3/30/12 VMae - Configaion Tool

1/9 .daadik.co.k/hml_doc/mae/ool.hm
Adanced Configaion Tool
In my last section on the VMware series I am going to cover advanced configuration tools, I will be covering host profiles, vCLI, ,
PowerCLI. I am from a Unix background and if I can I try to script everything this eliminates the human error factor, once you know a script
works then you can run hundreds of times knowing that the same outcome will occur, you can script many common tasks in VMware.
There are a few new features in version 4
Host Profiles which almost eliminate the need for complex scripted installations
The next generation of command-line tools which allow everyone to script configurations of not just ESXi servers but also the vCenter
environment
Below is a list of the current tools that are available for with VMware
Local CLI at the ESXi host
You requIre root level access and a SSH connectIon (PuTTy), thIs Is Idea for those who lIke the commandlIne and usIng swItches, a
bIt lIke the UnIx world.
Sphere CLI
vCL allows you to run commands from your WIndow/LInux server remotely wIthout an SSH sessIon, not all commands avaIlable at
the local CL are avaIlable In the vCL
Sphere PoerCLI
(toolkit for indos/Poershell toolkit)
PowerCL plugs dIrectly Into vCenter remotely and carrIes out many functIons that aren't even exposed In the CU. You should have
a good knowledge of objectorIented programmIng (objects, propertIes, attrIbutes, etc).
Sphere Perl
(Perl Sphere PoerCLI)
ThIs toolkIt exposes the same functIonalIty as the PowerShell toolkIt
Sphere Management Assistant
aggregates much of the functIonalIty seen In the vCL and the Perl toolkIt, It allows for an InteractIve CL to ESX classIc and ESXI, It
also automates much of the authentIcatIon Issues, meanIng you have no need to dIsclose the root account
Host Profiles
are not a scrIptIng engIne or CL tool but carry out many of the post confIguratIon tasks of an ESXI server normally undertaken wIth
scrIptIng, you can achIeve the same results wIth host profIles as wIth scrIptIng, so If you don't lIke scrIpt thIs Is the way to go.
Host Profiles
Host profiles allow you to capture the configuration of a ESXi server and apply it another ESXi server, essentially it acts like a policy object
that can be applied to either an ESXi server or cluster in the vCenter inventory, thus you can cut down on the scripting element. If you want
maximum control over any settings that make up your ESX server than scripted installation is the way to go, but if you are using ESXi host
profiles may be a better route because they are relatively easy to use and require no scripting knowledge whatsoever.
Host profiles have five main functions
Capture the configuration profile of an existing host
Apply the configuration profile to a new ESXi server
Confirm that an ESXi server is correctly configured
Prompt the administrator for per ESXi server settings such as VMKernel network configuration
Apply the profile as an ESXi host is added into vCenter cluster - a mere drag and drop event configures the ESXi server
You cannot install additional software into the ESXi server and there are some issues with the HA agent starting, but they are ideal for masse
rollouts of ESXi servers. Host profiles are associated with the vCenter you logged in to when you create them, they are not available across
multiple vCenters even in ied de, also the vCenter must manage the ESXi server.
FIrstly may want to prebuIld a clean ESXI server and apply a modest vSwItch, NTP and fIrewall confIguratIon. try to buIld as much as you can so that you don't have to
tweak to much after applyIng to a new ESXI server. Host profIles have many number of settIngs, am not goIng to show you all of them but do have a look and play
around.
