Category: VMware

Designing VMware Cloud Foundation 9.1: The 31 Decisions You Need to Make

Every VCF deployment starts the same way: someone hands you a blank whiteboard and says design it. The problem is that VCF 9.1 is a broad platform, and without a structured approach it is easy to make decisions out of order, miss dependencies, or find out three phases in that an early choice locked you into something you did not intend.

Broadcom organizes the VCF 9.1 design process into nine phases covering 31 distinct decisions. This post walks through each phase, what the decisions are, and why they matter in practice. If you are using the VCF Designer tool, this maps directly to the decision schema it uses.

Phase 1: Starting Point and Profile

Before touching any configuration, you need two things nailed down: the design blueprint and the scope.

The Design Blueprint is your baseline deployment profile. Broadcom defines several: single site minimal, single site, multi-site single region, multi-region, and others covering application and security modernization. This is not a technical decision as much as it is a business one. It defines the complexity ceiling for everything that follows.

Scope and Use Cases is where you gate the rest of the design. VCF 9.1 can cover private cloud IaaS, Kubernetes via Supervisor, Private AI Foundation, vDefend lateral security, VCF Edge, and disaster recovery. What you check here enables or disables options in later phases. Do not mark something in scope unless there is a real requirement behind it.

Phase 2: Fleet-Level Decisions

The VCF Fleet Deployment Model defines how the fleet is laid out. A single VCF instance is the most common for customers starting out or running a standalone private cloud. A connected fleet with multiple instances comes into play when you have multiple sites or organizational boundaries that require separate management planes.

The VCF Fleet Sizing Model covers appliance sizing: Small, Medium, HA Medium, Large, and HA Large. Sizing here is not about your workload VMs. It is about the management plane itself. Undersizing the fleet appliances is one of the most common mistakes in early VCF deployments.

Phase 3: Consumption Decisions

This phase covers how cloud consumers interact with the platform. Five decisions, and they are tightly interconnected.

The VCF Automation Model decides whether VCF Automation is deployed and in what topology. If your organization needs self-service provisioning or catalog-driven deployments, you need this. If not, skip it. Running it just because it is available adds operational overhead without benefit.

The Network Consumption Model is one of the most consequential decisions in the entire design. VLAN, NSX Overlay Segments, VPC, or Transit Gateway. This drives downstream decisions on edge clusters, load balancers, and how workloads connect. Get this wrong and you are rearchitecting the network mid-project.

Workload Connectivity and Load Balancer Model follow from the network consumption choice. For load balancing, NSX Native covers most use cases. Avi (VCF Advanced LB) is needed when you require full L7 with advanced policies, SSL offload, or WAF capabilities.

Phase 4: Operations Decisions

Six decisions covering management services, management networking, operations tooling, logging, network observability, and recovery.

The VCF Management Services Model defines availability for SDDC Manager, vCenter, and NSX Manager. Standard vs. Highly Available. For production environments, the answer is almost always HA. The cost of an HA management plane is small compared to the cost of a failed SDDC Manager during a critical operation.

The VCF Management Network Model determines whether management components share a VLAN, use isolated VLANs per component, or run on NSX segments. NSX segments require NSX to be up before management components can communicate, which creates a chicken-and-egg risk during recovery scenarios. Plan this carefully.

The VCF Recovery Option aligns to your RPO and RTO requirements. Backup and restore, component-level recovery, and instance-level recovery each have different complexity and cost profiles. Define your recovery requirements before choosing this, not after.

Phase 5: Security and Compliance

Identity Broker and SSO decisions define how users authenticate to VCF components. Most enterprise environments will federate to Active Directory or an external IdP. Plan this early since it affects every component that needs authentication.

vDefend Lateral Security only applies if it was included in scope in Phase 1. If deployed, the Security Services Platform adds distributed IDS/IPS and east-west traffic inspection.

Phase 6: Virtual Infrastructure

Seven decisions covering domains, clusters, networking, and storage. This is where the design gets concrete.

The VCF Domain Model defines your management and workload domain topology. Single-AZ with one management plus one workload domain is the most common starting point. Stretched (multi-AZ) adds complexity but is required for metro HA.

