Two components to vShield Zones: vShield Manager (centralised management of agents) and vShield agents (the security component that inspects traffic flow and provides firewall protection).

Deploy vShield by obtaining the OVF from the VMware Appliance Marketplace and deploying in vCenter. Follow the prompts to deploy the appliance.

Once deployed, create a new port group on the vSwitch that the vShield Manager was deployed to and call it ‘vsmgmt’ (this name is recognised by all vShield agents).

Edit the settings of the deployed vShield Manager virtual machine and select its Network Adapter 1, change the port group to vsmgmt.

Power on the virtual machine and open the console.

At the login prompt use admin / default to login

At prompt  manger>, type ‘enable’

At prompt manager# , type ‘setup’

Follow the prompts to enter network details (IP, Subnet, Default Gateway, DNS) and save the configuration.

Open a web browser and go to https://<fqdn | ip>

Login with the same account as above

You will login to the vCenter tab. Enter the IP address / name of the vCenter to connect to and login details.

Click Register under vSphere Plug-in, accept the certificate if prompted. The plug-in will now be registered in vCenter.

Once registered, look for the vShield tab under each host in vCenter.

Once the vShield Manager is setup, prepare the vShield agent. Do this by deploying the vShield agent OVF and converting the created virtual machine to a template. This template is then deployed per vSwitch requiring vShield protection.

To deploy a vShield agent, login to vShield Manager and go to the Install vShield tab. Configure the install parameters – select the template to clone (the vShield agent), IP addressing and the vSwitch to protect. Click Install to deploy the vShield agent.

Finally, if HA is deployed in the environment, ensure the vShield agent is disabled for vMotion and ensure that its host isolation response is set to Leave Powered On. Similarly, for DRS ensure that the vShield agent virtual machine is Disabled for automation

Get the OVA from the VMware Appliance Marketplace, deploy it and follow the steps. Power on the virtual machine and open it’s console. On first boot it will go through the initial network configuration, follow the steps. On to the cheat sheet…

Configure hostname:

hostname <new_hostname>

Reset the vi-admin password:

passwd

Add vMA to Active Directory domain:

sudo domainjoin-cli join <domain> <user>

Check the vMA domain status:

sudo domainjoin-cli query

Remove vMA from an Active Directory domain:

sudo domainjoin-cli leave

Enable the vi-user:

sudo passwd vi-user

Add target vCenter to vMA:

vifp addserver <vcenter_fqdn | ip> --authpolicy adauth --username <domain\user>

Add target ESX(i) host to vMA:

vifp addserver <host_fqdn | ip>

List target servers on vMA:

vifp listservers --long

Reconfigure a target:

vifp reconfigure <fqdn | ip>

Remove a server:

vifp removeserver <server>

Set a target server:

vifptarget --set <server>

Run command via vCenter example:

vicfg-nics -l --vihost <esx_host>

Run command direct on ESX(i) host:

vicfg-nics -l

Disconnect from a target:

vifptarget --clear

Shutdown vMA:

halt

Enable syslog server for all targets:

vilogger enable

Enable syslog server for a target:

vilogger enable --server <fqdn | ip>

Enable syslog server with max file size 10MB:

vilogger enable --maxfilesize 10

List names of logs collected:

vilogger list --server <fqdn | ip>

List logging status for all target servers:

vilogger list

Disable syslog server for all targets:

vilogger disable --force

The following will get CPU (num of cores) counts from hosts and will also get vCPU counts from VM’s. It will also get the operating system of each VM, its power state and the average CPU for the past week. The end of each section also has a count of the number of objects (hosts and VMs) in the environment.

Connect-VIServer <Your_vCenter_Server>
# define start and finish days (1 week period)
$startdate=(get-date).addDays(-7)
$finishdate=(get-date).addDays(-1)
# initialise counters
$vmcount=0
$hostcount=0

ForEach ($esxhost in (Get-VMHost | Sort Name)){
	Write-Host $esxhost.Name","$esxhost.NumCPU
    $hostcount++
}
Write-Host "Total Hosts:" $hostcount

ForEach ($vm in (Get-VM | Sort Name)){
    If ($vm.PowerState -eq 'PoweredOn'){
        $vstats = (Get-Stat -entity $vm -stat cpu.usage.average -Start $startdate -Finish $finishdate | measure-object -property value -average)
        # round to two decimal places
        $vavg = [system.math]::round($vstats.average,2)
    }Else{
        $vavg = 0
    }
	Write-Host $vm.Name","$vm.Guest.OSFullName","$vm.PowerState","$vm.NumCPU","$vavg
    $vmcount++
}

Write-Host "Total VM's:" $vmcount

This is a digital mental note of where VMware Tools can be downloaded from

http://www.vmware.com/download/packages.html

or direct to the tree:

http://packages.vmware.com/tools/index.html

Also, this is my 50th post. Woohoo! A ridiculous rant might have to wait until the 100th post. Yeah, that makes sense.

Was getting error “Unable to Connect to Remote Server” when trying to install the Converter plug-in from vSphere Client. The plug-in name and description were also appearing as just “converter” as opposed to “vCenter Converter” as it should be. The vCenter server had been recently setup and connected to an existing database which previously had Converter installed and the plug-in available from vCenter.

Checked in the vCenter database for details on the plug-ins available. The table in question is [VPX_EXT_CLIENT], the field [EXT_ID] will tell you which plug-in each row refers to. In this case it is the com.vmware.converter row. Noticed that the [URL] field had spaces in it (the field read: http:/server:80/vmc/VMware Converter Client.exe). Changed the spaces to %20 (since this is a HTTP service) so the field read: http:/server:80/vmc/VMware%20Converter%20Client.exe), retried the download from vSphere Client, all worked well.

I figure the plug-in’s details were updated in the database when the Converter service was installed on the new vCenter service but not sure why it ended up like that. So, put the database entry back to it’s original format (i.e. spaces instead of %20′s) and went to another client that did not have the Converter plug-in installed. Interestingly, it could see the correct name and description and could download and install the plug-in…