FIrst rIghtclIck the source ESXI server and choose host profIle, then select Create ProfIle from Host
3/30/12 VMae - Configaion Tool
2/9 .daadik.co.k/hml_doc/mae/ool.hm
create and edIt a host
profIle
Type In a frIendly name and a descrIptIon
Next we get the summary screen
Now go to the home page and select Host ProfIles
ThIs Is the maIn host profIles screen, we wIll dIscuss some of thIs later, you can edIt the productIon_cluster profIle we created by selectIng the edIt profIle lInk
If you select the edIt profIle, you wIll see the edIt edIt screen, thIs has vast amounts of InformatIon, there Is lots to confIgure here, hence why stated earlIer that
when you buIld the fIrst source ESXI server try to confIgure as much possIble
3/30/12 VMae - Configaion Tool
3/9 .daadik.co.k/hml_doc/mae/ool.hm
Once you have created and configured your host profile you might want to test it against some existing ESXi servers to see if they are
compliant with your build, next we attach a a ESXi server to the host profile and apply it
To attach ESXI servers to you host profIle, rIghtclIck the host profIle and select Attach Host/Cluster
Select the cluster or the ESXI server/s you want to attach
n the Hosts and Clusters tab you can now see two ESXI servers attached to the productIon_cluster host profIle, and If you notIce In the top rIghthand corner the lInks are now lIve, you can apply thIs profIle to a
3/30/12 VMae - Configaion Tool
4/9 .daadik.co.k/hml_doc/mae/ool.hm
AttachIng
and
applyIng
host
profIles
host or check Its complIance, whIch Is what we are goIng to do now
Select each ESXI server In turn and clIck the Check ComplIance Now lInk, vmware1 should be complIant as thIs Is the ESXI server we created the host profIle wIth In the fIrst place, however vmware2 Is not complIant as
the TS| servIce Is dIfferent
8efore you apply a host profIle to a ESXI server It must be In maIntenance mode, then just clIck the apply profIle lInk, below Is the screen you get If your ESXI server Is not In maIntenance mode
You may have to tweak the ESXI server after applyIng the profIle (P address, etc) but 99 of the confIguratIon should be complete.
You also have the ability to export the host profile, this can then be imported on another vCenter server, the host profile is saved in the
VMware Profile Format (.vpf) format as seen below
CLI
vCLI does not cover all the commands that the service console does, for instance you cannot add a second service console port for the
VMware iSCSI software initiator and VMware HA, you cannot open firewall ports for the iSCSI. vCLI comes in three flavors
Windows installer
Linux installer
Downloadable VM (called VMware management appliance)
They all use the perl environment, so if you are using windows you need ActivePerl installed, then download the latest version of vCLI from
VMware and install, hopefully you should end up with a vCLI icon like below
vCLi can configure common tasks such as the following, I am not going to cover every single command so I will point you to the VMware
vCLI documentation
Create vSwitches
3/30/12 VMae - Configaion Tool
5/9 .daadik.co.k/hml_doc/mae/ool.hm
setup DNS
configure NTP
Enable the iSCSI initiator
configure NAS
vCLI can be frustrating sometimes due to the authentication process, it may take some time for the prompt to come back, all vCLI
commands require a host (ESXi server or vCenter), username and password (HUP) to authenticate against the system prior to the command
being executed. There are three ways to authenticate
Use a sessIon fIle
## uses a cookie that expires after 30 minutes of nonuse, vCLI commands can be long especially when you add the authentication details for example
vicfg-vswitch.pl --server=vcenter1 --username=administrator --password=password --vihost=vmware1 -l
## to create a session file you can use the following command
save_session.pl --savesession=c:\vmware_session\vc1 --server=vcenter1 --username=administrator --password=password
## You should receive a message stating "Session information saved" and a file called vc1 should have been created, set a enviroment variable to ##
point to this file
set VI_SAVESESSIONFILE=c:\vmware_session\vc1
## The contents of the session file is below, but they will be different than yours
#LWP-Cookies-1.0
Set-Cookie3: vmware_soap_session="\"096482A3-3638-4674-A83C-42BD007486F2\""; path="/"; domain=win-2008.local; path_spec; discard; version=0
Now we can use this session file as seen in the image below were I list all the vSwitches
## A configuration file holds the details of the server, username and password, you have to make file secure as it is a text file, an example is
## below I called this vc2.txt
VI_SERVER=vcenter1
VI_USERNAME=administrator
VI_PASSWORD=password