The Storage Model is one of the decisions with the most downstream impact. VCF 9.1 supports vSAN OSA, vSAN ESA, NFS, VMFS on Fibre Channel, iSCSI, and NVMe variants. vSAN ESA is the recommended path for new deployments using compatible hardware. If you are connecting to an existing SAN or NAS, the external storage options apply.

NSX Manager topology and NSX Edge Cluster decisions define the control plane and data plane for your overlay network. Edge cluster sizing depends on the volume and type of north-south traffic. A shared NSX Manager cluster across domains reduces overhead. Dedicated per domain gives you blast radius isolation.

Phase 7: Physical Infrastructure

One decision: the Network Fabric Model. Routed VLAN fabric, Leaf-Spine VXLAN underlay, or EVPN-VXLAN fabric. This needs to be made in coordination with the network team. The fabric model affects how VLANs are extended across the environment and how the NSX overlay integrates with the underlay. EVPN-VXLAN provides the most flexibility for multi-site and stretched cluster scenarios.

Phase 8: Optional Workload Capabilities

VCF Edge and Private AI Foundation, both conditional on Phase 1 scope. For VCF Edge, single-host is suitable for small remote sites where HA is not required. Three-host provides local HA at the edge.

For Private AI Foundation, the compute model selection depends heavily on the type of workloads. Training workloads typically want full GPU passthrough or MIG. Inference workloads can often share via vGPU.

Phase 9: Closeout

Two workflow tasks, not configuration decisions. First, reconcile every decision made in Phases 1 through 8 against the Broadcom VCF Design Library to confirm alignment with supported patterns. Second, translate the finalized design into the VCF Planning and Preparation Workbook, which is the actual input consumed by the VCF Installer during bring-up. A clean design that does not translate into a properly completed workbook will cause bring-up failures. Budget time for this step.

The Full Decision Index

Step	Phase	Decision
1	Phase 1	Design Blueprint
2	Phase 1	Scope and Use Cases
3	Phase 2	VCF Fleet Deployment Model
4	Phase 2	VCF Fleet Sizing Model
5	Phase 3	VCF Automation Model
6	Phase 3	vSphere Supervisor Model
7	Phase 3	Network Consumption Model
8	Phase 3	Workload Connectivity Model
9	Phase 3	Load Balancer Model
10	Phase 4	VCF Management Services Model
11	Phase 4	VCF Management Network Model
12	Phase 4	VCF Operations Model
13	Phase 4	Log Management Model
14	Phase 4	VCF Operations for Networks Model
15	Phase 4	VCF Recovery Option
16	Phase 5	Identity Broker Model
17	Phase 5	VCF Single Sign-On Model
18	Phase 5	Lateral Security with vDefend
19	Phase 6	VCF Domain Model
20	Phase 6	vSphere Cluster Model
21	Phase 6	Distributed Switch Model
22	Phase 6	Storage Model
23	Phase 6	NSX Manager and Control Plane Model
24	Phase 6	NSX Edge Cluster Model
25	Phase 6	Virtual Network Appliance Cluster Model
26	Phase 7	Network Fabric Model
27	Phase 8	VCF Edge Model
28	Phase 8	Private AI Foundation Platform Model
29	Phase 8	Private AI Foundation Compute Model
30	Phase 9	Reconcile Against Broadcom Design Library
31	Phase 9	Produce the Planning and Preparation Workbook

June 1, 2026

Insights from a Nutanix Migration Specialist

My work life as an IT specialist has always been quite varied.

I spent part of my time installing traditional datacenter infrastructure, some of my time implementing cybersecurity solutions, and bits and pieces here and there, working on projects with a number of different technology vendors.

But over the past 18 months, my main focus has been: migrate customers’ virtualization environments to Nutanix.

The timing lines up with some big shakeups in the tech industry, as well as the continued growth of hyperconverged infrastructure (HCI). I heard my customers worry that support quality would decline for their existing environments, or that innovation might stall. In reality, what my customers have mostly seen is severe sticker shock on their renewal bills—partly due to inflation that has hit all sectors, but also due to dramatic changes to vendor licensing agreements.

