VCP 6 – DCV Study Guide: Section 9 – Objective 9.2

May 8, 2015
Section 9: Configure and Administer vSphere Availability Solutions

Objective 9.2: Configure Advanced vSphere DRS Features. In this objective we should be covering these topics:
- Identify Distributed Resource Scheduler (DRS) affinity rules
- Enable/Disable Distributed Resource Scheduler (DRS) affinity rules
- Identify Distributed Resource Scheduler (DRS) Automation levels
- Configure Distributed Resource Scheduler (DRS) Automation levels
Create a DRS Cluster
When you add a host to a DRS cluster, the host’s resources become part of the cluster’s resources. In addition to this aggregation of resources, with a DRS cluster you can support cluster-wide resource pools and enforce cluster-level resource allocation policies.

The following cluster-level resource management capabilities are also available.

Load Balancing
The distribution and usage of CPU and memory resources for all hosts and virtual machines in the cluster are continuously monitored. DRS compares these metrics to an ideal resource utilization given the attributes of the cluster’s resource pools and virtual machines, the current demand, and the imbalance target. It then performs (or recommends) virtual machine migrations accordingly. See Virtual Machine Migration. When you first power on a virtual machine in the cluster, DRS attempts to maintain proper load balancing by either placing the virtual machine on an appropriate host or making a recommendation. See Admission Control and Initial Placement.
Power management
When the vSphere Distributed Power Management (DPM) feature is enabled, DRS compares cluster- and host-level capacity to the demands of the cluster’s virtual machines, including recent historical demand. It places (or recommends placing) hosts in standby power mode if sufficient excess capacity is found or powering on hosts if capacity is needed. Depending on the resulting host power state recommendations, virtual machines might need to be migrated to and from the hosts as well. See Managing Power Resources.
Affinity Rules
You can control the placement of virtual machines on hosts within a cluster, by assigning affinity rules. See Using DRS Affinity Rules.
Prerequisites
You can create a cluster without a special license, but you must have a license to enable a cluster for vSphere DRS (or vSphere HA).
Procedure
1. Right-click a data center in the vSphere Web Client and select New Cluster.
2. Name the cluster in the Name text box. This name appears in the vSphere Web Client navigator.
3. Select the DRS Turn ON check box.
4. Select a default automation level for DRS.

5. Set the migration threshold for DRS.
6. (Optional) Select the vSphere HA Turn ON check box to enable vSphere HA.

vSphere HA allows you to:

■ Enable host monitoring.
■ Enable admission control.
■ Specify the type of policy that admission control should enforce.
■ Adjust the monitoring sensitivity of virtual machine monitoring.
7. If appropriate, enable Enhanced vMotion Compatibility (EVC) and select the mode it should operate in.
8. Click OK to complete cluster creation.
A new cluster does not include any hosts or virtual machines.

Set a Custom Automation Level for a Virtual Machine
After you create a DRS cluster, you can customize the automation level for individual virtual machines to override the cluster’s default automation level.

For example, you can select Manual for specific virtual machines in a cluster with full automation, or Partially Automated for specific virtual machines in a manual cluster.

If a virtual machine is set to Disabled, vCenter Server does not migrate that virtual machine or provide migration recommendations for it. This is known as pinning the virtual machine to its registered host.
```
Note
If you have not enabled Enhanced vMotion Compatibility (EVC) for the cluster, fault tolerant virtual machines are set to DRS disabled. They appear on this screen, but you cannot assign an automation mode to them.
```
Procedure
1. Browse to the cluster in the vSphere Web Client navigator.
2. Click the Manage tab and click Settings.
3. Under Services, select vSphere DRS and click Edit. Expand DRS Automation.
4. Select the Enable individual virtual machine automation levels check box.
5. To temporarily disable any individual virtual machine overrides, deselect the Enable individual virtual machine automation levels check box. Virtual machine settings are restored when the check box is selected again.
6. To temporarily suspend all vMotion activity in a cluster, put the cluster in manual mode and deselect the Enable individual virtual machine automation levels check box.
7. Select one or more virtual machines.
8. Click the Automation Level column and select an automation level from the drop-down menu.
```
Note
Other VMware products or features, such as vSphere vApp and vSphere Fault Tolerance, might override the automation levels of virtual machines in a DRS cluster. Refer to the product-specific documentation for details.
```
Using DRS Affinity Rules
You can control the placement of virtual machines on hosts within a cluster by using affinity rules.

You can create two types of rules.

■ VM-Host Affinity Rules
A VM-Host affinity rule specifies whether or not the members of a selected virtual machine DRS group can run on the members of a specific host DRS group.

Unlike a VM-VM affinity rule, which specifies affinity (or anti-affinity) between individual virtual machines, a VM-Host affinity rule specifies an affinity relationship between a group of virtual machines and a group of hosts. There are ‘required’ rules (designated by “must”) and ‘preferential’ rules (designated by “should”.)

A VM-Host affinity rule includes the following components.

■ One virtual machine DRS group.
■ One host DRS group.
■ A designation of whether the rule is a requirement (“must”) or a preference (“should”) and whether it is affinity (“run on”) or anti-affinity (“not run on”).

Because VM-Host affinity rules are cluster-based, the virtual machines and hosts that are included in a rule must all reside in the same cluster. If a virtual machine is removed from the cluster, it loses its DRS group affiliation, even if it is later returned to the cluster.

Create a VM-Host Affinity Rule
You can create VM-Host affinity rules to specify whether or not the members of a selected virtual machine DRS group can run on the members of a specific host DRS group.

Prerequisites
Create the virtual machine and host DRS groups to which the VM-Host affinity rule applies.
Procedure
1. Browse to the cluster in the vSphere Web Client navigator.
2. Click the Manage tab.
3. Click Settings and click DRS Rules.
4. Click Add.
5. In the Create DRS Rule dialog box, type a name for the rule.
6. From the Type drop down menu, select Virtual Machines to Hosts.
7. Select the virtual machine DRS group and the host DRS group to which the rule applies.
8. Select a specification for the rule.

■ Must run on hosts in group. Virtual machines in VM Group 1 must run on hosts in Host Group A.
■ Should run on hosts in group. Virtual machines in VM Group 1 should, but are not required, to run on hosts in Host Group A.
■ Must not run on hosts in group. Virtual machines in VM Group 1 must never run on host in Host Group A.
■ Should not run on hosts in group. Virtual machines in VM Group 1 should not, but might, run on hosts in Host Group A.
9. Click OK.

Using VM-Host Affinity Rules
You use a VM-Host affinity rule to specify an affinity relationship between a group of virtual machines and a group of hosts. When using VM-Host affinity rules, you should be aware of when they could be most useful, how conflicts between rules are resolved, and the importance of caution when setting required affinity rules.

One use case where VM-Host affinity rules are helpful is when the software you are running in your virtual machines has licensing restrictions. You can place such virtual machines into a DRS group and then create a rule that requires them to run on a host DRS group that contains only host machines that have the required licenses.
```
Note
When you create a VM-Host affinity rule that is based on the licensing or hardware requirements of the software running in your virtual machines, you are responsible for ensuring that the groups are properly set up. The rule does not monitor the software running in the virtual machines nor does it know what non-VMware licenses are in place on which ESXi hosts.
```
If you create more than one VM-Host affinity rule, the rules are not ranked, but are applied equally. Be aware that this has implications for how the rules interact. For example, a virtual machine that belongs to two DRS groups, each of which belongs to a different required rule, can run only on hosts that belong to both of the host DRS groups represented in the rules.

When you create a VM-Host affinity rule, its ability to function in relation to other rules is not checked. So it is possible for you to create a rule that conflicts with the other rules you are using. When two VM-Host affinity rules conflict, the older one takes precedence and the newer rule is disabled. DRS only tries to satisfy enabled rules and disabled rules are ignored.

DRS, vSphere HA, and vSphere DPM never take any action that results in the violation of required affinity rules (those where the virtual machine DRS group ‘must run on’ or ‘must not run on’ the host DRS group). Accordingly, you should exercise caution when using this type of rule because of its potential to adversely affect the functioning of the cluster. If improperly used, required VM-Host affinity rules can fragment the cluster and inhibit the proper functioning of DRS, vSphere HA, and vSphere DPM.

A number of cluster functions are not performed if doing so would violate a required affinity rule.

■ DRS does not evacuate virtual machines to place a host in maintenance mode.
■ DRS does not place virtual machines for power-on or load balance virtual machines.
■ vSphere HA does not perform failovers.
■ vSphere DPM does not optimize power management by placing hosts into standby mode.