## once you have created the file set the variable below
set VI_CONFIG=c:\vmware_session\vc2.txt
## now test the configuration file
3/30/12 VMae - Configaion Tool
6/9 .daadik.co.k/hml_doc/mae/ool.hm
Create a confIguratIon fIle
Passthrough the
credentIal
uses the current logon to the Microsoft Security Support Provider Interface (SSPI), to use this method all you need to do is use the below
parameters to the command
--passthroughauth --passthroughauthpackage="kerberos"
I am now going to list some of the more common commnds that you may use, there are many more so take a peak at the VMware
documentation, this is a sort of get the feel for vCLI
create a Internal vSwItch
vicfg-vswitch.pl --vihost=vmware1 -a=vSwitch1
## you can also create aport group on a vswitch by using th -A option
vicfg-vswitch.pl --vihost=vmware1 -A=vmware1-internal0 vSwitch1
## you can list the vswitches
vicfg-vswitch.pl --vihost-vmware1 -l
create a vSwItch wIth
7LAN taggIng
## First create the port groups
vicfg-vswitch.pl --vihost=vmware1 -A=vlan10 vswitch1
vicfg-vswitch.pl --vihost=vmware1 -A=vlan11 vswitch1
vicfg-vswitch.pl --vihost=vmware1 -A=vlan12 vswitch1
## then set the VLAN value on the properties of the correct port group
vicfg-vswitch --vihost=vmware1 -v=10 -p vlan0 vswitch1
vicfg-vswitch --vihost=vmware1 -v=11 -p vlan0 vswitch1
vicfg-vswitch --vihost=vmware1 -v=12 -p vlan0 vswitch1
## Finally link the relevant NIC's to the vSwitch
vicfg-vswitch.pl --vihost=vmware1 -L=vmnic1 vSwitch1
vicfg-vswitch.pl --vihost=vmware1 -L=vmnic2 vSwitch1
Create a 7|Kernel port
for v|otIon
## create a port group called vmotion
vicfg-vswitch.pl --vihost=vmware1 -A=vmotion vSwitch3
## link the relevant NIC's
vicfg-vswitch.pl --vihost=vmware1 -L=vmnic3 vSwitch3
## configure the IP address and subnet mask
vicfg-vmnic.pl --vihost-vmware1 -a -i 192.168.2.190 -n 255.255.255.0 -p vmotion
vicfg-vswitch.pl --vihost=vmware1 -a=vSwitch4
vicfg-vswitch.pl --vihost=vmware1 -A=ipstorage vSwitch4
vicfg-vswitch.pl --vihost=vmware1 -L=vmnic4 vSwitch4
vicfg-vswitch.pl --vihost=vmware1 -L=vmnic5 vSwitch4
## configure the IP address and subnet mask
vicfg-vmnic.pl --vihost-vmware1 -a -i 192.168.2.193 -n 255.255.255.0 -p ipstorage
## change the MTU to support jumbo frames
vicfg-vswitch --vihost=vmware1 -m=9000 vSwitch4
## Now enable the VMware iSCSI software initiator
vicfg-iscsi.pl --vihost=vmware1 -E -e
## check to see what virtual HBA device is used
vicfg-iscsi.pl --vihost=vmware1 -l -H
## now that you have the device, you can find out your IQN details
vicfg-iscsi.pl --vihost=vmware1 -E -l -P vmhba34
## now set the IQN for this interface
vicfg-iscsi.pl --vihost=vmware1 -I -n=iqn.2008-11.uk.co.datadisk:vmware1 -K=vmware1 vmhba34
## add the iSCSI target
3/30/12 VMae - Configaion Tool
7/9 .daadik.co.k/hml_doc/mae/ool.hm
Enable ISCS InItIator
vicfg-iscsi.pl --vihost=vmware1 -a -D -i=<openfiler IP address> vmhba34
## rescan and then list the available luns
vicfg-rescan.pl --vihost=vmware1 vmhba34
vicfg-iscsi.pl --vihost=vmware1 -E -l -L vmhba34
## here is simple session to display the current configured LUNs I have
Set up your NTP
vicfg-ntp.pl --vihost=vmware1 -a=0.uk.pool.ntp.org
vicfg-ntp.pl --vihost=vmware1 -a=1.uk.pool.ntp.org
vicfg-ntp.pl --vihost=vmware1 -a=2.uk.pool.ntp.org
## to stop and restart ntp use the below
vicfg-ntp.pl --vihost=vmware1 -s
vicfg-ntp.pl --vihost=vmware1 -r
## List the NTP servers
get-vmhostntpserver vmware1
|angIng FIles
## list the datastores available
vifs.pl --server=vmware1 --username=root --password=password -S
## upload a file, you must supply the "[datastore name] /directory"
vifs.pl --server=vmware1 --username=root --password=password -p=c:\w2k3.iso "[iso] /ms/w2k3.iso"
Snapshots
## list VM on the server
vmware-cmd.pl -H vmware1 -U root -P password -l
## take a snapshot, using the information obtained above
vmware-cmd.pl -H vmware1 -U root -P password /vmfs/volumes/4d7f4f35-c02e5bd8-5946-
00237d16ab10/linux01/linux01.vmx createsnapshot "Before Export" "Taken before using VM to 2gbsparse
format" 1 1
8ackup exIstIng ESXI server
confIguratIon
## make sure you don't have any registered VM's on the ESXi server, a binary file will be created
vicfg-cfgbackup.pl --server=vmware1 --username=root --password=password -s c:\vmware1.bak
## Now factory reset your ESXi server, make no VM's are running on this server
vicfg-cfgbackup.pl --server=vmware1 --username=root --password=password -r -q
## Now restore the configuration
vicfg-cfgbackup.pl --server=vmware1 --username=root --password=password -l c:\vmware1.bak -f -q
PoerCLI
Lastly we come to PowerCLI, by default PowerCLI is already installed on Windows 7 (see screen shot below of my Windows 7 desktop
PC) and Windows Server 2008 R2, otherwise you can download from the Microsoft website.
