gpxe; option gpxe.bus-id code 177 = string class "pxeclients" { match if substring(option vendor-class-identifier, 0, 9) = "PXEClient"; next-server <TFTP server address>; if not exists gpxe.bus-id { filename "/gpxelinux.0"; }
} subnet <Network address> netmask <Subnet Mask> { range <Starting IP Address> <Ending IP Address>; }
When a machine attempts to PXE boot, the DHCP server provides an IP address and the location of the gpxelinux.0 binary on the TFTP server. The IP address assigned will be in the range defined in the subnet section of the configuration file.
PXELINUX (without gPXE) Example
This sample shows how to configure the ISC DHCP server to enable PXELINUX.

Required Files

In the PXE configuration file, you must include paths to the following files:
n n vmlinuz is the boot loader kernel code. initrd.img is the boot ramdisk.
The path test/ used in the example is relative to /tftpboot. The actual path is /tftpboot/test/ on the TFTP server.

Installation Mode

ks=nfs://10.20.118.55/ks.cfg is the path to the ESX installation script. In a scripted installation, your script
includes all the necessary responses to fill in the blanks, including the location of the installation media. In an interactive installation, omit the ks= option. If you are performing an interactive installation with the installation media at a remote location, include the askmedia boot option, which causes the installer to prompt you for the location of the installation media. ESX 3.x supported a hybrid installation. In this mode, you could supply an incomplete ESX installation script, and the installer prompts you for the missing parts. ESX 4.0 does not support this. You either have all responses in your ESX installation script or you have no script.

IPAPPEND

For scripted installations, the IPAPPEND option specifies that the same network adapter the machine boots from is also used for connecting to the network. When you include the IPAPPEND option in the PXE configuration file, omit the --device option to the installation script network command. The IPAPPEND option has no impact on interactive installations. The following snippet shows how to include the IPAPPEND option in the PXE configuration file:
label Installer menu default kernel http://<server>/vmlinuz append initrd=http://<server>/initrd.img mem=512M vmkopts=debugLogToSerial:1 ks=nfs://10.20.118.55/ks.cfg IPAPPEND 2
For the IPAPPEND flag_val, use IPAPPEND 2. IPAPPEND 1 is not required. If you omit the network --device option from the installation script, the IPAPPEND option from the PXE configuration file, and the netdevice bootstrap command, the installer uses the first plugged in network adapter.
Filename for the PXE Configuration File
For the filename of the PXE configuration file, choose one of the following:
n n n 01-<mac_address_of_target_ESX_host>. For example, 01-23-45-67-89-0a-bc
The target ESX host IP address in hexadecimal notation.

default

The initial boot file, pxelinux.0 tries to load a PXE configuration file. First it tries with the MAC address of the target ESX host, prefixed with its ARP type code (01 for Ethernet). If that fails, it tries with the hexadecimal notation of target ESX system IP address. Ultimately, it tries to load a file named default. For example, you might save the file on the TFTP server at /tftpboot/pxelinux.cfg/01-00-21-5a-ce-40-f6. The MAC address of the network adapter on the target ESX host is 00-21-5a-ce-40-f6.
File Location for the PXE Configuration File

--path=

Specifies the location where the virtual disk is created. The path must include a directory and a filename ending in.vmdk. For example: cos/defaultcos.vmdk. Specifies the name of the VMFS volume where the VMDK file is created. Uses the first VMFS volume on a disk that matches the given description and has more free space than the requested size. Uses the same argument format as autopart.
--onvmfs= --onfirstvmfs= (<disk-type1>, [<disk-type2>,.])

%include or include

Specifies an additional installation script to parse. You can add several include commands to your script. When you use the %include command, put the <filename> argument on the same line as the command.

<filename>

For example: %include part.cfg

%packages

Adds or removes a package from the installation ISO image.
packages.xmlrequirement="recommended" %packages -<package_name> # The package will not be installed.
The requirement="optional" tag means that the package is not installed by default. To override the default setting in the script, include:
%packages <package_name> # The package will be installed. --resolvedeps --ignoredeps
Installs the listed packages and automatically resolves package dependencies. Ignores the unresolved dependencies and installs the listed packages without the dependencies.

