Tag: VMware

10fb does not support flow control autoneg

Issue with nic driver on HPE servers after updating HPE drivers on ESXi 6.5 and 6.7

What happened

I ran into an issue the other day with a vCenter Server Appliance filling up one of its partitions. The partition that was filling up was the /storage/seat partition. This partition holds the postgres SQL database, so the vCenter server was in trouble.

After some digging around I realized that the root cause was a new event error from all ESXi hosts, that was coming at a rapid pace. The errors had started during the last driver and base updates, and only the HPE servers was affected. Continue reading 10fb does not support flow control autoneg

Host xxx.xxx.xxx.xxx is not compatible with the VDS version

Just had an odd issue today.

A customer had created a Virtual Distributed Switch, but was unable to add his ESXi hosts to the vDS. It said that: “Host is not compatible with the VDS version.”

He was only able to join his version 6.5 ESXi host to a 5.5 vDS. If it was upgraded to version 6.0 or 6.5 it did not work.

There are multiple reports of this online related to upgraded hosts and vCenters. I suspect that it is an issue that you only run into if you do major upgrades without reinstalling ESXi, and since I never do that I have not had that problem before.

The quick solution to this problem is: Continue reading Host xxx.xxx.xxx.xxx is not compatible with the VDS version

Unable to VMotion to new Lenovo SR650 Host

Hi,

I have had an annoying issues at two customer sites now, and I want to share the solution with you.

The problem is that you cannot VMotion VMs to a newly installed ESXi 6.5 hosts running on Lenovo SR650 hardware. The CPU used in the new host is Intel Xeon Gold 6154 Processor, and the old hosts are using Intel Xeon Processor E7-4880 v2. I do not think that the source CPU model is relevant to the issue it could be any supported Intel CPU in the same cpu family.

When trying to VMotion the following error is displayed:

The virtual machine requires hardware features that are unsupported or disabled on the target host:
"""""""""""""* General incompatibilities
"
If possible, use a cluster with Enhanced vMotion Compatibility (EVC) enabled; see KB article 1003212.

CPUID details: incompatibility at level 0x1 register 'ecx'.
Host bits: 0110:0010:1101:1000:0011:0010:0000:0011
Required: x1xx:xx1x:10x1:1xx0:xx1x:xx1x:xxxx:xx11

If you then try to enable EVC in the cluster it complains that the new hosts has an issue, and returns this error:

The host's CPU hardware should support the cluster's current Enhanced vMotion Compatibility mode, but some of the necessary CPU features are missing from the host. Check the host's BIOS configuration to ensure that no necessary features are disabled (such as XD, VT, AES, or PCLMULQDQ for Intel, or NX for AMD). For more information, see KB article 1003212.

Continue reading Unable to VMotion to new Lenovo SR650 Host

Fujitsu Primergy ESXi Install Server Notes – BIOS Settings

So I was installing some Fujitsu Primergy RX2530 M4 servers today, and since I mostly work with HPE and Lenovo servers I had lookup the optimal BIOS settings to run ESXi 6.5.

This is what I came up with. From the default settings I only changed a couple of things that I found important. Continue reading Fujitsu Primergy ESXi Install Server Notes – BIOS Settings

vRealize Operations Manager 6.6.1 Upgrade failed

Hi,

just updated a vRealize Operations Manager server today from 6.0.2 to 6.6.1, and unfortunately I got an error during the fourth step of nine (4/9):

Failed The PAK action "apply_system_update" script "/usr/lib/vmware-vcopssuite/python/bin/python updateCoordinator.pu -p " failed

As I was in the middle of a vCenter upgrade and some other stuff, that was a little annoying, and I could not really find any articles on the particular problem, so I did some digging around in the appliance, and it turns out that it is not pleased with the certificate on the appliance.

Continue reading vRealize Operations Manager 6.6.1 Upgrade failed

Allow only specific hosts to log to vRealize Log Insight

Today a college of mine was asked by a customer if it would be possible to only allow specific host to send logs to VMware vRealize Log Insight (vRLI).

And as it is running on a Linux platform iptables is built in, so I figured why not?

iptables is a in kernel firewall built in to almost any Linux distribution.

Why would you limit who can send logs to your vRLI. This is not something that I hear many customers ask for, but I can certainly understand why you would not want any host or user without permission to spam you logs. And even though the filtering in vRLI is very good, you could potentially run out of disk space, and miss log that you actually wanted. Also it would be possible for an attacker to disguise his whereabouts with generated false logs. This would not be a foolproof method to avoid this, as I can easily think of a couple of ways to accomplish this anyway. Continue reading Allow only specific hosts to log to vRealize Log Insight

VMs with multiple vNics could be a security risk

Often when I do health checks on vSphere environments I come across VMs that have multiple vNics. That can be a serious security risk if these vNics are connected to different security zones. A VM that is connected both to a DMZ and to a Administration network could allow a hacker easy access to more privileged networks. Sometimes this configuration is acceptable if the operating system is designed to handle it, if for instance we are dealing with a firewall.

I often find VMs that have a configuration where one of the network adapters is disconnected. Sometimes the second vNic was forgotten, and other times it is connected from vCenter when access to the secondary network is wanted for some kind of maintenance.

There is a settings on the virtual network adapter called “allowGuestControl”, and I was wondering if this setting could be a security issue. Could a hacker enable the disconnected network adapter from within the guest operating system, and thereby gain access to a privileged network? Continue reading VMs with multiple vNics could be a security risk

VMware NSX Active Directory Groups Missing

Today I was doing some micro segmentation at a customer site, and I was having an issue with new active directory groups not showing up when I wanted to add them to a Security Group.

I turned out that there were a lot of groups missing. I checked the synchronization but there was no errors, and no pattern in what groups was missing and what groups were there. If you do have errors this article might be relevant for you: https://kb.vmware.com/s/article/2150678

I checked the release notes for recent updates, but it did not look like this was a known bug.

Solution:
I did find a workaround. I deleted the Domain from NSX, and set if up again. Now all groups was available. This is not a very good solution since all your existing setup in regards to Identity based rules in the distributed firewall, and security groups with AD Group members, needs to be redone. So be careful to document everything before you delete the domain.

Relevant NSX version: 6.3.2.5672532

Things to know about upgrading vCSA 6.0 to vCSA 6.5

Here is a list of things that you might want to do before you upgrade your vCenter from vCSA 6.0 to vCSA 6.5.

Postgres table owner

First check you postgres database. For some reason the table owner is often wrong. Thanks to black88mx6 There is a way to check this, and also to fix it. Remember that anything you see here is executed at your own risk. An important step to perform before upgrading is taking a backup/snapshot of your vCenter VM, and any related components, so that you will be able to recover from a failed upgrade. Continue reading Things to know about upgrading vCSA 6.0 to vCSA 6.5

Award – VMware Technical Ambassador of the year 2017

I was very surprised to receive the Technical Ambassador 2017 award from VMware at the Nordic Partner Briefing on Sunday evening.

For those who don’t know my history, I have been implementing and promoting VMware and virtualization since 2002, and it is not often that you receive awards in this industry unless you are working with sales, so i really appreciate this.

I owe a big thank you to Michael Eskildsen from VMware for nominating me, to Atea and my team leader Flemming Westervang for giving me the opportunity to work with the biggest customers and most interesting cases in the Nordic, and of course to VMware for constantly raising the bar.