Some customers have seen 3x, 5x, or even 10x increases in their virtualization costs, practically overnight. These are customers that have been with a vendor for 15 or 20 years, in many cases, and many had come to view their virtualization environments as something of a commodity with a stable pricing structure. But changes to licensing agreements have upended this stability. Before, customers could mostly purchase individual product licenses as needed, but they’re now being funneled into bundled packages with add-on features they don’t want and can’t use.

Some large enterprises are able to absorb these new costs. But for others—especially small and medium-sized companies—the impact to their business is comparable to tripling their rent, or adding a zero to their monthly utility bills. These smaller customers also find themselves in a poor negotiating position with tech giants.

For example, we recently worked with Norfolk Public Schools in Virginia to migrate to Nutanix. The district was facing an eye-popping 680% cost increase if it stayed with its previous provider, but a five-year licensing agreement saved it approximately $2 million.

For customers like Norfolk Public School, the numbers of the new virtualization landscape simply don’t add up. And for the first time, many of these organizations are willing to seriously consider a change.

Even non-technical people can understand the anxiety that comes with switching technology platforms. (Think of how rarely people change to a phone with a different operating system.) Most of my customers never even considered switching from their existing virtualization provider until recently. After all, virtualization is a foundational technology that supports their entire business. Many system administrators have built their careers and expertise around the environment they know, developed their own workflows around its interface and capabilities, and integrated their entire application environment with that platform.

Most importantly, businesses have come to rely on the stability of their virtualization environments to keep their mission-critical systems up and running. So, it’s understandable why many approach a change with a degree of trepidation. They want to know whether their applications will work the same way, how much downtime to expect, and whether their teams will need extensive retraining.

However, once customers make the move, they tend to find that Nutanix infrastructure provides everything they need—and often in a more intuitive way, at what essentially amounts to what they were paying before the market shifts of the past couple off years. During the pre-sales process, I sit with customers to walk them through the Nutanix interface. We spend much of this time exploring the equivalent functionality between the platforms, which is often mostly a matter of learning new terminology for familiar features.

At Norfolk Public Schools, we conducted site assessments, installed and configured new hardware, configured the Nutanix platform, and migrated more than 400 virtual machines—all in just over a month. The cutover to the new operating environment was seamless, and the district saw immediate improvements in performance and reliability.

For most organizations, the migration is just as painless. Some clients prefer to migrate in small batches of just a few virtual machines, while others are ready to move hundreds of virtual machines over a single weekend. The actual cutover process for each virtual machine takes only about five to ten minutes—comparable to the standard maintenance window for most security patches. Post-migration, customers typically notice improved performance (mostly due to new hardware). In addition to the cost savings, many also cite Nutanix’s simplified disaster recovery capabilities as a major benefit of the move.

After we start the migration, I can see the anxiety on my customers’ faces melt away, replaced by relief. Recently, one even started laughing. “This is so amazing!” he kept repeating. “This is so easy!”

February 4, 2026
vSphere Upgrade 6.0 to 6.5 Fails with Replace Process Level Token error.
Recently I was upgrading a vCenter 6.0 U2 to 6.5, and after successfully upgrading the external PSC, the process failed at the vCenter. After some troubleshooting, I found out that I needed to add the user to the “Replace a Process Level Token” attribute under the Local Security Policy. You can find the Microsoft documentation here. The process is simple:
1. Login into the vCenter Windows Server with your Administrator account.
2. Open the Control Panel and click the Administrative Tools.
3. Browse to and double click the Local Security Policy and then expand the Local Policies.
4. Click on User Rights Assignment and open the Replace a Process Level Token attribute.
5. Click the Add User or Group button to add the service account.
June 19, 2019
vCenter 6.7 upgrade walkthrough

VMware recently announced a new vSphere release, version 6.7. It includes new features like the Per-VM EVC and support for embedded PSC and vCenter in enhanced link mode (ELM). In this post, I will show a slideshow of the upgrade process in a topology with the Platform Service Controller separate from the vCenter server. Basically, this only means that you have to perform the upgrade twice. Before starting your upgrade make sure you have a good backup of your system, consult the vSphere 6.7 Release Notes and the related essential information about compatibility. First, we upgrade the external PSC, you’ll need a temporary IP address to deploy the new image before doing the final cut. The upgrade order is published in this VMware KB-53710. Make sure that all the host and IP address information is resolvable using DNS and that the NTP servers are working.