%pre (optional)

Specifies a script to be executed before the kickstart configuration is evaluated. For example, a %pre script can generate include files, as shown here:
# Partitioning %include part.cfg. %pre cat > /tmp/part.cfg <<EOF part /boot --fstype=ext3 --size= --onfirstdisk part storage1 --fstype=vmfs3 --size=10000 --grow --onfirstdisk part None --fstype=vmkcore --size=100 --onfirstdisk EOF --interpreter =[python|bash]
Specifies an interpreter to use. The default is bash.

%post (optional)

Executes the specified script after package installation has been completed. If you specify multiple %post sections, they are executed in the order they appear in the installation script. For example:
%post MY_MAC=`esxcfg-nics -l | tail -1 | awk '{print $7}'` CONF_URL="http://example.com/$MY_MAC" esxcfg-firewall --allowOutgoing --interpreter python -c "import urllib; urllib.urlretrieve('$CONF_URL', '/tmp/myconfig.sh')" esxcfg-firewall --blockOutgoing sh /tmp/myconfig.sh --interpreter =[perl|python|bash] --nochroot

VCDB_mssql.SQL purge_stat1_proc_mssql.sql purge_stat2_proc_mssql.sql purge_stat3_proc_mssql.sql purge_usage_stats_proc_mssql.sql stats_rollup1_proc_mssql.sql stats_rollup2_proc_mssql.sql stats_rollup3_proc_mssql.sql cleanup_events_mssql.sql delete_stats_proc_mssql.sql upsert_last_event_proc_mssql.sql
For all supported editions of Microsoft SQL Server (except Microsoft SQL Server 2005 Express), ensure that the SQL Server Agent service is running by using these additional scripts to set up scheduled jobs on the database.
job_schedule1_mssql.sql job_schedule2_mssql.sql job_schedule3_mssql.sql job_cleanup_events_mssql.sql
What to do next On the machine on which you intend to install vCenter Server, create a DSN that points to the database server with the schema. Run the vCenter Server installer. a If a database reinitialization warning message appears in the vCenter Server installer, select Do not overwrite, leave my existing database in place and continue the installation. This message appears if you are using a database that has vCenter Server tables created by a previous installation. The message does not appear if the database is clean. If you leave your existing database in place, you cannot join a Linked Mode group during the installation. You can join after the installation is complete. (See Join a Linked Mode Group After Installation, on page 101.) b When prompted, provide the database user login.
Configure a SQL Server ODBC Connection
When you install the vCenter Server system, you can establish a connection with a SQL Server database. If you use SQL Server for vCenter Server, do not use the master database. See your Microsoft SQL ODBC documentation for specific instructions regarding configuring the SQL Server ODBC connection. Prerequisites
Review the required database patches specified in vCenter Server Database Patch and Configuration Requirements, on page 71. If you do not prepare your database correctly, the vCenter Server installer displays error and warning messages. Create a database using SQL Server Management Studio on the SQL Server. Create a database user with database operator (DBO) rights. The default database for the DBO user is the one that you created using SQL Server Management Studio. Make sure that the database login has the db_owner fixed database role on the vCenter Server database and on the MSDB database. The db_owner role on the MSDB database is required for installation and upgrade only. You can revoke this role after installation.

