Not Supported

Native MAC Learning in vSphere 6.7 removes the need for Promiscuous mode for Nested ESXi

04/25/2018 by William Lam 22 Comments

Over the years, several solutions have been developed here and here to help reduce the impact of promiscuous mode, which is a requirement for running Nested ESXi as a workload. Although these solutions worked extremely well, it however did require users to install additional software to enable this functionality. The most recent solution was a new Learnswitch VMkernel module (released as a VMware Fling) that enables MAC learning capabilities on ESXi.

Today, I am pleased to announce that with the release of vSphere 6.7, the MAC Learning functionality is now available as a native feature of the VMware Distributed Virtual Switch (VDS) and as some of you may have guessed from the title, promiscuous mode is also no longer a requirement for running Nested ESXi! I wanted to take a moment and thank Subin, Jobin, Sriram, Rajeev & Samuel from our Network and Security Business Unit (NSBU) at VMware who worked tirelessly to get this integrated and productized into ESXi. Not only will this benefit Nested ESXi workloads but also other solutions and use cases that have historically required the use of promiscuous mode. For customers who are still running ESXi 6.0 or 6.5, you should continue to use the Learnswitch Fling until you fully upgrade to vSphere 6.7.

To use the new MAC Learning functionality, you will of course need to upgrade to vSphere 6.7 (both vCenter and ESXi) but also upgrade to the latest VDS version which is 6.6. MAC Learning can be enabled on a per Distributed Virtual Portgroup bases and today, it is only available when using the vSphere API. For those that have used the VDS API to manage their VDS, you will simply use the existing ReconfigureDVPortgroup_Task() method and in 6.7, there now a new macManagementPolicy property which allows you to enable and define your MAC Learning settings. This new MAC Management Policy will also be the new preferred method for managing security policies going forward for a DV Portgroup and the previous security policy settings should no longer be used.

Disclaimer: Nested ESXi is still not officially supported by VMware. Please use at your own risk. [Read more...] about Native MAC Learning in vSphere 6.7 removes the need for Promiscuous mode for Nested ESXi

Nested ESXi 6.7 Virtual Appliance Updates

04/20/2018 by William Lam 14 Comments

I know many of you have been pinging me the last couple of days for an updated Nested ESXi 6.7 Virtual Appliance and I have just finished my strict quality control process 🙂 The only minor change with the 6.7 appliance is the VM is now configured with EFI Firmware, where as in the past it was set to BIOS. As of vSphere 6.5+ appliances, the customization scripts are automatically removed by default which means that customers can turn on Secure Boot feature post-deployment without having to perform any manual workarounds. In addition, you will find a few more updates related to the updated ESXi appliance below. I hope you enjoy these free resources to help learn and plan for your vSphere 6.7 upgrades, Happy Friday!

Note: These solutions are all developed during off hours and does take a considerable amount of time/effort to manage and update. Although they are provided to you as a free solution, the development itself is not 🙂

Nested ESXi 6.7 Appliance:

ESXi 6.7 Virtual Appliance (Nested_ESXi6.7_Appliance_Template_v1.ova)

Nested ESXi Content Library

If you are using my Nested ESXi Content Library, I have updated it to include the latest 6.7 Appliance. Simply refresh your Content Library to automatically pull down the image or you can create a new Content Library by subscribing to the following URL: https://download3.vmware.com/software/vmw-tools/lib.json For more details, please take a look at this blog post here.

vGhetto vSphere Automated Lab Deployment:

For those that use my vGhetto lab deployment script to automate a fully functional vSphere environment, I have created a new version of the script to support vSphere 6.7 which you can find more details here. One neat feature that was suggested by Christian Mohn awhile back was the ability to get more insights to what is happening during the VCSA deployment since the verbosity can be quite distracting on the primary screen. There is now a new $enableVerboseLoggingToNewShell variable that is enabled by default to spawn a new PowerShell console that will watch the VCSA installer logs, so you have a better idea of what is going on.

Can the VCSA 6.5 forward to multiple syslog targets?

12/11/2017 by William Lam 2 Comments

I had a couple folks ping me recently asking whether the latest vCenter Server Appliance (VCSA) 6.5 release supports forwarding to multiple syslog targets? Currently today, only a single syslog target is officially supported which can be configured using the VAMI UI. I know this is something our customers have been asking about and I know this is something the VC Engineering team is considering.

Having said that, it is possible to configure additional syslog targets on the VCSA, but please be aware this is not officially supported. A couple of these customers understood the support impact and were still interested in a solution as some of their environments mandated multiple redundant syslog targets and using a syslog forwarder/relay was not an option for them.

Disclaimer: This is not officially supported by VMware, please use at your own risk.

When configuring syslog forwarding from the VAMI UI, the configurations are all written to /etc/vmware-syslog/syslog.conf on the VCSA.