This slideshow requires JavaScript.

Once you have the PSC upgraded and running, you can move on to the vCenter in a similar process.

This slideshow requires JavaScript.

The topologies must stay the same when using the upgrade script. If you want to change from two VMs into an embedded deployment with the PSC and the vCenter in a single VM, then you’ll have to re-deploy your vCenter appliance.

April 20, 2018
How to re-register the embedded VMware Update Manager (VUM) to its vCenter (VCSA) 6.5
The time comes when you have to upgrade your system to add new features and functionality. Sometimes you find bugs and need to troubleshoot a little bit the situation. Precisely what happened to me when upgrading from VCSA 6.0 to VCSA 6.5 with embedded VMware Update Manager (VUM). It took me a little digging here and there and few messages to my colleagues in the VMware community, but finally I came up with the solution. The problem the system presented was this:
```
Error

Error attempting Vcintegrity Export file does not exist or is corrupted, abort import
Resolution

Please check vcIntegrity migration logs for details.
```
That came up at the end of the vCenter migration. The cause is that I had a VCSA with an external VUM. The migration assistant won’t help because the process is expecting to find the service in the old vCenter appliance (VCSA 6.0). This is a documented problem, and you’ll see the KB here. The first step is to remove the VUM from the old server, then deregister the Web Plugin from the new vCenter. At this moment go ahead and restart(stop and start) the web client service in the VCSA command line. Use the command “service-control –start vsphere-client” (VMware KB found here). And then either disable the VMware Update Manager plugin from the web client using the GUI or the MOB, these are the steps:
1. In a web browser, navigate to http://vCenter_Server_name_or_IP/mob.
  Where vCenter_Server_name_or_IP/mob is the name of your vCenter Server or its IP address.
2. Click Content.
3. Click ExtensionManager.
4. Select and copy the name of the plug-in you want to remove from the list of values under Properties. For a list of default plug-ins, see the Additional Information section of this article.
5. Click UnregisterExtension. A new window appears.
6. Paste the key (vcIntegrity) of the plug-in and click Invoke Method. This removes the plug-in and results in void.
7. Close the window.
8. Refresh the Managed Object Type:ManagedObjectReference:ExtensionManager window to verify that the plug-in is removed successfully.
The previous steps are found in this other VMware KB.

Then to register the VUM with the vCenter, you need to follow this procedure:
```
cd /lib/vmware-updatemgr/bin
mkdir backup
cp -p extension.xml backup/
cp -p vci-integrity.xml backup/
cp -p jetty-vum* backup/
```
Now go ahead and finish the failed registration with this command:
```
/lib/vmware-updatemgr/bin/vmware-vciInstallUtils -C /lib/vmware-updatemgr/bin/ -L /var/log/vmware/vmware-updatemgr/ -I /lib/vmware-updatemgr/bin/ -v <your vCenter FQDN> -p 80 -U administrator@<your SSO domain> -P <password> -S /lib/vmware-updatemgr/bin/extension.xml -O extupdate

chown updatemgr:updatemgr vci-integrity.xml

service-control --start vmware-updatemgr
```
In the command above replace the information within the <> with your own, for example <your vCenter FQDN> could be vcenter01.google.com.

