License Hub 2.0 for VMware vDefend and Avi LB – Architecture and Deployment

Manish Jha

Licensing has quietly become one of the more consequential architectural changes in the VCF 9.0 ecosystem. First, VCF 9.0 adopted subscription-based licensing, and now, in VCF 9.1, this change has been pushed for Avi and vDefend. What used to be a 25-character key pasted into NSX Manager is now managed through a dedicated, centralized service: License Hub. With the release of License Hub 2.0, Broadcom has taken that model further by decoupling it from the Security Services Platform (SSP) installer, shrinking its footprint, and adding the operational tooling (APIs, backup/restore, NFR support) that a standalone licensing control plane needs to run at scale.

This post walks through what License Hub is, what changed in 2.0, why it matters for anyone running vDefend 9.1 or Avi 32.1.1, and what to plan for if you’re upgrading.

What License Hub Actually Does?

License Hub for VMware vDefend and Avi Load Balancer provides centralized license management and reporting for VMware vDefend and VMware Avi subscription license files.… Read the rest

VCF 9.1 Home Lab Series – Part 15: Distributed Transit Gateway Packet Walk

Manish Jha

Welcome to part 15 of the VCF-9.1 home lab series. The previous post in this series discussed implementing Distributed Transit Gateway (DTGW) and demonstrated how NSX VPCs used DTGW for network connectivity. This post will dive deep into inspecting the ingress and egress packet flow.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

11: VCFA Provider Management Configuration

12: Deploy VCF Operations for Logs

13: VNA Cluster for Distributed Connectivity

14: Distributed Transit Gateway for VPCs

Before diving into the lab, let’s do a quick recap of DTGW and the VNA cluster.… Read the rest

VCF 9.1 Home Lab Series – Part 14: Distributed Transit Gateway for VPCs

Manish Jha

Welcome to part 14 of the VCF-9.1 home lab series. The previous post in this series discussed the architecture and deployment of a VNA cluster for distributed connectivity. This post will discuss implementing the distributed transit gateway for VPC connectivity.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

11: VCFA Provider Management Configuration

12: Deploy VCF Operations for Logs

13: VNA Cluster for Distributed Connectivity

Within a VPC, routing between subnets is handled by a VPC Gateway, which behaves like a distributed tier-1.… Read the rest

VCF 9.1 Home Lab Series – Part 13: VNA Cluster for Distributed Connectivity

Manish Jha

Welcome to part 13 of the VCF-9.1 home lab series. The previous post in this series discussed deploying and configuring VCF Logs. This post will discuss VNA clusters in detail, including the deployment.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

11: VCFA Provider Management Configuration

12: Deploy VCF Operations for Logs

VCF 9.0 introduced a public-cloud-style consumption model for networking: instead of designing tier-0/tier-1 gateways by hand, tenants and application teams get Virtual Private Clouds (VPCs) with self-service subnets, routing, and security.… Read the rest

Certificate Management in VCF 9.x with Microsoft CA

Manish Jha

In a production environment, certificate expiry is one of those problems that never announces itself until it’s too late. The self-signed certificates on various appliances quietly tick toward their expiration date, and nobody notices. Then one Monday morning, every management UI throws a browser warning, API integrations start failing, and backup jobs silently break. This is a huge operational gap for any organization.

Certificate Management in pre-VCF 9.x Era

The older VCF releases had support for integrating an external CA with the SDDC Manager, but the cert replacement was totally manual. Neither was there any way to automatically replace certificates that are about to expire, nor any alerting functionality in the UI.

Certificate Management in VCF 9.x

TLS certificates secure every management interface in a VCF deployment — vCenter, NSX Manager, SDDC Manager, ESX hosts, and the various VCF Operations components. Each one gets a certificate from a default signing CA at deployment time, and best practice has always been to replace those defaults with certificates from a trusted enterprise CA.… Read the rest

VCF 9.1 Home Lab Series – Part 12: Deploy VCF Operations for Logs

Manish Jha

Welcome to part 12 of the VCF-9.1 home lab series. The previous post in this series discussed configuring provider management in VCFA. This post will demonstrate deploying and configuring VCF Operations for logs.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

11: VCFA Provider Management Configuration

In VCF 9.1, log management has been further unified into VCF Operations. Rather than deploying it as a standalone appliance (VCF 9.0 and earlier), it now runs as a service on the VCF Services Runtime Cluster—the same Kubernetes-based platform that also hosts Fleet Management and other management components.… Read the rest

Remediating Password of a Stubborn Edge Node in VCF 5.2

Manish Jha

Recently, while working in my lab, I encountered an issue in which an edge node’s password had fallen out of sync with SDDC Manager, causing all attempts to update or remediate it to fail. The most common causes of a failed password rotation are the following:

  • SSH connectivity to the edge appliance is blocked.
  • The account is locked.
  • The password has already expired (so SDDC Manager can’t authenticate to change it).
  • The edge node’s hostname/FQDN case doesn’t match what’s stored in the SDDC Manager database.

Upon logging into the edge node, I confirmed that the password had not expired and that the edge node’s FQDN matched the value stored in the database, indicating that the underlying issue was simply a password out of sync with SDDC Manager. Every attempt to update or remediate the password continued to fail at the pre-validation stage.

I checked the API that the SDDC Manager was executing in the backend for the password update operation, and the API response reported that the edge node was not in the active state.… Read the rest

VCF 9.1 Home Lab Series – Part 11: VCFA Provider Management Configuration

Manish Jha

Welcome to part 11 of the VCF-9.1 home lab series. The previous post in this series discussed deploying a new instance of VCF Automation. In this post, I will demonstrate provider management configuration.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

In VCFA, objects are categorized under provider and organization. The provider admin creates organizations (tenants) and resources that these organizations can consume. VCFA supports two different types of organizations:

  • All-Apps: Requires a supervisor and supports running VMs and container workloads.
  • VM-Apps: Only supports running VMs (the old Aria Automation way)

The diagram below shows the high-level architecture of the VCFA.… Read the rest

VCF 9.1 Home Lab Series – Part 10: Deploy VCF Automation

Manish Jha

Welcome to part 10 of the VCF-9.1 home lab series. The previous post in this series discussed enabling a supervisor in the workload domain. In this post, I will demonstrate deploying and configuring VCF Automation.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

VMware Cloud Foundation (VCF) 9.1 represents a landmark release that fundamentally reshapes how organizations build, operate, and consume private cloud infrastructure. At its core, VCF Automation transforms the traditional infrastructure delivery model into a self-service, policy-governed cloud experience that rivals the simplicity of public cloud consumption while retaining the sovereignty and security of on-premises deployments.… Read the rest

VCF 9.1 Home Lab Series – Part 9: Deploy Supervisor in Workload Domain

Manish Jha

Welcome to part 9 of the VCF-9.1 home lab series. The previous post in this series discussed deploying the Avi load balancer in the workload domain. In this post, I will demonstrate deploying the supervisor in a workload domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

While creating a new workload domain, you will observe that the toggle button for enabling supervisor post domain deployment is activated. You can turn off the toggle if you wish. I did the same, as I wanted to cover this topic in a separate post and discuss the networking stack on which a supervisor can be deployed.… Read the rest