VCF 9.1 Home Lab Series – Part 14: Distributed Transit Gateway for VPCs

Welcome to part 14 of the VCF-9.1 home lab series. The previous post in this series discussed the architecture and deployment of a VNA cluster for distributed connectivity. This post will discuss implementing the distributed transit gateway for VPC connectivity.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

11: VCFA Provider Management Configuration

12: Deploy VCF Operations for Logs

13: VNA Cluster for Distributed Connectivity

Within a VPC, routing between subnets is handled by a VPC Gateway, which behaves like a distributed tier-1.… Read the rest

VCF 9.1 Home Lab Series – Part 13: VNA Cluster for Distributed Connectivity

Welcome to part 13 of the VCF-9.1 home lab series. The previous post in this series discussed deploying and configuring VCF Logs. This post will discuss VNA clusters in detail, including the deployment.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

11: VCFA Provider Management Configuration

12: Deploy VCF Operations for Logs

VCF 9.0 introduced a public-cloud-style consumption model for networking: instead of designing tier-0/tier-1 gateways by hand, tenants and application teams get Virtual Private Clouds (VPCs) with self-service subnets, routing, and security.… Read the rest

Certificate Management in VCF 9.x with Microsoft CA

In a production environment, certificate expiry is one of those problems that never announces itself until it’s too late. The self-signed certificates on various appliances quietly tick toward their expiration date, and nobody notices. Then one Monday morning, every management UI throws a browser warning, API integrations start failing, and backup jobs silently break. This is a huge operational gap for any organization.

Certificate Management in pre-VCF 9.x Era

The older VCF releases had support for integrating an external CA with the SDDC Manager, but the cert replacement was totally manual. Neither was there any way to automatically replace certificates that are about to expire, nor any alerting functionality in the UI.

Certificate Management in VCF 9.x

TLS certificates secure every management interface in a VCF deployment — vCenter, NSX Manager, SDDC Manager, ESX hosts, and the various VCF Operations components. Each one gets a certificate from a default signing CA at deployment time, and best practice has always been to replace those defaults with certificates from a trusted enterprise CA.… Read the rest

VCF 9.1 Home Lab Series – Part 12: Deploy VCF Operations for Logs

Welcome to part 12 of the VCF-9.1 home lab series. The previous post in this series discussed configuring provider management in VCFA. This post will demonstrate deploying and configuring VCF Operations for logs.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

9: Deploy Supervisor in Workload Domain

10: Deploy VCF Automation

11: VCFA Provider Management Configuration

In VCF 9.1, log management has been further unified into VCF Operations. Rather than deploying it as a standalone appliance (VCF 9.0 and earlier), it now runs as a service on the VCF Services Runtime Cluster—the same Kubernetes-based platform that also hosts Fleet Management and other management components.… Read the rest

VCF 9.1 Home Lab Series – Part 9: Deploy Supervisor in Workload Domain

Welcome to part 9 of the VCF-9.1 home lab series. The previous post in this series discussed deploying the Avi load balancer in the workload domain. In this post, I will demonstrate deploying the supervisor in a workload domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

8: Enable Avi on Workload Domain

While creating a new workload domain, you will observe that the toggle button for enabling supervisor post domain deployment is activated. You can turn off the toggle if you wish. I did the same, as I wanted to cover this topic in a separate post and discuss the networking stack on which a supervisor can be deployed.… Read the rest

VCF 9.1 Home Lab Series – Part 8: Deploy Avi Load Balancer

Welcome to part 8 of the VCF-9.1 home lab series. The previous post in this series discussed setting up network connectivity in the management domain. In this post, I will demonstrate deploying the Avi load balancer in the workload domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

7: Deploy Workload Domain

Avi and VCF Integration

VCF 5.2.X was the first version that enabled deploying the Avi load balancer using SDDC Manager. Although the deployment of the controller nodes was automated and some aspects of the Avi life-cycle management (password, certificates, and upgrade) were tied to the SDDC Manager, the configuration was largely manual and error-prone.… Read the rest

VCF 9.1 Home Lab Series – Part 7: Deploy Workload Domain

Welcome to part 7 of the VCF-9.1 home lab series. The previous post in this series discussed setting up network connectivity in the management domain. In this post, I will demonstrate deploying a new workload domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

6: Configure Management Domain Network Connectivity

A typical VCF deployment includes a management domain and one or more VI workload domains. Each VI workload domain can be configured with specific resources, network configurations, and policies to support its intended workloads. The VI workload domains are isolated from the management domain and used for hosting business applications and providing a public cloud-like experience within a VCF private cloud.… Read the rest

VCF 9.1 Home Lab Series – Part 6: Configure Network Connectivity

Welcome to part 6 of the VCF-9.1 home lab series. The previous post in this series discussed the bringup process of the management domain. In this post, I will demonstrate setting up network connectivity in the management domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: What’s New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

5: VCF 9.1 Deploy Management Domain

Why Deploy an Edge Cluster in the Management Domain Even If You Run Nothing There?

The Management Domain Edge Cluster in VCF 9.1 is the network spine of the entire software-defined fabric — it carries transit, external, and inter-VPC traffic even though no workload VMs run on it. Think of it less as a compute resource and more as a dedicated routing/NAT appliance for the whole VCF environment.… Read the rest

VCF 9.1 Home Lab Series – Part 5: Management Domain Bringup

Welcome to part 5 of the VCF-9.1 home lab series. The previous post in this series discussed setting up an offline depot. In this post, I will demonstrate deploying the VCF 9.1 management domain.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: Whats New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

4: Setting up VCF 9.1 Offline Depot

After you configure the depot settings and download the installation binaries to the VCF installer appliance, you start the deployment by clicking the deployment wizard button and selecting the option VCF.

On the introduction page, the very first page is About the deployment wizard, and it provides a high-level overview of the VCF fleet and VCF instances.

The next screen presents the different deployment paths supported in VCF 9.1. If this is a greenfield deployment, you must select the first option to deploy to a new VCF fleet.… Read the rest

VCF 9.1 Home Lab Series – Part 4: VCF Offline Depot

Welcome to part 4 of the VCF-9.1 home lab series. The previous post in this series discussed the pre-deployment planning and checklist. In this post, I will demonstrate setting up an offline depot for deploying a VCF 9.1 fleet.

If you are not following along, I encourage you to read the earlier parts of this series from the links below:

1: Whats New in VCF 9.1

2: VCF 9.1 High-Level Design

3: VCF 9.1 Pre-Deployment Planning

The very first step after deploying the VCF installer is to connect it to a depot from where it can pull the installation binaries. The VCF Installer depot supports the following connection modes.

Connection Mode Description
Online Depot Internet connection is available (either directly or through a proxy server) for binary downloads.
Offline Depot Dark site/Air gapped environment, and internet connectivity is not available.
Manual Transfer The VCF Installer appliance cannot connect to an online or offline depot.
Read the rest