VCF 5.2 Admin Exam

• SDDC Manager is essential for configuration changes, software updates, adding/removing hosts from workload domain clusters and ensuring accurate inventory within VMware Cloud Foundation (VCF).

Key SDDC Manager Services

• UI: HTML5-based interface consistent with VMware UIs
• Lifecycle Manager: Monitors/updates software, ensures product compatibility, automates upgrades, updates inventory
• Domain Manager: Orchestrates workload domain creation, deletion, and scaling
• SoS Utility: Performs health checks and collects logs via command line or API
• Network Pools: Provides IP address pools for deployed resources like ESXi hosts
• Inventory: Maintains a database of managed entities

User Management

• Roles include admin, operator, and view-only.
• Actions within SDDC Manager involve changing passwords, deploying NSX Edge, adding/removing hosts, and creating vSphere clusters.
• Actions outside SDDC Manager involve changing Active Directory permissions, adding resource pools/port groups, and applying vSphere license keys.
• vSphere admin actions can have serious ramifications on VCF, requiring a deep understanding to avoid issues like inaccessible clusters. Contact Broadcom support before attempting to fix such issues.

Password Management

• SDDC Manager uses the "admin" account for internal API calls, so the password should be changed periodically.
• Password resets for local accounts in SDDC Manager differ from changing the API "admin" account password.

Changing "root" and "vcf" Passwords

• Access SDDC Manager via SSH as the "vcf" user.
• Use the su command to switch to the “root” account.
• Then, use the passwd command.

Changing API "admin" Password

• Access SDDC Manager via SSH as the "vcf" user, switch to “root”, and run: /opt/vmware/vcf/commonsvcs/scripts/auth/set-basicauth-password.sh admin <password>
• Ensure proper escaping of special characters is applied.

NSX Overview

• Segments, or logical switches, provide switching functionality in NSX, similar to VLANs, with VNIs scaling beyond VLAN limits.
• Segments contain segment ports where entities like VMs connect.
• Segment profiles configure logical switches and ports, with NSX Manager providing default profiles.
• Profiles applied at the segment level apply to all ports unless overwritten at the port level and multiple profiles are supported, including QoS and port mirroring.
• NSX Edge nodes are appliances providing distributed routing and other services.
• NSX Edge offers high availability through active-active and active-standby models.
• VMware Cloud Foundation automates NSX Edge deployment in DMZs and multi-tenant environments.

NSX with VI Workload Domain Creation

• A three-node NSX Manager cluster deploys in the management domain when the first VI workload domain supported by NSX is created.
• The cluster can be shared or dedicated to single/multiple VI workload domains.
• NSX Manager adds VI workload domain vCenter instances as a compute manager, and creates VLAN and overlay transport zones for host transport nodes.
• NSX Manager creates and applies an uplink profile to transport nodes.

Uplink Profiles

• An uplink profile defines how Edges and transport nodes connect to VLAN/Overlay networks and specifies the NICs used
• Workload domain traffic separation allows separation of VMkernel traffic types.
• Separation can include management, storage, vSphere vMotion, and overlay traffic.

Multi-NIC Host Use Cases

• Use-cases involve adhering to legacy practices and traffic segregation for security/bandwidth limitations.
• VCF replaces the practice of multi-NIC by using consolidated VDS (NSX) with VLANs and GENEVE/ TEPs.
• Physical segregation environments can map management/storage/VM traffic to a logical switch connected to dedicated physical NICs.

Importing vSphere Infrastructure

• Two scenarios exist for importing vSphere infrastructure, depending on SDDC Manager deployment status.
• Scenario 1 involves deploying SDDC Manager into a vSphere cluster and using an import script to convert it into a management domain.
• Scenario 2 involves using an import script to import vSphere clusters as VI workload domains into an existing SDDC Manager deployment.

NSX Edge Networking

• VMware Cloud Foundation automates NSX Edge cluster deployment/configuration:
• Deployment of NSX Edge VMs with initial Tier-0 and Tier-1 gateways.
• Configuration of NSX Edge uplink profiles and segments.
• Enabling BGP when used.
• Scaling of existing NSX Edge clusters.
• NSX Edge clusters are associated with workload domains, sharing North-South routing and networking throughout the entire Workload Domain and other workload Domains that use the same NSX Manager cluster.

Edge Cluster Prerequisites

• Separate VLANs and subnets must be available.
• Host TEP VLAN and Edge TEP VLAN need routing.
• Reserve an ASN.
• Set two BGP peers on TORs or infra ESG.
• Populate DNS entries for NSX Edge.
• Have L2 Uniform vSphere clusters to host Edge clusters, with identical networking.
• Use identical PNIC speed and same NSX enabled VDS uplinks for the hosting vSphere cluster.