<path> is the directory path to the /<installation directory>/vpx/dbschema folder. @<path>/VCDB_oracle.SQL @<path>/purge_stat1_proc_oracle.sql @<path>/purge_stat2_proc_oracle.sql @<path>/purge_stat3_proc_oracle.sql @<path>/purge_usage_stats_proc_oracle.sql @<path>/stats_rollup1_proc_oracle.sql @<path>/stats_rollup2_proc_oracle.sql @<path>/stats_rollup3_proc_oracle.sql @<path>/cleanup_events_oracle.sql @<path>/delete_stats_proc_oracle.sql
For all supported editions of Oracle Server, run these additional scripts to set up scheduled jobs on the database.
@<path>/job_schedule1_oracle.sql @<path>/job_schedule2_oracle.sql @<path>/job_schedule3_oracle.sql @<path>/job_cleanup_events_oracle.sql
You now have a database schema that is compatible with vCenter Server 4.0. What to do next On the machine where you are installing vCenter Server, create a DSN that points to the database server with the schema. Run the vCenter Server installer. a If a database reinitialization warning message appears in the vCenter Server installer, select Do not overwrite, leave my existing database in place and continue the installation. This message appears if you are using a database that has vCenter Server tables created by a previous installation. The message does not appear if the database is clean. If you leave your existing database in place, you cannot join a Linked Mode group during the installation. You can join after the installation is complete. (See Join a Linked Mode Group After Installation, on page 101.) b When prompted, provide the database user login.
Configure an Oracle Connection for Local Access
VMware recommends that the vCenter Server database be located on the same system as vCenter Server. Prerequisites Before configuring an Oracle connection, review the required database patches specified in vCenter Server Database Patch and Configuration Requirements, on page 71. If you do not prepare your database correctly, the vCenter Server installer displays error and warning messages.
Procedure Download Oracle 10g or Oracle 11g from the Oracle Web site, install it, and create a database. Configure the TNS Service Name option in the ODBC DSN. The TNS Service Name is the net service name for the database to which you want to connect. You can find the net service name in the tnsnames.ora file located in the NETWORK\ADMIN folder in the Oracle database installation location.
Configure an Oracle Connection for Remote Access
A vCenter Server system can access the database remotely. Prerequisites Before configuring an Oracle connection, review the required database patches specified in vCenter Server Database Patch and Configuration Requirements, on page 71. If you do not prepare your database correctly, the vCenter Server installer displays error and warning messages. Procedure 3 Install the Oracle client on the vCenter Server system machine. Download and install the ODBC driver. Create a new tablespace for a vCenter Server system using a SQL statement such as the following.

Chapter 11 Introduction to Installing vCenter Server
If you install an instance of vCenter Server as a local system account on a local SQL Server database with Integrated Windows NT Authentication and you add an Integrated Windows NT Authentication user to the local database server with the same default database as vCenter Server, vCenter Server might not start. To resolve this issue, remove the Integrated Windows NT Authentication user from the local SQL database server, or change the default database for the local system user account to the vCenter Server database for the SQL Server user account setup.
About Installing vCenter Server on IPv6 Machines
If the system on which you install vCenter Server is configured to use IPv6, vCenter Server uses IPv6. When you connect to that vCenter Server system or install additional modules, you must specify the server address in IPv6 format, unless you use the fully qualified domain name.
Configure the URLs on a Standalone vCenter Server System
If you are joining a standalone vCenter Server system to a Linked Mode group, the domain name of the system must match the machine name. If you change either name to make them match, you must also configure the vCenter Server URLs to make them compatible with the new domain name and machine name. If you do not update the URLs, remote instances of vCenter Server cannot reach the vCenter Server system, because the default vCenter Server URL entries are no longer accurate. The vCenter Server installer configures default URL entries as follows:
For the VirtualCenter.VimApiUrl key, the default value is http(s)://<FQDN of VC machine>/sdk. For the Virtualcenter.VimWebServicesUrl key, the default value is https://<FQDN of VC machine>:<installed-webservices-port>/vws.
Procedure 3 From the vSphere Client, connect directly to the vCenter Server instance on which you have changed the domain or host name. Select Administration > vCenter Server Settings and click Advanced Settings. For the Virtualcenter.VimApiUrl key, change the value to point to the location where the vSphere Client and SDK clients can access the vCenter Server system. For example: http(s)://<machine-name/ip>:<vc-port>/sdk. 4 For the Virtualcenter.VimWebServicesUrl key, change the value to point to the location where vCenter Server Webservices is installed. For example: https://<machine-name/ip>:<webservices-port>/vws. 5 For the Virtualcenter.Instancename key, change the value so that the modified name appears in the vCenter Server inventory view.