To avoid these situations, exercise caution when creating more than one required affinity rule or consider using VM-Host affinity rules that are preferential only (those where the virtual machine DRS group ‘should run on’ or ‘should not run on’ the host DRS group). Ensure that the number of hosts in the cluster with which each virtual machine is affined is large enough that losing a host does not result in a lack of hosts on which the virtual machine can run. Preferential rules can be violated to allow the proper functioning of DRS, vSphere HA, and vSphere DPM.
```
Note
You can create an event-based alarm that is triggered when a virtual machine violates a VM-Host affinity rule. In the vSphere Web Client, add a new alarm for the virtual machine and select VM is violating VM-Host Affinity Rule as the event trigger. For more information about creating and editing alarms, see the vSphere Monitoring and Performance documentation.
```
■ VM-VM Affinity Rules

A VM-VM affinity rule specifies whether selected individual virtual machines should run on the same host or be kept on separate hosts. This type of rule is used to create affinity or anti-affinity between individual virtual machines that you select.

When an affinity rule is created, DRS tries to keep the specified virtual machines together on the same host. You might want to do this, for example, for performance reasons.

With an anti-affinity rule, DRS tries to keep the specified virtual machines apart. You could use such a rule if you want to guarantee that certain virtual machines are always on different physical hosts. In that case, if a problem occurs with one host, not all virtual machines would be placed at risk.

When you add or edit an affinity rule, and the cluster’s current state is in violation of the rule, the system continues to operate and tries to correct the violation. For manual and partially automated DRS clusters, migration recommendations based on rule fulfillment and load balancing are presented for approval. You are not required to fulfill the rules, but the corresponding recommendations remain until the rules are fulfilled.

To check whether any enabled affinity rules are being violated and cannot be corrected by DRS, select the cluster’s DRS tab and click Faults. Any rule currently being violated has a corresponding fault on this page. Read the fault to determine why DRS is not able to satisfy the particular rule. Rules violations also produce a log event.
```
Note
VM-VM and VM-Host affinity rules are different from an individual host’s CPU affinity rules.
```
Create a VM-VM Affinity Rule
You can create VM-VM affinity rules to specify whether selected individual virtual machines should run on the same host or be kept on separate hosts.
```
Note
 If you use the vSphere HA Specify Failover Hosts admission control policy and designate multiple failover hosts, VM-VM affinity rules are not supported.
```
Procedure
1. Browse to the cluster in the vSphere Web Client navigator.
2. Click the Manage tab.
3. Click Settings and click DRS Rules.
4. Click Add.
5. In the Create DRS Rule dialog box, type a name for the rule.
6. From the Type drop-down menu, select either Keep Virtual Machines Together or Separate Virtual Machines.
7. Click Add.
8. Select at least two virtual machines to which the rule will apply and click OK.
9. Click OK.

VM-VM Affinity Rule Conflicts
You can create and use multiple VM-VM affinity rules, however, this might lead to situations where the rules conflict with one another.

If two VM-VM affinity rules are in conflict, you cannot enable both. For example, if one rule keeps two virtual machines together and another rule keeps the same two virtual machines apart, you cannot enable both rules. Select one of the rules to apply and disable or remove the conflicting rule.

When two VM-VM affinity rules conflict, the older one takes precedence and the newer rule is disabled. DRS only tries to satisfy enabled rules and disabled rules are ignored. DRS gives higher precedence to preventing violations of anti-affinity rules than violations of affinity rules.

Create a Host DRS Group
A VM-Host affinity rule establishes an affinity (or anti-affinity) relationship between a virtual machine DRS group with a host DRS group. You must create both of these groups before you can create a rule that links them.

Procedure
1. Browse to the cluster in the vSphere Web Client navigator.
2. Click the Manage tab.
3. Click Settings, and click DRS Groups.
4. In the DRS Groups section, click Add.
5. In the Create DRS Group dialog box, type a name for the group.
6. Select Host DRS Group from the Type drop down box and click Add.
7. Click the check box next to a host to add it. Continue this process until all desired hosts have been added.
8. Click OK.
What to do next
Using this host DRS group, you can create a VM-Host affinity rule that establishes an affinity (or anti-affinity) relationship with an appropriate virtual machine DRS group.

Create a Virtual Machine DRS Group
Affinity rules establish an affinity (or anti-affinity) relationship between DRS groups. You must create DRS groups before you can create a rule that links them.

Procedure
1. Browse to the cluster in the vSphere Web Client navigator.
2. Click the Manage tab.
3. Click Settings, and click DRS Groups.
4. In the DRS Groups section, click Add.
5. In the Create DRS Group dialog box, type a name for the group.
6. Select VM DRS Group from the Type drop down box and click Add.
7. Click the check box next to a virtual machine to add it. Continue this process until all desired virtual machines have been added.
8. Click OK.
VCP 6 – DCV Study Guide: Section 9 – Objective 9.1

April 14, 2015
Section 9: Configure and Administer vSphere Availability Solutions

Objective 9.1: Configure Advanced vSphere HA Features: In this objective we should be covering these topics:
- Explain Advanced vSphere HA settings
- Enable/Disable Advanced vSphere HA settings
- Explain how vSphere HA interprets heartbeats
- Interpret and correct errors during conversion
- Identify virtual machine override priorities
- Identify Virtual Machine Component Protection (VMCP) settings
vSphere HA Advanced Options
You can set advanced options that affect the behavior of your vSphere HA cluster.

vSphere HA Advanced Options

Note
If you change the value of any of the following advanced options, you must disable and then re-enable vSphere HA before your changes take effect.

■ das.isolationaddress[…]
■ das.usedefaultisolationaddress
■ das.isolationshutdowntimeout

For a complete list of vSphere HA advanced options, see the VMware knowledge base article at http://kb.vmware.com/kb/2033250.

Set Advanced Options
To customize vSphere HA behavior, set advanced vSphere HA options.

Prerequisites
Verify that you have cluster administrator privileges.
Procedure
1. In the vSphere Web Client, browse to the vSphere HA cluster.
2. Click the Manage tab and click Settings.
3. Under Settings, select vSphere HA and click Edit.
4. Expand Advanced Options.
5. Click Add and type the name of the advanced option in the text box. You can set the value of the option in the text box in the Value column.
6. Repeat step 5 for each new option that you want to add and click OK.
The cluster uses the options that you added or modified.
What to do next
Once you have set an advanced vSphere HA option, it persists until you do one the following:

■ Using the vSphere Web Client, reset its value to the default value.
■ Manually edit or delete the option from the fdm.cfg file on all hosts in the cluster.

Customize an Individual Virtual Machine
Each virtual machine in a vSphere HA cluster is assigned the cluster default settings for VM Restart Priority, Host Isolation Response, VM Component Protection, and VM Monitoring. You can specify specific behavior for each virtual machine by changing these defaults. If the virtual machine leaves the cluster, these settings are lost.

Procedure
1. In the vSphere Web Client, browse to the vSphere HA cluster.
2. Click the Manage tab and click Settings.
3. Under Settings, select VM Overrides and click Add.
4. Use the + button to select virtual machines to which to apply the overrides.
5. Click OK.
6. (Optional) You can change other settings, such as the Automation level, VM restart priority, Host isolation response, VMCP settings,VM Monitoring, or VM monitoring sensitivity settings.

Note
You can view the cluster defaults for these settings by first expanding Relevant Cluster Settings and then expanding vSphere HA.
7. Click OK.
The virtual machine’s behavior now differs from the cluster defaults for each setting that you changed.

Datastore Heartbeating
When the master host in a vSphere HA cluster can not communicate with a slave host over the management network, the master host uses datastore heartbeating to determine whether the slave host has failed, is in a network partition, or is network isolated. If the slave host has stopped datastore heartbeating, it is considered to have failed and its virtual machines are restarted elsewhere.

vCenter Server selects a preferred set of datastores for heartbeating. This selection is made to maximize the number of hosts that have access to a heartbeating datastore and minimize the likelihood that the datastores are backed by the same LUN or NFS server.

You can use the advanced option das.heartbeatdsperhost to change the number of heartbeat datastores selected by vCenter Server for each host. The default is two and the maximum valid value is five.

vSphere HA creates a directory at the root of each datastore that is used for both datastore heartbeating and for persisting the set of protected virtual machines. The name of the directory is .vSphere-HA. Do not delete or modify the files stored in this directory, because this can have an impact on operations. Because more than one cluster might use a datastore, subdirectories for this directory are created for each cluster. Root owns these directories and files and only root can read and write to them. The disk space used by vSphere HA depends on several factors including which VMFS version is in use and the number of hosts that use the datastore for heartbeating. With vmfs3, the maximum usage is approximately 2GB and the typical usage is approximately 3MB. With vmfs5 the maximum and typical usage is approximately 3MB. vSphere HA use of the datastores adds negligible overhead and has no performance impact on other datastore operations.

vSphere HA limits the number of virtual machines that can have configuration files on a single datastore. See Configuration Maximums for updated limits. If you place more than this number of virtual machines on a datastore and power them on, vSphere HA protects a number of virtual machines only up to the limit.

Note
A Virtual SAN datastore cannot be used for datastore heartbeating. Therefore, if no other shared storage is accessible to all hosts in the cluster, there can be no heartbeat datastores in use. However, if you have storage that can be reached by an alternate network path that is independent of the Virtual SAN network, you can use it to set up a heartbeat datastore.

VM Component Protection
If VM Component Protection (VMCP) is enabled, vSphere HA can detect datastore accessibility failures and provide automated recovery for affected virtual machines.

