ESXi Host Preparation Checklist for VCF 9
Review a VCF ESXi host preparation checklist covering installation, management networking, DNS, NTP, certificates and commissioning readiness.
Overview
This ESXi host preparation checklist records the settings I used before deploying VCF 9 in my lab. Review the host configuration and additional considerations below against the requirements for your target release before using them in another environment.
Read-only host validation
esxcli system hostname get
esxcli system ntp get
esxcli system ntp test
nslookup vcenter.example.com
nslookup 192.0.2.10
openssl x509 -in /etc/vmware/ssl/rui.crt -noout -subject -issuer -dates -ext subjectAltNameReplace the example vCenter name/address. Check the host FQDN, configured and operational NTP, forward/reverse DNS, certificate validity and SAN identity. If an OpenSSL build does not support -ext, inspect the full output with -text -noout. These commands inspect state; they do not regenerate certificates.
Command reference: ESXCLI system commands. For certificate replacement, follow the workflow matching the host’s certificate mode and VCF release, rather than treating regeneration as a routine preparation step.
Host preparation checklist
After visiting with a customer today, it got me thinking about the host preparation list I use to follow prior to the custom ISOs and I figured I should share it for others out there. Below are the steps needed to prepare a host for VCF commissioning.
- Download vSphere/ESXi ISO from Broadcom Support Portal that matches the current Bill of Materials (BOM) for your version of VCF. (If you are using a OEM ESXi ISO, it is probably not the latest version of ESXi and could require additional patching of the host)
- Install ESXi on all hosts
- Configure static IP, subnet mask, gateway, DNS server(s) and in the hostname field enter in the FQDN (This is important for certificate regeneration)
- Enable SSH when required for the commissioning or approved troubleshooting workflow; restrict access and disable it afterward unless the target-release operating policy requires otherwise.
- Configure NTP service and set policy so that is starts and stops with host (Ensure NTP service is running)
- Check the host certificate FQDN/SAN and trust first. Regeneration is not a routine step for a host already using managed or custom certificates. If a self-signed hostname mismatch is diagnosed, follow Broadcom’s specific certificate-mismatch guidance and its restart requirements during a planned maintenance window.
- Configure VM Network port group to the VM Management Network VLAN ID
Additional considerations
Some options things to consider are
- Rename default datastore on hosts (Installer defaults the datastore name to datastore1)
- If you want to use custom CA signed certificates follow the guidance on the VCF Techdoc
- Do not disable IPv6 merely to hide unused addresses. Preserve the release-supported networking defaults unless a documented requirement for your exact deployment calls for a change; verify dependencies before altering the host stack.