What to do next See Chapter 13, Postinstallation Considerations for vCenter Server, on page 95.
Postinstallation Considerations for vCenter Server
After you install vCenter Server, consider the postinstallation options and requirements.
Install the vSphere Client and make sure that you can access the vCenter Server instance. Check the license server configuration. A license server is required if this vCenter Server is managing ESX 3.x/ESXi 3.5 hosts. For information about installing the VMware License Server, see the documentation for VMware Infrastructure 3. For environments that require strong security, VMware recommends that you replace the default certificates on your vCenter Server system with certificates signed by a commercial Certificate Authority (CA). See vSphere 4.0 technical note Replacing vCenter Server Certificates at http://www.vmware.com/resources/techresources/. When vCenter Server and the database are installed on the same machine, after rebooting the machine, the VMware VirtualCenter Management Webservices service might not start. To start the service manually, select Settings > Control Panel > Administrative Tools > Services > VMware VirtualCenter Management Webservices and start the service. The machine might require several minutes to start the service. For Oracle databases, note the following: n For the Oracle Instant client, copy ojdbc14.jar to the vCenter Server tomcat directory (<vCenter install location>\Infrastructure\tomcat\lib)
The Oracle 10g client and Oracle 11g client come with ojdbc14.jar (<Install location>\oracle\product\10.2.0\<instance_name>\jdbc\lib or <Install
location>\app\Administrator\product\11.1.0\<instance_name>\sqldeveloper\jdbc\lib). The
vCenter Server installer copies the file from the Oracle client install location to the vCenter Server tomcat directory (<vCenter install location>\Infrastructure\tomcat\lib)
If the ojdbc14.jar file is not found in the Oracle 10g or Oracle 11g client location, the vCenter Server installer prompts you to copy the file manually. You can download the file from http://www.oracle.com/technology/software/tech/java/sqlj_jdbc/htdocs/jdbc101040.html.
Install the vSphere Client, on page 96 Install the vSphere Host Update Utility, on page 97 Uninstall VMware vSphere Components, on page 98
Install the vSphere Client
The vSphere Client enables you to connect to an ESX/ESXi host and to a vCenter Server system. Prerequisites
You must have the vCenter Server installer or the vSphere Client installer. You must be a member of the Administrators group on the machine.
Procedure 1 Run the vSphere Client installer.
In the vCenter Server installer, double-click the autorun.exe file at C:\<vc-installer location>\ and click VMware vSphere Client. If you downloaded the vSphere Client, double-click the VMware-viclient.exe file.

IDE disks 13 iLO 37 ILO 19 include command 48 initrd.img 37 install command 25, 48 installation logs 39, 42 installation script, creating 46 installation scripts, default 46 installing ESX 39, 42 vCenter Server 92 vCenter Server in a virtual machine 91 VirtualCenter Server 99 vSphere Client 96 vSphere Host Update Utility 97 installing ESX, scripted 45, 47 interactive installation 25 introduction to vSphere 11 IPAPPEND 34 IPv6 87
Ffirewall network-based 104 Windows 104 firewall command 48 firewallport command 48 FTP 29

JDBC 78

kernel 37 keyboard command 48 kickstart, differences with ESX 56 kickstart commands 56 kickstart file, creating 46 ks-first-safe.cfg 46 ks-first.cfg 46
global data 101, 102 Global.licenses permission 113 gpupdate /force command 103 gPXE 29 group policy update 103 groups, requirements 99 guest operating systems 18 GUID 103
LDAP 101 license expiration 119 license inventory 112 license key applying 117 names 110 license keys assigning 117 change history 111
hardware requirements, for vCenter Server 16
combining 111 dividing 111 license portal 111 license report, export data 116 license server 110 License Server configuration 111 license troubleshooting 119 licensed features 117 licenses, viewing 113 licensing adding license keys 114, 115 after evaluation 120 assigning 115 host 63 legacy assets 109 per processor 115 per-instance 110 per-processor 110 troubleshooting 118 Linked Mode affect on license inventory 112 and databases 100 and permissions 100 reachability 87, 100, 103 requirements 99 troubleshooting 103, 104 listening ports 18 local Oracle database 81, 83 local SQL Server database 74 logs, installation 39, 42
optional partitions 22, 61 Oracle database changing the computer name 73 creating a schema 80 remote access 82 requirements 71 script for creating 79 user 80 Oracle databases, postinstallation 95 Oracle, preparing database 81 OS repository 25
packages.xml 25 paranoid command 48 part command 48 partition command 48 partitioning optional 62 required 61 partitions 22, 61 patching 66 patching ESX/ESXi 67 patching hosts, with vSphere Host Update Utility 65 per-instance licensing 110 per-processor licensing 110, 115 permissions Global.licenses 113 Read-only 113 physical partitions 61 plugins 105 port port port port ports configuring 18 firewall 18 ports 1025 through ports used by vCenter Server 18 postinstallation options 95 postinstallation requirements 95 power on virtual machines 119 preparing database 83 prerequisites, ESX 21 prerequisites for installing vCenter Server 85 PXE configuration files 34 prerequisites 32 setup procedure 32 PXE boot, overview 29