VMCP provides protection against datastore accessibility failures that can affect a virtual machine running on a host in a vSphere HA cluster. When a datastore accessibility failure occurs, the affected host can no longer access the storage path for a specific datastore. You can determine the response that vSphere HA will make to such a failure, ranging from the creation of event alarms to virtual machine restarts on other hosts.

Types of Failure
There are two types of datastore accessibility failure:

PDL
PDL (Permanent Device Loss) is an unrecoverable loss of accessibility that occurs when a storage device reports the datastore is no longer accessible by the host. This condition cannot be reverted without powering off virtual machines.
APD
APD (All Paths Down) represents a transient or unknown accessibility loss or any other unidentified delay in I/O processing. This type of accessibility issue is recoverable.

Configuring VMCP
VM Component Protection is enabled and configured in the vSphere Web Client. To enable this feature, you must select the Protect against Storage Connectivity Loss checkbox in the edit cluster settings wizard. The storage protection levels you can choose and the virtual machine remediation actions available differ depending on the type of database accessibility failure.

PDL failures
A virtual machine is automatically failed over to a new host unless you have configured VMCP only to Issue events.
APD events
The response to APD events is more complex and accordingly the configuration is more fine-grained.

After the user-configured Delay for VM failover for APD period has elapsed, the action taken depends on the policy you selected. An event will be issued and the virtual machine is restarted conservatively or aggressively. The conservative approach does not terminate the virtual machine if the success of the failover is unknown, for example in a network partition. The aggressive approach does terminate the virtual machine under these conditions. Neither approach terminates the virtual machine if there are insufficient resources in the cluster for the failover to succeed.

If APD recovers before the user-configured Delay for VM failover for APD period has elapsed, you can choose to reset the affected virtual machines, which recovers the guest applications that were impacted by the IO failures.

Configure Virtual Machine Responses
The Failure conditions and VM response page allows you to choose settings that determine how vSphere HA responds to host failures and isolations. These settings include the VM restart priority, host isolation response, settings for VM Component Protection, and VM monitoring sensitivity.

Virtual Machine Response page is editable only if you enabled vSphere HA.
Procedure
1. In the vSphere Web Client, browse to the vSphere HA cluster.
2. Click the Manage tab and click Settings.
3. Under Settings, select vSphere HA and click Edit.
4. Expand Failure Conditions and VM Response to display the configuration options.

5. Click OK.
Your Virtual Machine Response settings take effect.

vSphere HA Checklist
The vSphere HA checklist contains requirements that you must be aware of before creating and using a vSphere HA cluster.

Review this list before you set up a vSphere HA cluster. For more information, follow the appropriate cross reference.

■ All hosts must be licensed for vSphere HA.
■ A cluster must contain at least two hosts.
■ All hosts must be configured with static IP addresses. If you are using DHCP, you must ensure that the address for each host persists across reboots.
■ All hosts must have at least one management network in common. The best practice is to have at least two management networks in common. You should use the VMkernel network with the Management traffic checkbox enabled. The networks must be accessible to each other and vCenter Server and the hosts must be accessible to each other on the management networks. SeeBest Practices for Networking.
■ To ensure that any virtual machine can run on any host in the cluster, all hosts must have access to the same virtual machine networks and datastores. Similarly, virtual machines must be located on shared, not local, storage otherwise they cannot be failed over in the case of a host failure.

Note
vSphere HA uses datastore heartbeating to distinguish between partitioned, isolated, and failed hosts. So if some datastores are more reliable in your environment, configure vSphere HA to give preference to them.
■ For VM Monitoring to work, VMware tools must be installed. See VM and Application Monitoring.
■ vSphere HA supports both IPv4 and IPv6. See Other vSphere HA Interoperability Issues for considerations when using IPv6.
■ For VM Component Protection to work, hosts must have the All Paths Down (APD) Timeout feature enabled.
■ To use VM Component Protection, clusters must contain ESXi 6.0 hosts or later.
■ Only vSphere HA clusters that contain ESXi 6.0 or later hosts can be used to enable VMCP. Clusters that contain hosts from an earlier release cannot enable VMCP, and such hosts cannot be added to a VMCP-enabled cluster.
■ If your cluster uses Virtual Volume (vVol) datastores, when vSphere HA is enabled a configuration vVol is created on each vVol datastore by vCenter Server. In these containers, vSphere HA stores the files it uses to protect virtual machines. vSphere HA does not function correctly if you delete these containers. Only one container is created per vVol datastore.

Troubleshooting checklist for VMware Converter (1016330)
VCP 6 – DCV Study Guide: Section 10 – Objective 10.2

April 14, 2015
Section 10: Administer and Manage vSphere Virtual Machines

Objective 10.2: Create and Manage a Multisite Content Library: In this objective we should be covering these topics:
- Configure Content Library to work across sites
- Configure Content Library authentication
- Set/Configure Content Library roles
- Add/Remove Content Libraries
Using Content Libraries
Content libraries are container objects for VM templates, vApp templates, and other types of files. vSphere administrators can use the templates in the library to deploy virtual machines and vApps in the vSphere inventory. Sharing templates and files across multiple vCenter Server instances in same or different locations brings out consistency, compliance, efficiency, and automation in deploying workloads at scale.

A content library is managed from a single vCenter Server instance, but can be shared across multiple vCenter Server systems.

Each VM template, vApp template, or another type of file in a library is a library item. An item can contain a single file or multiple files. In the case of VM and vApp templates, each item contains multiple files. For example, because an OVF template is a set of multiple files, when you upload an OVF template to the library, you actually upload all the files associated with the template (.ovf, .vmdk, and .mf), but in the vSphere Web Client you see listing only of the .ovf file in the content library.

You can create two types of libraries: local or subscribed library.

Local Libraries
You use a local library to store items in a single vCenter Server instance. You can publish the local library so that users from other vCenter Server systems can subscribe to it. When you publish a content library externally, you can configure a password for authentication.

VM templates and vApps templates are stored as OVF file formats in the content library. You can also upload other file types, such as ISO images, text files, and so on, in a content library.
Subscribed Libraries
You subscribe to a published library by creating a subscribed library. The subscribed library can be created in the same vCenter Server instance where the published library is, or in a different vCenter Server system. When creating a subscribed library you have the option to download all the contents of the published library immediately after the subscribed library is created, or to download only metadata for the items from the published library. If you download only metadata for the items in a subscribed library, you save storage space. A subscribed library, which is set with the option to download all the content of the published library immediately, automatically synchronize with the published library on regular intervals to ensure the contents are up-to-date. You have to manually synchronize a subscribed library, which is set with the option to download contents from the published library only when needed.

If you use a subscribed library, you can only utilize the content, but cannot contribute with content. Only the administrator of the published library manages the templates and files.

Source Objects to Which You Can Subscribe By Creating a Subscribed Library in The vSphere Web Client.

Libraries store content on a file system or a datastore. To ensure optimal performance, use file systems for libraries that are published, and use datastores for local and subscribed libraries.

Create a Library
You can create a content library in the vSphere Web Client, and populate it with templates, which you can use to deploy virtual machines or vApps in your virtual environment.
Prerequisites
Required privileges: Content library. Create local library or Content library. Create subscribed library on the vCenter Server instance where you want to create the library.
Procedure
1. In the vSphere Web Client navigator, select vCenter Inventory Lists > Content Libraries.
2. Click the Objects tab.
3. Click the Create a New Library icon ( ).
4. Enter a name for the content library, and in the Notes text box, enter a description for the library, and click Next.
5. Select the type of content library you want to create.

6. Click Next.
7. Enter the path to a storage location where to keep the contents of this library.

8. Review the information on the Ready to Complete page, and click Finish.

Synchronize a Subscribed Library
To ensure that your subscribed library displays the latest content of the published library, you can manually initiate a synchronization task.
You can also have subscribed libraries automatically synchronize with the content of the published library. To enable automatic synchronization of the subscribed library, select the option to Enable automatic synchronization with the external library in the subscribed library settings. Take into account that the automatic synchronization requires a lot of storage space, because you download full copies of all the items in the published library.
Prerequisites
Required privilege: Content library. Sync subscribed library on the library.
Procedure
1. In the vSphere Web Client navigator, select vCenter Inventory Lists > Content Libraries.
2. Right-click a subscribed library from the list and select Synchronize Library.
A new task for synchronizing the subscribed library appears in the Recent Tasks pane. After the task is complete, you can see the updated list with library items in the Related Objects tab under Templates and Other Types.

Edit the Settings of a Local Library
You can change the settings of a content library. As an administrator of a content library, you can publish a local library from your vCenter Server instance to share its contents across multiple vCenter Server systems. From the Edit Setting dialog box, you can obtain the URL of your library and send it to other users to subscribe. If the library is already published, you can change its password for authentication. Users who are subscribed to your library must update the password to keep access to the published library.
Prerequisites
Required privileges: Content library. Update library and Content library. Update local library on the library.
Procedure
1. In the vSphere Web Client navigator, select vCenter Inventory Lists > Content Libraries.
2. Right-click a content library and select Edit Settings.
3. Edit the settings for the library.