With this information, if we want to add additional targets (which can be of the same configuration or different), you simply append additional targets to the syslog configuration file. For example, if I have two syslog targets 192.168.30.110 and 192.168.30.111 and I wish to use the default log level, TCP and 514, I would use the following:

*.* @@192.168.30.110:514;RSYSLOG_SyslogProtocol23Format
*.* @@192.168.30.111:514;RSYSLOG_SyslogProtocol23Format

1 2	. @@192.168.30.110:514;RSYSLOG_SyslogProtocol23Format . @@192.168.30.111:514;RSYSLOG_SyslogProtocol23Format

Once you have saved your changes, you will need to restart the rsyslog service for the change to go into effect. To do so, run the following two commands on the VCSA:

systemctl stop rsyslog
systemctl start rsyslog

One additional thing to note is that the VAMI UI will only show the very last syslog target within the configuration file but if you monitor syslog servers, you will see that logs are indeed being forward to all servers that have been configured in the syslog configuration file.

“Shockwave Flash has crashed” workaround for vSphere Web (Flash) Client

10/15/2017 by William Lam 77 Comments

On Saturday, I started to notice that logins to the vSphere Web (Flex) Client stopped working with Google Chrome. Upon a successful logon, it would immediately crash with "Shockwave Flash has crashed" message. I had seen this message plenty of times in the past and usually restarting Chrome would resolve the problem but this time it looked to be persistent even after a system reboot.

I took to Twitter to see if I was the only one hitting this issue since I was not able to find anything on the web and literally in minutes, I had several dozen replies with folks experiencing the same issue which apparently started several days ago but like most, including myself, thought it was an isolated event.

I thought it was just me, but apparently other folks reporting Flash crashing immediately w/Flash Web Client on latest Chrome. Anyone else? pic.twitter.com/8RWbyPGLG4

— William Lam (@lamw) October 15, 2017

After a bit of back/fourth and a few other folks chiming in, it looks like Google actually went and published a newer version of Flash (27.0.0.170) with latest Chrome (61.0.3163.100) update. This newer Flash version is not even available for download and the current version as listed on Adobe's website should be 27.0.0.159. This issue not only affects VMware products that uses Flash but any website that has Flash content and I had also noticed few others sharing frustrations on Twitter for other flash-based websites.

~~Luckily, one workaround that I had found which others have also confirmed is to switch to Firefox which currently does not have this issue~~ Its also been reported that latest updates from Firefox is also distributing the latest Flash which causes the exact same issue. Like most, Chrome is my default browser and it was annoying that I had to switch to another browser but that was the only way I could access the content I needed. Earlier this evening, I was looking at the VMware Reddit Channel and noticed a thread had popped up regarding this exact issue and it looks like more and more folks are now noticing.

VMworld Hackathon vSphere Client Login UI Theme

09/27/2017 by William Lam 7 Comments

For those of you who attended this years VMworld Hackathon (US/Europe), you may have noticed something different when logging into the vSphere Web/H5 Client? In case you missed it or could not attend, here is a GIF demonstrating what you would have saw:

via GIPHY

No, the VMworld Hackathon environment was not hacked 😉 but instead I had built a very special VMworld Hackathon vSphere Client Login UI Theme for the event. I was also getting tired of looking at our boring blue login screen. Customizing the vSphere Client Login UI has been possible (though not officially supported by VMware) since vSphere 6.0 which I have written about here, here and most recently here (due to vSphere 6.5 Update 1 changes). Having received a large number of requests from folks who attended the Hackathon as well as folks who had heard or saw the customization who wish to replicate this in their own environment, I have posted the instructions below.

This slick customization would not have been possible without the help from Timo Sugliani (thanks dude!) who was the one that made me aware of the two of the creatives that then gave me the idea to combine them into a vSphere Client Login UI Theme. The first is V for Vendetta image which can be found here and the second is super slick interactive Bootstrap animation which can be found here. Lastly, I added my own touch by using a Mr. Robot font from this site here which goes really well with the overall theme.

vSphere Client Login UI customizations do not persist in VCSA 6.5 Update 1

08/03/2017 by William Lam 3 Comments

The much anticipated release of vSphere 6.5 Update 1 just GA'ed late last week and like many in the community, I also went ahead and upgraded my home lab to this latest release. vSphere 6.5 Update 1 contains a ton of fixes as well as several new capabilities which you can read all about in the release notes here and here.

One neat little trick I take advantage of in my lab environments when deploying the vCenter Server Appliance (VCSA) is actually pre-filling out the credentials for the vSphere Client UI (not recommended for production environments of course) which I had blogged about here a few years back. Sine I have many different environments for different scenarios, I find myself being lazy and having to type in the credentials to each one of these environments. Instead, I can pre-fill either the username and/or password (which I will stress again, not recommended for production) within the vSphere Client Login UI page which is simply just using HTML.

After making the necessary changes to my VCSA 6.5u1 system, I needed to reboot my ESXi host and when everything came back up, I was surprised to find my changes to the vSphere Client Login UI had disappeared. It took me awhile to figure out why the changes were not persisting across reboots. There seems to be a change in behavior compared to prior releases of the VCSA (6.0 & 6.5) on when this capability was actually possible.