Hopefully, that will save you some time in this specific case of a failed vCenter upgrade because the VUM was on a separate server than the vCenter.
February 21, 2018
Hacking Public Speaking
This morning I am crashing down on a bean bag to listen to a few tricks from newbies and seasoned public speakers alike on how to master this skill. Thanks to Ariel Sanchez (@arielsanchezmor ), Thom Greene (@tbgree00), Edward Haletky (@Texiwill), and Simon Long (@SimonLong_ ) for this excellent talk.
1. Create a mind map, and plan your flow of the presentation. If you present something you love, it comes easier.
2. If you are a mumbler or is not your first language, try to speak slower.
3. Pick a topic that you feel comfortable with and that you know pretty well.
4. Practice or rehearse, you don’t have to wait for an opportunity to speak in public to start preparing, if you know you love something you’ll eventually present about it.
5. Be realistic, sometimes there are questions you don’t know the answer to, don’t try to BS about, answer: “I don’t know, but I will found out, and I will get back to you.” But do follow up, at the end of the talk collect the contact information of the person to be able to deliver the answer.
6. Know yourself, some people are comfortable with being thrown into the cold water, others need to dip the toes. For example, talk to people before the session starts, or maybe have a ritual of something that you normally do to ease yourself.
7. Don’t stand in front of everyone waiting for the presentation to start.
8. Have confidence that the audience is there because they want to listen to what you are presenting and that you are the SME on that topic.
9. Make eye contact to get a feeling how the material is getting absorved. If you see that people are wondering, then you could change your strategy a little bit, this is why is really important to know the material by heart.
10. Record yourself practicing the presentation and post it on youtube, or at least record it with the idea in mind that it will be published.
11. Have some friends be there, and ask for pictures while you are presenting to celebrate afterwards. That though will pump you.
12. Give yourself time to prepare and to be able to share your presentation and content with friends to receive feedback with enough time to make corrections.
13. Have the talk ready in full with a few days of buffer, prepare something that you can use as it is, but then you can keep tuning up to the last moment.
14. Start preaparing as early as you can so you don’t get into a timing problem.
15. Support from family, co-workers, and friends helps a lot.
16. To get used to your voice, record yourself and listen to it as many times as you need to.
17. If you are presenting a demo, expect that it will go wrong and have a video as backup.
18. Don’t plan jokes, things will happen that will make you look funny anyway, smile a lot tho.
19. Nerves will be present, develop strategies to cope with it.
August 30, 2017
VMworld 2017 General Session Day Two

Day one at VMworld 2017 was huge, exciting announcements about VMWare on AWS and ubiquitous security via the NSX framework and AppDefense. Day two is action-packed. Michael Dell joins Pat Gelsinger on stage for this second-day general session. The digital transformation is the main topic around all the sessions, Michael Dell talks about how easy is to make smart gadgets and that it is all connected. The fuel for these engines is the data, without it even the best algorithms are useless.
Dell talks about how the drivers of the economy are small, medium and emerging business by employing most the workforce, and how VMware serves that market with a complete technology ecosystem.
The market is seeing growth with next generation applications and containers. Pivotal Cloud Foundry works together to shorten the gap between the IT people and the cool developer using the latest technologies, to make it happen, Rob, Pat and Mike announced Pivotal Container Services (PKS). Based on Kubernetes, it will allow customers to build scalable apps that can go from development to the real world in less time. Read more about it here.
VMware proposes a consistent environment across all platforms, in an entirely secure environment. The office of the CTO goes ahead and presents a demo of a complete suite of VMware Cloud products for the Elastic Sky Pizza hypothetical company. It is all focused-on simplicity, scalability, speed, automation, and security.

They provide a demo of the Pivotal Container Services to setup a platform for developers, and it only takes a few minutes on a single pane of glass. VMWare cloud services, built in the cloud and for the cloud. A technical preview of the automation services provides a visual representation of the system. You could provision this blueprint to any cloud.
Networking and Security are the main challenges for any cloud deployment. With NSX Cloud we can manage and deploy services via policies maintaining a consistent experience across all stages.

Wavefront by VMWare is a real-time metric, alerting and analytics platform that will help the developers identify and pinpoint the root cause of problems in applications deviating from normal behavior. This offering complements the suite that goes from the physical infrastructure all the way to the support of the application.
How does VMware’s future look? Pulse IoT Center will help manage sensors and objects that are connected. With function as a service AI algorithms can observe and act on the system providing immediate response to different needs or patterns.

Moving the functions to the data and not the other way around, bring the public cloud the edge of your on-prem DC.

In my opinion, we are witnessing the evolving of multiple clouds to just one. It will not be private, public, or hybrid; it will be one cloud on any device used by any app.