4. Click OK.

Edit the Settings of a Subscribed Library
You can edit the settings of a subscribed library to optimize storage space and network bandwidth by switching between the options to download content from the published library. You might also need to update the password for authentication to the library if the administrator of the published library changes the password.

Prerequisites
Required privileges: Content library. Update subscribed library and Content library. Probe subscription information on the subscribed library.
Procedure
1. In the vSphere Web Client navigator, select vCenter Inventory Lists > Content Libraries.
2. Right-click a subscribed library and select Edit Settings.
3. Edit the settings of the subscribed library.

■ Enable or disable the automatic synchronization with the published library.
■ Update the password for authentication to the published library.
■ Select a download method. You can either download all library content immediately or download library content only when needed.

If you switch from the option to download content only when needed to the option to immediately download all library content, after confirming the dialog a synchronization task starts and content starts to download. The number and size of items in the published library determine the amount of time and network bandwidth that the task requires.
4. Click OK.

Delete a Content Library
You can delete a content library that you no longer want to use.

Prerequisites
Required privilege: Content library. Delete subscribed library or Content library. Delete local library on the type of library you want to delete.
Procedure
1. In the vSphere Web Client navigator, select vCenter Inventory Lists > Content Libraries.
2. Right-click a content library from the list and select Delete.
3. In the Delete library confirmation dialog box, click Yes.
The content library and all its contents are deleted.

Hierarchical Inheritance of Permissions for Content Libraries
vSphere objects inherit permissions from a parent object in the hierarchy. Content libraries work in the context of a single vCenter Server instance. However, content libraries are not direct children of a vCenter Server system from an inventory perspective.

The direct parent for content libraries is the global root. This means that if you set a permission at a vCenter Server level and propagate it to the children objects, the permission applies to data centers, folders, clusters, hosts, virtual machines, and so on, but does not apply to the content libraries that you see and operate with in this vCenter Server instance. To assign a permission on a content library, an Administrator must grant the permission to the user as a global permission. Global permissions support assigning privileges across solutions from a global root object.

The figure illustrates the inventory hierarchy and the paths by which permissions can propagate.

vSphere Inventory Hierarchy

To let a user manage a content library and its items, an Administrator can assign the Content Library Administrator role to that user as a global permission. The Content Library Administrator role is a sample role in the vSphere Web Client.

Users who are Administrators can also manage libraries and their contents. If a user is an Administrator at a vCenter Server level, they have sufficient privileges to manage the libraries that belong to this vCenter Server instance, but cannot see the libraries unless they have a Read-Only role as a global permission.

For example, a user has an Administrator role that is defined at a vCenter Server level. When the Administrator navigates to Content Libraries in the object navigator, he sees 0 libraries despite there are existing libraries in the vSphere inventory of that vCenter Server instance. To see the libraries, the Administrator needs a Read-Only role assigned as a global permission.

Administrators whose role is defined as a global permissions can see and manage the libraries in all vCenter Server instances that belong to the global root.

Because content libraries and their children items inherit permissions only from the global root object, when you navigate to a library or a library item and click Manage tab, you can see there is no Permissions tab. An Administrator cannot assign individual permissions on different libraries or different items within a library.

Sample User Role for Working with Content Libraries
vSphere Web Client provides a sample role that lets you be an administrator of content libraries. You can modify the role or use it as an example to create custom roles for specific tasks you want to allow other users to perform.

Content Library Administrator

Content Library Administrator role is a predefined role that gives a user privileges to monitor and manage a library and its contents.

A user who has this role can perform the following tasks:

■ Create, edit, and delete local or subscribed libraries.
■ Synchronize a subscribed library and synchronize items in a subscribed library.
■ View the item types supported by the library.
■ Configure the global settings for the library.
■ Import items to a library.
■ Export library items.

VCP 6 – DCV Study Guide: Section 10 – Objective 10.1

April 7, 2015

Section 10: Administer and Manage vSphere Virtual Machines

Objective 10.1: Configure Advanced vSphere Virtual Machine Settings

Identify available virtual machine configuration settings

You can view or change virtual machine settings from the vSphere Web Client. Not all options are available to every virtual machine and some options rarely need to change from their defaults.

The host that the virtual machine runs on and the guest operating system must support any configurations that you make.

When you select Edit Settings from a virtual machine right-button menu and click VM Options, you can select one of the following options.

Virtual Machine Options
Options	Description
General Options	Virtual machine name and location of the virtual machine configuration file and virtual machine working location. View or change the type and version of the guest operating system.
VMware Remote Console Options	Locking behavior and settings for simultaneous connections,
VMware Tools	Power Controls behavior, VMware Tools scripts, automatic upgrades, and time synchronization between the guest and host.
Power Management	Virtual machine Suspend behavior and wake on LAN.
Boot Options	Virtual machine boot options. Add a delay before booting, force entry into the BIOS or EFI setup screen, or set reboot options.
Advanced	Advanced virtual machine options. See the table below.
Fibre Channel NPIV	Virtual node and port World Wide Names (WWNs).

When you select Edit Settings from a virtual machine right-button menu, click VM Options, and click Advanced, you can select one of the following options.

Advanced Virtual Machine Options
Advanced Options	Description
Settings	Specify acceleration and logging settings.
Debugging and statistic	Specify the level of debugging information that is being collected.
Swap file location	Specify the swap file location.
Configuration Parameters	View, modify, or add configuration parameters.
Latency Sensitivity	Set a value for latency sensitivity.

Interpret virtual machine configuration files (.vmx) settings

View the Virtual Machine Configuration and Working File Location

You can view the location of the virtual machine configuration and working files. You can use this information when you configure backup systems.

Prerequisites

Verify that the virtual machine is powered off.

Procedure

1. Right-click a virtual machine in the inventory and select Edit Settings.

2. Click VM Options tab and expand General Options.

The path to the location of the virtual machine configuration file appears in the VM Config File text box. The path to the virtual machine working location appears in the VM Working Location text box.

What Is a Virtual Machine?

A virtual machine is a software computer that, like a physical computer, runs an operating system and applications. The virtual machine consists of a set of specification and configuration files and is backed by the physical resources of a host. Every virtual machine has virtual devices that provide the same functionality as physical hardware are more portable, more secure, and easier to manage.

A virtual machine consists of several files that are stored on a storage device. The key files are the configuration file, virtual disk file, NVRAM setting file, and log file. You configure virtual machine settings through the vSphere Web Client, one of the vSphere command-line interfaces (PowerCLI, vCLI) or the vSphere Web Services SDK.

Virtual Machine Files
File	Usage	Description
.vmx	vmname.vmx	Virtual machine configuration file
.vmxf	vmname.vmxf	Additional virtual machine configuration files
.vmdk	vmname.vmdk	Virtual disk characteristics
-flat.vmdk	vmname-flat.vmdk	Virtual machine data disk
.nvram	vmname.nvram or nvram	Virtual machine BIOS or EFI configuration
.vmsd	vmname.vmsd	Virtual machine snapshots
.vmsn	vmname.vmsn	Virtual machine snapshot data file
.vswp	vmname.vswp	Virtual machine swap file
.vmss	vmname.vmss	Virtual machine suspend file
.log	vmware.log	Current virtual machine log file
-#.log	vmware-#.log (where # is a number starting with 1)	Old virtual machine log files

VMX files – a VMX file is the primary configuration file for a virtual machine. When you create a new virtual machine and answer questions about the operating system, disk sizes, and networking, those answers are stored in this file. As you can see from the screenshot below, a VMX file is actually a simple text file that can be edited with Notepad. Example:

config.version = "8"
virtualHW.version = "3"
guestOS = "otherlinux"
displayname = "IPFire"
memsize = "256"
MemAllowAutoScaleDown = "FALSE"
usb.present = "TRUE"
ide0:0.present = "TRUE"
ide0:0.filename = "primaryMaster.vmdk"
#ide1:0.autodetect = "TRUE"
#ide1:0.filename = "auto detect"
#ide1:0.deviceType = "cdrom-raw"
ide1:0.present = "true"
ide1:0.deviceType = "cdrom-image"
ide1:0.filename = "ipfire-2.9.i586-full-core48.iso"
ide1:0.startConnected = "TRUE"
floppy0.present = "FALSE"
sound.present = "FALSE"
ethernet0.present = "TRUE"
ethernet0.addressType = "generated"
ethernet0.connectionType= "nat"
ethernet1.present = "TRUE"
ethernet1.addressType = "generated"
ethernet1.connectionType= "nat"

Identify virtual machine DirectPath I/O feature

DirectPath I/O allows virtual machine access to physical PCI functions on platforms with an I/O Memory Management Unit.

The following features are unavailable for virtual machines configured with DirectPath:

■ Hot adding and removing of virtual devices
■ Suspend and resume
■ Record and replay
■ Fault tolerance
■ High availability
■ DRS (limited availability. The virtual machine can be part of a cluster, but cannot migrate across hosts)
■ Snapshots

The following features are only available for virtual machines configured with DirectPath I/O on Cisco Unified Computing Systems (UCS) through Cisco Virtual Machine Fabric Extender (VM-FEX) distributed switches.