Edge Cluster Profile Options

• Select the default configuration unless BFD is required for BGP peering..
• BGP peering is used to enhance network reliability.
• BGP is required for dynamic route advertisement that requires a physical switch configuration.

Routing Options

• Select between BGP, which distributes routes automatically, or Static, where routes are configured manually.
• External BGP is typically preferred for automatic route redistribution. Static routes might be best when extra security is desired in various environments.

NSX Edges Appliances

• You must configure network interfaces for each NSX Edge Appliance before deploying: Mgt IP, one edge TEP for each edge note on the edge TEP VLAN and an uplink IP on separate uplink VLANs.
• NSX Edge nodes can be removed only if certain requirements are satisfied (active cluster, more than two nodes).
• Equal-cost multi-path routing (ECMP) load balances traffic across layer 3 connections.

BGP Protocol

• BGP exchanges routes and peer with NSX Edge nodes.
• Serves as interdomain routing protocol for loop-free routing among domains with independent policies.
• The new dvPortgroups in vSphere and NSX managed logical switches are connected north-south to ECMP On-Ramp.

L2 Fabric vs L3 ToR

• Edge nodes pair with L3 devices to which ToR connects.
• Both BGP and OSPF are applicable in L2 design.
• The L3 ToR design has the following characteristics: Simple design is using non-LACP uplink teaming and MLAG terminates LACP at the ToR
• With the use of MLAG (Arista etc.) LACP is terminated at the TOR and BGP or OSPF can be used.
• You are able to set the routing feature on Tier-0 logical router that does the peering with the Layer 3 device. Also, static routes or Multihop external BGP(eBGP).

BFD Protocol

• BFD aids in resilience via rapid detection of link/path failures.
• Is either set up with an internal iBGP, with BGP routers in the same AS, or categorized as external BGP (eBGP) sessions.
• Internal BGP are more secure.
• Equal-Cost Multi-Path (ECMP) is a technique, not routing protocol for balance with performance and reliability.

Appplication Virtual Networks (AVNs)

• Are software defied networks that serve a special purpose in the SDDC.
• Span clusters and traverse NSX Edge service gateways for North/South traffic.
• Implements SDN utilizing NSX in the management domain
• They contain a Tier-0 gateway that peers with physical networks.
• Made up of both a Tier-1 Gateway that services NSX segments and a NSX Edge cluster.

AVN Uses

• Mgmt-RegionA01-VXLAN is for VMware Aria Suite workloads, VMware Aria Operations for Logs and VMware Aria Automation Proxy Servers guided deployment. Does not require region portability
• Mgmt-xRegion01-VXLAN is used for VMware Aria Suite workloads that require portability, VMware Aria Suite Lifecycle guided deployment.

AVN Configuration

• Overlay-backed NSX segment are best, requiring a direct connection to the Tier-1 gateway. The traffic is carried between VMs and the traffic has its layer carried by a tunnel.
• VLAN- backed NSX has Layer 2 traffic that is across the VLAN network between running VMs on different hosts.

WLD Checklist

• After commissioning the host, the parameters should be rechecked if they match below criteria and ensure separate VLANs and subnets if required are setup.
• Before changing the storage, reach out to support and ensure required network pool is created.

Network Pools

• Each pool constitutes a range of IP addressed to assign specific VCF services.
• A vSphere vMotion subnet should be configured during it. Hosts are first connected to a Standard VSwitch and then upon Domain integration to the VMware Distributed Switch (VDS).

Transport node

• Follow a basic guideline that allows only one overlay transport zone, ensure transport nodes more than two pNICs and a single segment assigned to a single transport zone. For the best results, refer to the VMware installation documents for recommendations. All transport modes should be of same types (ESXi and NSX).
• Ensure appropriate bandwidth depending on type of usage on the network.
• A transport zone is also not a security boundary.
• VMware Cloud Foundation leverages a single Overlay Transport Zone per NSX instance.

Overlay Zone

• An overlay transport zone has TEP. The VLAN assigned enables effective traffic traversing.
• Use cases: NSX edge nodes and host edge.

Fabric Design:

• Has an upstream layer and all L2 VLANS is used to extend and connect across racks.
• VLAN must have support for both Layer 3 and gateway functionality.
• Single vendor is preffered and supported.

Per rack

• There are different NSX profile configurations for each rack.
• In Nsx a cluster or host is common elements that address and share network features.

Preparations

• You must configure both A DCHP server for NSX overlay and a Static IP pool for host. After host commissioning you may assign to the inventory.
• Also verify DNS records exist for both vCenters and NSX manager as well as unassigned hosts to the correct Storage.