August 29, 2017
VMWorld 2017 End of Day One – What Now?
The first day is almost closing, great sessions, thousands of VMs and Hands on Labs, vBreakfast, vLunch, vBeers. Reunited with old friends, made some new ones. In summary, an awesome day and this is only the beginning! Where do we go from here? I mean that literally, don’t even think that I am going to solve your cloud migration problems right now. Tonight there are several activities, for most of them you will need a reservation or sponsor, but I guess you always know someone that knows someone, right? (except for the Mayweather bout) Here is a list to a few of the networking opportunities:
1. IGEL, Login VSI & Nutanix Exclusive Happy Hour
2. Dell/VMware/NVIDIA Channel Partner Dinner at Seafood at Mandalay Bay.
3. VMware Latin America reception
I will see you all tomorrow walking around, collecting swag and learning everything I can. ENJOY!
August 28, 2017
VMworld 2017 Day One General Session
This morning we woke to a couple of announcements from VMWare, first VMware on AWS is available on a By-The-Hour basis and also the new AppDefense security offering. At the main session, Pat welcomes a crowd of 20k+ participants and takes a minute to ask for help in any way to the victims of Hurricane Harvey. Every day across everything we do, touch, and see technology is changing the way we experience our surroundings. Changes in technology aim to create higher value jobs, not about bringing old jobs back. VMware’s vision of any device, any application, any cloud spans across all aspects of our life is now more pertinent with things like IoT, and it tries to get the users and apps closer and closer by delivering those apps in a simple but secure way. When listening to Capital One

By listening to Capital One, we can confirm that most companies now technology companies. That their business could be banking, food or marketing, but every company has to be a technology company to be able to reach the users in more efficient ways. From VMware’s https://cloud.vmware.com/vmc-aws we get what is VMware Cloud on AWS: “VMware Cloud on AWS is an on-demand service that enables you to run applications across vSphere-based cloud environments with access to a broad range of AWS services.” Some of the use cases for this new offering are:
1. Test and Development: without a massive capital investment you can start working in little time on new projects.
2. Migrate applications on-prem to off-prem and back, use this to grow only when needed and pay only for that time.
The pricing at this stage is as On Demand and pay only for what you use, later more offerings will be available.

The new security offering, AppDefense, is based on the NSX software defined networking platform. A new approach is needed to protect the apps and data. AppDefense is application focused, and it will identify and capture the behavior of the application, in this way it will be able to determine problems with it. After detecting anomalies, it will also be able to take actions (automated) depending on what is happening. This process is called “Capture Good”. One neat topic that came up is Cyber Hygiene. VMware published a new paper on it, and these are what VMware calls the five pillars:
1. Least Privilege
2. Micro-Segmentation
3. Encryption
4. Multi-Factor Authentication
5. Patching
Pat Gelsinger and Cyber Hygiene

You can find the paper here.

NSX is the key that glues it all together. I’ve been coming to VMworld for three years now, and every year I meet more and more people with NSX as part of their environments. It all answers to the need of agility and rapid growth. I’ve heard this too many times now: go fast or it will pass by you.
August 28, 2017
Assessment Led Selling
One on the most important gains at VMware Partner Exchange is learning how to approach a client to help them achieve their goals and solve their problems. We all know that we should lead with a solution and not a product, but to design the right solution we need a good understanding of their environment and a clear view of the need. With an assessment of the customer’s environment, we will have a better view of their system and may even find things that they are not aware of.

Leading the sales with an assessment means using tools, health checks, observations, and interviews to enable the sale of a solution.

Let me summarize why we should lead with an assessment.
1. Shortens the sales cycle by removing the objections to the solution that the client may think will not apply to their environment.
2. Increase your value as a trusted advisor by providing insight into the customer’s system that sometimes not even themselves know about.
3. Demonstrate the value of the solution with actual data and not just hypothetical cases.
4. Quantifies the benefits of the solution and amplifies the potential deal size.
Two examples of assessments that I use are:
It is important that the process is one in which all stakeholders are part of the assessment. The technical operations personnel will provide the devices and will facilitate the installation, and all executive level people will provide the budget.
August 27, 2017