■ vMotion
■ Hot adding and removing of virtual devices
■ Suspend and resume
■ High availability
■ DRS
■ Snapshots

Enable DirectPath I/O with vMotion on a Virtual Machine
You can enable DirectPath I/O with vMotion for virtual machines in a datacenter on a Cisco UCS system that has at least one supported Cisco UCS Virtual Machine Fabric Extender (VM-FEX) distributed switch.

Prerequisites

1. Enable high performance network I/O on at least one Cisco UCS port profile on a supported Cisco VM-FEX distributed switch. For supported switches and switch configuration, see Cisco’s documentation at http://www.cisco.com/go/unifiedcomputing/b-series-doc.

2. Launch the vSphere Client and log in to a vCenter Server system.

3. Power off the virtual machine.

Procedure
1. Log in to the vSphere Client and select the VMs and Templates inventory view.
2. Right-click the virtual machine to modify and click Edit Settings.
3. On the Resources tab, select Memory.
4. Select Unlimited.
5. On the Hardware tab, select the network adapter to configure as a passthrough device.
6. Select a port profile with high performance enabled from the network label drop-down menu, and click OK.
7. Power on the virtual machine.

After the virtual machine is powered on, DirectPath I/O appears as Active on the Hardware tab of the virtual machine properties dialog box.

DirectPath I/O vs SR-IOV
SR-IOV offers performance benefits and tradeoffs similar to those of DirectPath I/O. DirectPath I/O and SR-IOV have similar functionality but you use them to accomplish different things.

SR-IOV is beneficial in workloads with very high packet rates or very low latency requirements. Like DirectPath I/O, SR-IOV is not compatible with certain core virtualization features, such as vMotion. SR-IOV does, however, allow for a single physical device to be shared amongst multiple guests.

With DirectPath I/O you can map only one physical function to one virtual machine. SR-IOV lets you share a single physical device, allowing multiple virtual machines to connect directly to the physical function.

Enable/Disable Advanced virtual machine settings

Edit Configuration File Parameters
You can change or add virtual machine configuration parameters when instructed by a VMware technical support representative, or if you see VMware documentation that instructs you to add or change a parameter to fix a problem with your system.

Prerequisites

Verify that you have the following privileges:

Virtual machine.Configuration.Advanced on the destination folder or datacenter, if you are configuring advanced virtual machine settings.

Procedure
1. Right-click a virtual machine in the inventory and select Edit Settings.
2. Click the VM Options tab and expand Advanced.
3. Click Edit Configuration.
4. (Optional) To add a parameter, click Add Row and type a name and value for the parameter.
5. (Optional) To change a parameter, type a new value in the Value text box for that parameter.
6. Click OK.

Disable Virtual Machine Acceleration

You might find that when you install or run software in a virtual machine, the virtual machine appears to stop responding. The problem occurs early in the program’s execution. You can get past the problem by temporarily disabling acceleration in the virtual machine.

This setting slows down virtual machine performance, so use it only for getting past the problem with running the program. After the program stops encountering problems, deselect Disable acceleration. You might be able to run the program with acceleration.

You can enable and disable acceleration when the virtual machine is running.

Procedure

1 Right-click a virtual machine in the inventory and select Edit Settings.
2 Click the VM Options tab and expand Advanced.
3 Click VM Options and expand Advanced.
4 Select Disable acceleration.
5 Click OK.
You should be able to install or run the software successfully.

Enable Virtual Machine Logging

You can enable logging to collect log files to help troubleshoot problems with your virtual machine.

ESXi hosts store virtual machine log files in the same directory as the virtual machine’s configuration files. By default, the log file name is vmware.log. Archived log files are stored as vmware-n.log, where n is a number in sequential order beginning with 1.

Prerequisites

Required privilege: Virtual machine.Configuration.Settings
Procedure

1 Right-click a virtual machine in the inventory and select Edit Settings.
2 Click the VM Options tab and expand Advanced.
3 In the Settings row, select Enable logging and click OK.
You can view and compare log files in the same storage location as the virtual machine configuration files.

Configure Virtual Machine Debugging and Statistics

You can run a virtual machine so that it collects additional debugging information that is helpful to VMware technical support in resolving issues.

Prerequisites

Power off the virtual machine.

Procedure

1 Right-click a virtual machine in the inventory and select Edit Settings.
2 Click the VM Options tab and expand Advanced.
3 Select a debugging and statistics option from the drop-down menu.

Run normally
Record Debugging Information
Record Statistics
Record Statistics and Debugging Information

The number of debugging and statistics options available depends on the host software type and version. On some hosts, some options are not available.

4 Click OK.
Change the Swap File Location

When a virtual machine is powered on, the system creates a VMkernel swap file to serve as a backing store for the virtual machine’s RAM contents. You can accept the default swap file location or save the file to a different location. By default, the swap file is stored in the same location as the virtual machine’s configuration file.

Procedure

Right-click a virtual machine in the inventory and select Edit Settings.
Click the VM Options tab and expand Advanced.
Select a swap file location option.
Click OK.

Edit Configuration File Parameters

You can change or add virtual machine configuration parameters when instructed by a VMware technical support representative, or if you see VMware documentation that instructs you to add or change a parameter to fix a problem with your system.

IMPORTANT Changing or adding parameters when a system does not have problems might lead to decreased system performance and instability.

The following conditions apply:

To change a parameter, you change the existing value for the keyword/value pair. For example, if you start with the keyword/value pair, keyword/value, and change it to keyword/value2, the result is keyword=value2.
You cannot delete a configuration parameter entry.

CAUTION You must assign a value to configuration parameter keywords. If you do not assign a value, the keyword can return a value of 0, false, or disable, which can result in a virtual machine that cannot power on.

Procedure

1 Right-click a virtual machine in the inventory and select Edit Settings.
2 Click the VM Options tab and expand Advanced.
3 Click Edit Configuration.
4 (Optional) To add a parameter, click Add Row and type a name and value for the parameter.
5 (Optional) To change a parameter, type a new value in the Value text box for that parameter.
6 Click OK.

Enabling the latency-sensitivity feature for a given VM.

The latency-sensitivity feature is applied per VM, and thus a vSphere host can run a mix of normal VMs and VMs with this feature enabled. To enable the latency sensitivity for a given VM from the UI, access the Advanced Settings from the VM Options tab in the VM’s Edit Settings pop-up window and select High for the Latency Sensitivity

VCP 6 – DCV Study Guide: Section 1 – Objective 1.1

April 3, 2015
Section 1: Configure and Administer vSphere 6.x Security

Objective 1.1: Configure and Administer Role-based Access Control

Users, and roles control who has access to vSphere components and what actions each user can perform. A role is a predefined set of privileges. Privileges define rights to perform actions and read properties. For example, the Virtual Machine Administrator role consists of read properties and of a set of rights to perform actions. The role allows a user to read and change virtual machine attributes. When you assign permissions, you pair a user or group with a role and associate that pairing with an inventory object. A single user or group can have different roles for different objects in the inventory.

Compare and contrast propagated and explicit permission assignments

see Hierarchical Inheritance of Permissions below

View/Sort/Export user and group lists

You can view, sort, and export lists of a host’s local users to a file that is in HTML, XML, Microsoft Excel, or CSV format.

Procedure
1. Log in to ESXi using the vSphere Client.
2. Click the Local Users & Groups tab and click Users .
3. Determine how to sort the table, and hide or show columns according to the information you want to see in the exported file.

■ To sort the table by any of the columns, click the column heading.
■ To show or hide columns, right-click any of the column headings and select or deselect the name of the column to hide.
■ To show or hide columns, right-click any of the column headings and select or deselect the name of the column to hide.

4. Right-click anywhere in the table and click Export List to open the Save As dialog box.
5. Select a path and enter a filename.
6. Select the file type and click OK.

Add/Modify/Remove permissions for users and groups on vCenter Server inventory objects

A permission is set on an object in the vCenter object hierarchy. Each permission associates the object with a group or user and the group’s or user’s access roles. For example, you can select a virtual machine object, add one permission that gives the ReadOnly role to Group 1, and add a second permission that gives the Administrator role to User 2.

By assigning a different role to a group of users on different objects, you control the tasks that those users can perform in your vSphere environment. For example, to allow a group to configure memory for the host, select that host and add a permission that grants a role to that group that includes the Host.Configuration.Memory Configurationprivilege.

To manage permissions from the vSphere Web Client, you need to understand the following concepts:

Permissions
Each object in the vCenter Server object hierarchy has associated permissions. Each permission specifies for one group or user which privileges that group or user has on the object.
Users and Groups
On vCenter Server systems, you can assign privileges only to authenticated users or groups of authenticated users. Users are authenticated through vCenter Single Sign-On. The users and groups must be defined in the identity source that vCenter Single Sign-On is using to authenticate. Define users and groups using the tools in your identity source, for example, Active Directory.
Roles
Roles allow you to assign permissions on an object based on a typical set of tasks that users perform. Default roles, such as Administrator, are predefined onvCenter Server and cannot be changed. Other roles, such as Resource Pool Administrator, are predefined sample roles. You can create custom roles either from scratch or by cloning and modifying sample roles.
Privileges
Privileges are fine-grained access controls. You can group those privileges into roles, that you can then map to users or groups.