3/30/12 VMae - Configaion Tool
8/9 .daadik.co.k/hml_doc/mae/ool.hm
Once you have this installed you next need to download the vSphere PowerCLI from the Vmware website, then install this, hopefully you
should end up with a icon like below
Because I installed PowerCLI on my desktop PC, when I open a window I am not connected to a vCenter (notice the error messages), to
connect to a vCenter I use the connect-viserver command
Once connected I can then run the PowerCLI commands, here I get a list of the current ESXi servers and VM's
Now I am not going to explain all the commands, so again go to the VMware documentation for a complete list, there are seven categories
which you can carry out tasks
Add - adding objects such as ESXI servers, vSwitches
Get - listing objects
Move - moving objects such as moving a VM from one ESXi server to another
New - create new objects such as port groups, vSwitches
Remove - remove objects
Set - set a VM resource allocation
Stop/Start - stop a vm or start an ESXi server service
3/30/12 VMae - Configaion Tool
9/9 .daadik.co.k/hml_doc/mae/ool.hm
You can also feed one command into another with the use of Pipes (), if you know the Unix world then this will be familiar, I have listed
some common commands below to get you started and to see what tasks you can perform using PowerCLI.
LIst all the get commands get-command where object $_.name-like "get*"
LIst ESXI servers and 7|
get-vmhost
get-vm
0IsconnectIng C0/FloppIes
get-vm get-floppydrive set-floppydrive -connected:$false
get-vm get-cddrive setcddrive -connected:$false
Port groups
## List network adapters and sort them
get-vm get-networkadapter sort-object -property "NetworkName"
get-vm get-networkadapter sort-object -property "NetworkName" where 'Production' -contains $_.NetworkName
## rename a port group
get-vm get-networkadapter sort-object -property "NetworkName" where 'Production' -contains $_.NetworkName
set-networkadapter -Networkname 'production'
|aIntenace |ode get-vmhost -name vmware1 set-vmhost -state maintenace
LIst datastores
get-datastore
## get the datastores on a particular ESXi server
get-vmhost -name vmware1 get-datastore
Create a datacenter wIth
folders
## Create the DataCenter first
new-datacenter -location (get-folder -Name 'UK DataCenters') -name 'Milton Keynes DataCenter'
## Now create the folder inside the DataCenter
new-folder -location (get-datacenter -Name 'Milton Keynes DataCenter') -name 'AMD Hosts'
new-folder -location (get-datacenter -Name 'Milton Keynes DataCenter') -name 'Intel Hosts'
Create a cluster
new-cluster -location (get-datacenter -name 'Milton Keynes DataCenter' get-folder -name 'AMD Hosts') -name 'AMD
Cluster' -HAEnabled -HHAdmissionControlEnabled -HAFailoverLevel 2 -DRSEnabled -DRSMode PartiallyAutomated
AddIng hosts to a
datacenter or cluster
add-vmhost vmware1 -location (get-datacenter 'Milton Keynes Datacenter') -user root -password password
TrIggerIng v|otIon move-vm (get-vm -name 'linux01') -destination (get-vmhost vmware1)
Now that you have a feel for the commands, you can create scripts to run multiple commands, save the script with the extension of .ps1 then
just run it, if it complains that you are not authorized then run the command "set-executionpolicy unrestricted", remember this is dangerous as
you can run any command but it will at least get your going on you test setup.