Change Permissions
After a user or group and role pair is set for an inventory object, you can change the role paired with the user or group or change the setting of the Propagate check box. You can also remove the permission setting.

Procedure
1. Browse to the object in the vSphere Web Client object navigator.
2. Click the Manage tab and select Permissions.
3. Click the line item to select the user or group and role pair.
4. Click Change role on permission.
5. Select a role for the user or group from the Assigned Role drop-down menu.
6. To propagate the privileges to the children of the assigned inventory object, click the Propagate check box and click OK.
Add a Permission to an Inventory Object

After you create users and groups and define roles, you must assign the users and groups and their roles to the relevant inventory objects. You can assign the same permissions to multiple objects simultaneously by moving the objects into a folder and setting the permissions on the folder.

When you assign permissions from the vSphere Web Client, user and group names must match Active Directory precisely, including case. If you upgraded from earlier versions of vSphere, check for case inconsistencies if you experience problems with groups.
Prerequisites
On the object whose permissions you want to modify, you must have a role that includes the Permissions.Modify permission privilege.
Procedure
1. Browse to the object for which you want to assign permissions in the vSphere Web Client object navigator.
2. Click the Manage tab and select Permissions.
3. Click the Add icon, and click Add.
4. Identify the user or group that will have the privileges defined by the selected role.
  1. From the Domain drop-down menu, select the domain where the user or group is located.
  2. Type a name in the Search box or select a name from the list. The system searches user names, group names, and descriptions.
  3. Select the user or group and click Add. The name is added to either the Users or Groups list.
  4. (Optional) Click Check Names to verify that the user or group exists in the identity source.
  5. Click OK.
5. Select a role from the Assigned Role drop-down menu. The roles that are assigned to the object appear in the menu. The privileges contained in the role are listed in the section below the role title.
6. (Optional) To limit propagation, deselect the Propagate to Child Objects check box. The role is applied only to the selected object and does not propagate to the child objects.
7. Click OK to add the permission.
Determine how permissions are applied and inherited in vCenter Server

The permission model for vCenter Server systems relies on assigning permissions to objects in the vSphere object hierarchy. Each permission gives one user or group a set of privileges, that is, a role for the selected object.

You need to understand the following concepts:

Permissions
Each object in the vCenter Server object hierarchy has associated permissions. Each permission specifies for one group or user which privileges that group or user has on the object.
Users and Groups
On vCenter Server systems, you can assign privileges only to authenticated users or groups of authenticated users. Users are authenticated through vCenter Single Sign-On. The users and groups must be defined in the identity source that vCenter Single Sign-On is using to authenticate. Define users and groups using the tools in your identity source, for example, Active Directory.
Roles
Roles allow you to assign permissions on an object based on a typical set of tasks that users perform. Default roles, such as Administrator, are predefined onvCenter Server and cannot be changed. Other roles, such as Resource Pool Administrator, are predefined sample roles. You can create custom roles either from scratch or by cloning and modifying sample roles.
Privileges
Privileges are fine-grained access controls. You can group those privileges into roles, that you can then map to users or groups.

To assign permissions to an object, you follow these steps:

1. Select the object in the vCenter object hierarchy to which you want to apply the permission.
2. Select the group or user that should have privileges on the object.
3. Select the role, that is the set of privileges, that the group or user should have on the object. By default, permissions propagate, that is the group or user has the selected role on the selected object and its child objects.

Hierarchical Inheritance of Permissions

When you assign a permission to an object, you can choose whether the permission propagates down the object hierarchy. You set propagation for each permission. Propagation is not universally applied. Permissions defined for a child object always override the permissions that are propagated from parent objects.

vSphere Inventory Hierarchy

Most inventory objects inherit permissions from a single parent object in the hierarchy. For example, a datastore inherits permissions from either its parent datastore folder or parent data center. Virtual machines inherit permissions from both the parent virtual machine folder and the parent host, cluster, or resource pool simultaneously.

Create/Clone/Edit vCenter Server Roles

Creating a Custom Role

You can create vCenter Server custom roles to suit the access control needs of your environment.

If you create or edit a role on a vCenter Server system that is part of the same vCenter Single Sign-On domain as other vCenter Server systems, the VMware Directory Service (vmdir) propagates the changes that you make to all other vCenter Server systems in the group. Assignments of roles to specific users and objects are not shared across vCenter Server systems.

Prerequisites
Verify that you are logged in as a user with Administrator privileges.

Procedure
1. Log in to vCenter Server with the vSphere Web Client.
2. Select Home, click Administration, and click Roles.
3. Click the Create role action (+) button.
4. Type a name for the new role.
5. Select privileges for the role and click OK.

Once you’ve created or modified the roles as needed, you can assign the roles to the users and groups associated with your ESX/ESXi host or vCenter Server.

Cloning a Role
You can make a copy of an existing role, rename it, and edit it. When you make a copy, the new role is not applied to any users or groups and objects. You must assign the role to users or groups and objects.

If you create or edit a role on a vCenter Server system that is part of the same vCenter Single Sign-On domain as other vCenter Server systems, the VMware Directory Service (vmdir) propagates the changes that you make to all other vCenter Server systems in the group. Assignments of roles to specific users and objects are not shared acrossvCenter Server systems.
Prerequisites
Verify that you are logged in as a user with Administrator privileges.
Procedure
1. Log in to vCenter Server with the vSphere Web Client.
2. Select Home, click Administration, and click Roles.
3 Select a role, and click the Clone role action icon.
4 Type a name for the cloned role.
5 Select or deselect privileges for the role and click OK.

Edit a Role
When you edit a role, you can change the privileges selected for that role. When completed, these privileges are applied to any user or group that is assigned the edited role.

If you create or edit a role on a vCenter Server system that is part of the same vCenter Single Sign-On domain as other vCenter Server systems, the VMware Directory Service (vmdir) propagates the changes that you make to all other vCenter Server systems in the group. Assignments of roles to specific users and objects are not shared across vCenter Server systems.
Prerequisites
Verify that you are logged in as a user with Administrator privileges.
Procedure
1. Log in to vCenter Server with the vSphere Web Client.
2. Select Home, click Administration, and click Roles.
3. Select a role and click the Edit role action button.
4. Select or deselect privileges for the role and click OK.

Configure VMware Directory Service

The VMware Directory service (vmdir) is associated with the domain you specify during installation and is included in each embedded deployment and on each Platform Services Controller. This service is a multi-tenanted, multi-mastered directory service that makes an LDAP directory available on port 389. The service still uses port 11711 for backward compatibility with vSphere 5.5 and earlier systems.

If your environment includes more than one instance of the Platform Services Controller, an update of vmdir content in one vmdir instance is propagated to all other instances of vmdir.

Starting with vSphere 6.0, the VMware Directory Service stores not only vCenter Single Sign-On information but also certificate information.

Replace the VMware Directory Service Certificate (from the Security Guide)
If you decide to use a new VMCA root certificate, and you unpublish the VMCA root certificate that was used when you provisioned your environment, you must replace the machine SSL certificates, solution user certificates, and certificates for some internal services.
If you unpublish the VMCA root certificate, you must replace the SSL Signing Certificate that is used by vCenter Single Sign-On. See “Refresh the Security Token Service (STS) Root Certificate,” on page 36. You must also replace the VMware Directory Service (vmdir) certificate.
Prerequisites
Request a certificate for vmdir for your third-party or enterprise CA.
Procedure
1. Stop vmdir.
  Linux: service-control –stop vmdird
  Windows: service-control –stop VMWareDirectoryService
2. Copy the certificate and key that you just generated to the vmdir location.
  Linux: cp vmdir.crt /usr/lib/vmware-vmdir/share/config/vmdircert.pem
  cp vmdir.priv /usr/lib/vmware-vmdir/share/config/vmdirkey.pem
  Windows: copy vmdir.crt C:\programdata\vmware\vCenterServer\cfg\vmdird\vmdircert.pem
  copy vmdir.priv C:\programdata\vmware\vCenterServer\cfg\vmdird\vmdirkey.pem
3. Restart vmdir from the vSphere Web Client or using the service-control command.
  Linux: service-control –start vmdird
  Windows: service-control –start VMWareDirectoryService
Apply a role to a User/Group and to an object or group of objects

There a few things to keep in mind when configuring access controls in VMware, however. First of all, if a group is assigned a role, all of the users in that group are given those same privileges unless the users have roles of their own assigned. Second of all, if a user is assigned privileges in VMware, those privileges take precedence over the privileges of the group.

For example, User A and User B are assigned to Group 1. Group 1 has been assigned the Read-Only role. User A doesn’t have a role assigned to it, so it automatically gets all of the permissions given to Group 1. User B, however, has been assigned the No Access role, so User B has no permissions at all.

VMware also validates the users and groups in Windows Active Directory against the users and groups in vCenter Server. So, if a user or group exists in vCenter Server, but doesn’t exist in the domain, VMware will delete all of the permissions associated with the user or group during validation.

You can also assign privileges to multiple inventory objects in VMware by creating a folder and moving all of the appropriate objects to that folder.

Assigning a Role
1. Go to Home, Inventory, and then Hosts and Clusters. Click the inventory object and then click “Permissions.”
2. Right-click an empty area in the right pane, then click “Add Permissions” to open the Assign Permissions window.
3. Click “Add” and insert the appropriate user(s) or group(s). Select the desired role for the user(s) from the drop-down menu.
4. Review the list of permissions in the right pane. To prevent access to child objects, uncheck “Propagate to Child Objects.”
5. Click “OK” to assign the permissions to the selected user(s) or group(s).

Change permission validation settings

vCenter Server periodically validates its user and group lists against the users and groups in the Windows Active Directory domain. It then removes users or groups that no longer exist in the domain. You can change the interval between validations.

Procedure
1. From the vSphere Client connected to a vCenter Server system, select Administration > vCenter Server Settings.
2. In the navigation pane, select Active Directory.
3. (Optional) Deselect the Enable Validation check box to disable validation. Validation is enabled by default. Users and groups are validated when vCenter Server system starts, even if validation is disabled.
4. If validation is enabled, enter a value in the Validation Period text box to specify a time, in minutes, between validations.
Determine the appropriate set of privileges for common tasks in vCenter Server

Many tasks require permissions on more than one object in the inventory. You can review the privileges that are required to perform the tasks and, where applicable, the appropriate sample roles.

If the task that you want to perform is not in this table, the following rules can help you determine where you must assign permissions to allow particular operations:
- Any operation that consumes storage space, such as creating a virtual disk or taking a snapshot, requires the Datastore.Allocate Space privilege on the target datastore, as well as the privilege to perform the operation itself.
- Moving an object in the inventory hierarchy requires appropriate privileges on the object itself, the source parent object (such as a folder or cluster), and the destination parent object.
- Each host and cluster has its own implicit resource pool that contains all the resources of that host or cluster. Deploying a virtual machine directly to a host or cluster requires the Resource.Assign Virtual Machine to Resource Pool privilege.
The images below present common tasks that require more than one privilege. You can add permissions to inventory objects by pairing a user with one of the predefined roles, or you can create custom roles with the set of privileges that you expect to use multiple times.

Compare and contrast default system/sample roles

vCenter Server provides system roles and sample roles by default:

System roles
System roles are permanent. You cannot edit the privileges associated with these roles.
Sample roles
VMware provides sample roles for certain frequently performed combination of tasks. You can clone, modify or remove these roles.

vCenter Server System Roles
A role is a predefined set of privileges. When you add permissions to an object, you pair a user or group with a role. vCenter Server includes several system roles, which you cannot change. vCenter Server provides a small number of default roles. You cannot change the privileges associated with the default roles. The default roles are organized as a hierarchy; each role inherits the privileges of the previous role. For example, the Administrator role inherits the privileges of the Read Only role. Roles that you create do not inherit privileges from any of the system roles.
- Administrator Role
  Users assigned the Administrator role for an object are allowed to view and perform all actions on the object. This role also includes all privileges inherent in the Read Only role. If you are acting in the Administrator role on an object, you can assign privileges to individual users and groups. If you are acting in the Administrator role in vCenter Server, you can assign privileges to users and groups in the default vCenter Single Sign-On identity source. Supported identity services include Windows Active Directory and OpenLDAP 2.4.
  By default, the administrator@vsphere.local user has the Administrator role on both vCenter Single Sign-On and vCenter Server after installation. That user can then associate other users with the Administrator role on vCenter Server.
- No Access Role
  Users assigned the No Access role for an object cannot view or change the object in any way. New users and groups are assigned this role by default. You can change the role on an object-by-object basis.
  The administrator@vsphere.local user, the root user, and vpxuser are the only users not assigned the No Access role by default. Instead, they are assigned the Administrator role. You can remove the root user from any permissions or change its role to No Access as long as you first create a replacement permission at the root level with the Administrator role and associate this permission with a different user.
- Read Only Role
  Users assigned the Read Only role for an object are allowed to view the state of the object and details about the object. With this role, a user can view virtual machine, host, and resource pool attributes. The user cannot view the remote console for a host. All actions through the menus and toolbars are disallowed.
vCenter Server Sample Roles
- Virtual Machine Administrator: A sample role that allows a user complete and total control of a virtual machine or a host, up to and including removing that VM or host
- Virtual Machine Power User: A sample role that grants a user access rights only to virtual machines; can alter the virtual hardware or create snapshots of the VM
- Virtual Machine User: Grants user access rights exclusively to VMs. The user can power on, power off, and reset the virtual machine, as well as run media from the virtual discs.
- Resource Pool Administrator: Allows the user to create resource pools (RAM and CPU reserved for use) and assign these pools to virtual machines
- Datacenter Administrator: Permits a user to add new datacenter objects
- VMware Consolidated Backup User: Required to allow VMware Consolidated Backup to run
- Datastore Consumer: Allows the user to consume space on a datastore
- Network Consumer: Allows the user to assign a network to a virtual machine or a host
For a list of Common Privileges, scroll down to “Determine the appropriate set of privileges for common tasks in vCenter Server”

Click here for a complete list of Defined Privileges.

Determine the correct roles/privileges needed to integrate vCenter Server with other VMware products

Global permissions are applied to a global root object that spans solutions, for example, both vCenter Server and vCenter Orchestrator. Use global permissions to give a user or group privileges for all objects in all object hierarchies.

Each solution has a root object in its own object hierarchy. The global root object acts as a parent object to each solution object. You can assign global permissions to users or groups, and decide on the role for each user or group.

NX-OS Basic Commands Cheat Sheet

March 7, 2015

I am going to start today some hands on labs to practice for my CCNA (DCICN) Data Center test (640-911). This post is going to look more like a series of questions and answers with the commands used in the exercises.

1. To delete the start-up configuration

Switch#write erase boot
Switch#reload

2. To enter Global Configuration Mode

Switch#config
Switch(config)#

3. How to the save the Configuration

Switch#copy running-config start-config or
Switch#copy run star

4. Set the hostname

Switch#config t
Switch(config)#hostname switchA

5. Setting up the management ip address and description

switchA#config t
switchA(config)#int mgmt0
switchA(config-if)#ip address 10.10.10.2 255.255.255.0
switchA(config-if)#description management address
switchA(config-if)#end
switchA#

6. Creating VLANs

switchA#
switchA(config)#vlan 10
switchA(config-vlan)#name meaningful-name
switchA(config-vlan)#exit
switchA(config)#

7. Assign an interface to a vlan

switchA#config t
switchA(config)#int e3/1
switchA(config-if)#switchport
switchA(config-if)#switchport mode access
switchA(config-if)#switchport access vlan 10
switchA(config-if)#end
switchA(config)#

8. RIP

Nexus7k(config)# feature rip
Nexus7k(config)# router rip RodzRIP
Nexus7k(config-router)# address-family ?
ipv4 Configure IPv4 address-family
ipv6 Configure IPv6 address-family
Nexus7k(config-router)# address-family ipv4 unicast
Nexus7k(config-router-af)# int e3/1 - 2
Nexus7k(config-if-range)# ip router rip RodzRIP

9. EIGRP

Nexus7k(config)# feature eigrp
 Nexus7k(config)# router eigrp RodzEIGRP
 Nexus7k(config-router)# au?
 authentication autonomous-system
 Nexus7k(config-router)# autonomous-system ?
 <1-65535> Local AS number
 Nexus7k(config-router)# autonomous-system 100
 Nexus7k(config-router)# int e3/1 - 2
 Nexus7k(config-if-range)# ip router eigrp RodzEIGRP

10. OSPF

Nexus7k(config-if-range)# feature ospf
Nexus7k(config)# router ospf  JRVOSPF
Nexus7k(config-router)# int e3/1 -2
Nexus7k(config-if-range)# ip router ospf JRVOSPF area 0

11. Configure ports for routing, Example ports e3/1 and e3/2

Nexus7(config-if)# int e3/1
Nexus7(config-if)# no switchport
Nexus7(config-if)# ip address 172.16.10.1/24
Nexus7(config-if)# no shutdown
Nexus7(config-if)# int e3/2
Nexus7(config-if)# no switchport 
Nexus7(config-if)# ip address 172.16.20.1/24
Nexus7(config-if)# no shutdown

12. Configure a static route to remote network 192.168.10.0/24

Switch#conf t
Switch#(config)#ip route 192.168.10.0/24 e3/1 172.16.10.2

13. VLAN TRUNK

Switch#conf t
Switch#(config)#int e3/28
Switch#(config-if)#switchport
Switch#(config-if)#switchport mode trunk
Switch#(config-if)#switchport trunk allowed vlan add 10
Switch#(config-if)#switchport trunk allowed vlan remove 10
Switch#(config-if)#end

14. Changing Native VLAN

Switch#conf t
Switch#(config)#int e3/28
Switch#(config-if)#switchport
Switch#(config-if)#switchport mode trunk
Switch#(config-if)#switchport trunk native vlan 660

15. Configuring VTP

Switch#conf t
Switch#(config)#feature vtp
Switch#(config)#vtp mode server
Switch#(config)#vtp domain <domain-name>
Switch#(config)#vtp password <password>
Switch#(config)#vtp version 2
Switch#(config)#vtp pruning
Switch#(config)#sh vtp status

16. Configuring Inter-VLAN Routing

feature interface-vlan
interface vlan 10
ip address 172.16.10.1/24
int vlan 20
ip address 172.16.20.1/24
int vlan 30
ip address 172.16.30.1

17. STP

show spanning-tree
conf t
spanning-tree vlan 1 priority 4096 (multiples of 4096 up to 61440)
int e3/40-44
spanning-tree port type edge (for hosts)
int e3/45-48
spanning-tree port type network (for inter switch links)

18. Set a switch as root bridge

spanning-tree vlan 1 root primary

19 port-channels

interface port-channel 1
int e3/31-38
switchport
switchport mode  trunk
channel group 1 mode on
channel group 1 force mode on

20. Show the forward/filter table

show mac address-table

21. Show the STP root bridge for a VLAN

sh spanning-tree
sh spanning tree vlan <vlan#>

22. Configure a switch port to not transition through STP

spanning-tree port type edge

23. Show port channel

sh interface port-channel number

24 ACL To deny access to host 172.16.50.5 for telnet and ftp:

access-list 110 deny tcp any host 172.16.50.5 eq 21
access-list 110 deny tcp any host 172.16.50.5 eq 23
access-list 110 permit ip any any
int e3/1
ip access-group 110 out

25. Named ACL

ip access-list Deny_FTP
deny tcp any host 10.10.10.10 eq ftp
permit ip any any
int e3/2
ip accès-group Deny_FTP out
sh access-lists

26. Configure Session

config session <session name>
....
verify
commit

27. Object Groups

object-group ip address <name>
10.0.0.0/8
172.16.0.0/12
192.168.0.0/24
show object group <name>
10 10.0.0.0/8
20 172.16.0.0/12
30 192.168.0.0/24
Nexus7(config)# object-group ip port Permit_Ports
Nexus7(config-port-ogroup)# range 2011 2099
Nexus7(config-port-ogroup)# eq 31156
Nexus7(config-port-ogroup)# gt 32655
Nexus7(config-port-ogroup)# show object-group Permit_Ports
Protocol port object-group Permit_Ports
        10 range 2011 - 2099

Super Tech Resource

February 6, 2015
Suddenly you realize it, you are an expert at so many irrelevant things. This happened to you?, if you’ve been on IT for a while and you are still actually doing instead of managing, then you may end up rotting with some technology that is dying. When someone claims is a Cloud XXX, what do you expect from them? Well I found these skills for a Cloud Engineer job from a really cool company:
- A mastery of Linux. This means: you know why things work on a Linux system, not just how to configure them
- Experience developing enterprise application architectures to meet business requirements in complex environments
- Knowledge and experience with large-scale systems integration involving private, hybrid, and public cloud platforms
- Understanding of cloud orchestration frameworks, enterprise IT service provisioning tools, and their role in IT transformation
- Experience with public and private cloud, including OpenStack and AWS
- Experience with configuring: OpenStack Ceilometer, Cinder, Glance, Heat, Keystone, Nova, Neutron, Swift
- Experience with virtualization, including: KVM, Xen, and VMWare
- Experience with RabbitMQ / AMQP, Puppet, LDAP, NFS, and RHCS
- Experience administering CentOS or Ubuntu
- Able to write software in Python or some other administrative language
- Able to read and perform debugging of C / C++ / Java programs. Being able to write programs in these languages is even better!
- Experience supporting or maintaining MySQL, MongoDB, and Couchbase
How do I get these? I mean all of them. Is it really something achievable? For example, take virtualization. How much time does it take to be a VMware master? Then learn enough KVM and Xen to be able to master all three. I know it depends on how smart you are, but also on how much hands experience you can get. What if you are an expert in Solaris or AIX, but not Linux. I wonder if such a person exists. I would like to work with this person and learn everything I could. In the meantime maybe I should apply for an internship with this company to be able to master every skill in this list, and then hope they are not replaced by new technology and become irrelevant again.

As always pardon my English, I just feel that if I write these in Spanish nobody would ever read them (not that anyone read them anyway :P)
Just don’t follow your dream

June 25, 2014

Ok, I have your attention, now let me explain myself. I come from a home in which my father always worked Monday to Saturday, he doesn’t know what the word vacation means, and he is still working at age 74. He never bought anything that was not essential to us. Good house (of course no mortgage), food and good education. I once asked my parents if they could buy an ATV for me if I obtained good grades, and they said that the good grades were for me not for them (kind of saying there is no way you are going to blackmail us with that), but really just saying that it was in my best interest to do well in school.

Enough about family history, here is what I mean. You really have to setup a goal, but then stop thinking about the end result and start thinking on how to get there. Dedicate all your resources to those little things that will allow you to reach that goal. Stop daydreaming, be practical and don’t waste your time on things that will not contribute to your mission.

If you want to be the best basketball player, then research what you have to do and then do it six days a week for the amount of time needed to create results, don’t waste you time playing a video game or fantasizing about wining the slam dunk contest.

Those of us in the IT business will be challenged multiple times during our career. This is something you learn and relearn, apply the useful stuff and hopefully discard what doesn’t work. Keep your goals clear and well defined, but never hold back, shoot for the moon.
Cloud Something

June 13, 2014

The World Cup started, so I will cheer for the one who seems to be wining at any give point. Yes I know it sounds not very loyal from my part, but a man does what a man needs to do, right? Anyway I’ve been out for a while (again) but I want to share my thoughts on the cloud, but the cloud that its beginning to be seen in the TV and movies, yesterday I saw a movie trailer and the actors were saying something about “nobody understands the cloud”. Well that may be the case, I mean probably big companies do, but believe me that some people out there are still trying to understand virtualization so you can imagine.

The issue is more on whether you continue on the race to the bottom, or do you jump on this big opportunity. I believe that is possible to consolidate beyond what we’ve achieved with virtualization. We are talking about Virtual Data Centers, having a couple of physical locations, but seen as one.

Who are the players? Well, this looks like the gold rush., everyone have some sort of initiative. So please take a look at you situation. Do you work in an environment (I guess mostly tech) that will be affected by this cloud storm? Make your move now, don’t get caught without an emergency plan.

Remember when you see clouds, there may be a storm coming.
EMCWORLD 2014

May 7, 2014

Finally I made it to Las Vegas. It is fantastic!, I’m starting the third day and I’ve enjoyed every single minute of it. Honestly, although I liked all the sessions, Bear Grylls talk on extra-ordinary was my favorite. When you absolutely think there is nothing left on you to give, that is the moment you know you have to give a little bit more., that is the “Q”. We can’t wait to get back home to pass the message, the third platform is here, we as IT professionals need to prepare for the software defined everything. This is just the logical next step, the software have always been there, it is going to be disconnect now. It is all business driven, mobile apps, cloud, time to market, and always on, are some of the drivers or reasons this is happening. I want to make a commitment, I’ll start blogging more, I have a few interesting projects I want to “document” in my vNotepad. But going back to EMCWorld I am impress with the level of cohesiveness about the message at all levels, from Joe Tucci to Urayoan Irizarry down at the Solutions Arcade. I really liked the VPLEX Virtual Edition session, I will setup something here in the next few days.

Section 9: Configure and Administer vSphere Availability Solutions

Objective 9.2: Configure Advanced vSphere DRS Features. In this objective we should be covering these topics:

Section 9: Configure and Administer vSphere Availability Solutions

Objective 9.1: Configure Advanced vSphere HA Features: In this objective we should be covering these topics:

Section 10: Administer and Manage vSphere Virtual Machines

Objective 10.2: Create and Manage a Multisite Content Library: In this objective we should be covering these topics:

Section 10: Administer and Manage vSphere Virtual Machines

Objective 10.1: Configure Advanced vSphere Virtual Machine Settings

Identify available virtual machine configuration settings

Interpret virtual machine configuration files (.vmx) settings

Identify virtual machine DirectPath I/O feature

Enable/Disable Advanced virtual machine settings

Section 1: Configure and Administer vSphere 6.x Security

Objective 1.1: Configure and Administer Role-based Access Control

Add/Modify/Remove permissions for users and groups on vCenter Server inventory objects

Create/Clone/Edit vCenter Server Roles

Configure VMware Directory Service

Apply a role to a User/Group and to an object or group of objects

Change permission validation settings

Determine the correct roles/privileges needed to integrate vCenter Server with other VMware products