vSphere のライセンスにバンドルされるvSphere Data Protection VM（VDP）のUpgrade 方法です。

Part 2ではUpgrade VDPボタンを押下して、実際のUpgradeフェーズのご紹介します。

!!!!! 注意 !!!!!

vSphere Data Protection（VDP）のUpgradeはVxRailのサポートに含まれません。

VxRailのUpgradeの際にvSphere Data Protection（VDP）はUpgradeされませんので、お客様にて事前にUpgradeを実施いただく必要があります。

本資料は参考資料としていただき、正式な手順についてはVMware社の提供する資料をご参照ください。

本資料で紹介されない細かい手順や、トラブルシューティングなどについてもVMware社提供のKBやドキュメントを御参照ください

### vSphere Data Protection のUpgrade参考手順 ###

Upgradeの実行

前図赤枠内のUpgrade VDPボタンを押下してUpgradeを実行してください。

途中で１～２度ほどVDPとの接続が切れますが正常動作です。

切断されましたら再度ログインしてください。自動的にUpgradeの進捗画面へ遷移します。

実行中の画面については下記のGIFをご参考にしてください。

GIFが動かない場合は画像をクリックしてください

始まったら基本的に放置で問題ありません。

2回目の切断（Reboot）ののち再度接続してUpgradeタブにいくと、下図のようになにも表示されませんがまだUpgradeは続いています。

しばらくすると下図のように100％の画面が表示されます。

Upgradeが成功するとVDPは自動的にShutdownされます。

Upgrade事後作業

VDPの正常動作を確認

Upgradeが完了したらVDPを起動し、バックアップやVCとの接続性などを確認してください。

Upgrade後にvCenterから接続できなくなったら、一度web clientをLog out/inしてみてください。

それでもだめな場合はPSCとVCSAを再起動してみてください。

動作に問題がある場合はサポートへ連絡し、必要に応じてUpgrade前にSnapshotに戻してください

ShutDown～Snapshotの削除

VDPの正常稼働を確認できたら、WebClientからShutdownを実行してください。（VDP のSnapshotの取得の手順を参照）

WebClientからVDPを右クリックして「Snapshotの管理」を起動し、Upgrade前に取得したSnapShotを削除してください。

Hard Disk2以降の仮想ディスクのDisk Modeを「Independent - Persistent」にもどしてください。（VDP のSnapshotの取得の手順を参照）

ISOファイルのアンマウント

Shutdown状態のまま、Edit Settingより、以下の図を参考にISOファイルをアンマウントしてください。

※Client Deviceを選択して、ConnectedのCheckが外れていることを確認する

VDPのPowerOn

最後にVDPをPower ONしてください

サービスの正常動作を https://<IP_address_VDP_appliance>:8543/vdp-configure/ より確認してください。

Administration Guide（vSphere Data ProtectionのUpgrade概要（所要時間やマニュアル等）を参照）の“Running an Integrity Check” のセクションを参考に、手動にてIntegrity Checkを実行ください

Integrity Checkの実行

管理者ガイドの手順に従い、Integrity Checkを実施してください。

WebClientから簡単に実行できます。

Integrity Checkの進捗はWebClientのRecent Task Paneから確認できます。

（Option手順）仮想ハードウェアVersionのUpgrade

### 補足情報 ###

Intel CPUの脆弱性のFixを適用するためには仮想ハードウェアVersionが9以上である必要があります。

すでに対象Versionよりも高い場合、もしくはIntel CPU脆弱性の対応が不要な場合は本手順の実施の必須ではありません。

##############

一度VDPをShutdownしてください。

WebClientよりVDPを右クリックして、「Compatibility（日本語だと互換性）」を展開して、Upgrade VM Compatibilityを選択してください

Yesを選択してください

Intel CPUの脆弱性のFixを適用するためには仮想ハードウェアVersionが9以上である必要があります。

すでに対象Versionよりも高ければ実施の必要はありません。

仮想ハードウェアのUpgradeが完了したらVDPをPower Onしてください

Upgrade中に問題が発生したら。。。

公式の管理者ガイドの手順をよく読み、紹介されている手順を実施してください。

またそれでも解決されない場合は、検索エンジンよりVMware KBやVDPのRelease Noteを参照すると解決策が提示されていることがあります。

問題が解消されない場合はサポート窓口までご連絡ください

Upgrade後にバックアップに失敗したら

vSAN環境では以下に該当する可能性があります。

Dell EMC KB#494454

Dell EMC KB#494236

Attached is the Service-defined Firewall Solution Architecture document from the networking and security group at VMware. The Service-defined Firewall is the industry’s first purpose-built internal firewall. It delivers intrinsic stateful layer 7 firewall protection to prevent lateral movement and other attack vectors specific to the internal network of on-prem, hybrid, and multi-cloud environments.

Attached is the Service-defined Firewall Benchmark document from Coalfire. The Service-defined Firewall is the industry’s first purpose-built internal firewall. It delivers intrinsic stateful layer 7 firewall protection to prevent lateral movement and other attack vectors specific to the internal network of on-prem, hybrid, and multi-cloud environments. Coalfire’s examination and testing of the Service-defined Firewall solution utilized simulated real-world exploits. The methodology used simulated attacks that begin with the successful compromise of a vulnerable and exploitable machine within the network and then follow with attack propagation to other machines that share network access with the exploited VM.

By Mark Benson, Senior Architect and Senior Staff Engineer, End-User-Computing CTO Office, VMware

• Introduction
• What are the requirements for deploying UAG appliances using this script?
• How do I run the script?
• Configuration Settings
• Standard SSL, TLS and Cipher Settings
• Managing SSL Server Certificate Files
• Network Setting for each NIC (UAG 3.3 and newer)

Introduction

Updated March 2019 for version 3.5

In September 2015, I posted the article https://blogs.vmware.com/euc/2015/09/what-is-vmware-unified-access-gateway-secure-remote-access.html. Unified Access Gateway (UAG) is a VMware virtual appliance which is used with several VMware End-User Computing products for VMware Horizon, VMware Identity Manager and VMware AirWatch. In that article I mentioned the ability to perform a scripted deployment of a UAG virtual appliance to perform a repeatable deployment where all settings can be applied in a way that allows UAG to be production ready on first boot.

It is possible to deploy UAG in a vSphere environment using the VMware OVF Tool command. Whilst it is great to be able to specify all configuration settings in one go at deployment time, the downside of this is that the OVF Tool command line can become very long and complex. It is also easy to introduce errors on the command line as the command syntax for OVF Tool used in this way can be difficult to get right. Also, it is not possible to validate the settings with OVF Tool and it is therefore very easy to make configuration errors such as setting an admin REST API password that doesn't meet the required complexity rules.

Many Windows administrators managing a VMware End-User Computing product environment need an automated way to deploy UAG in a secure, reliable and repeatable way and to have complete control over the settings. For these reasons, we have developed a PowerShell script that can be used to deploy UAG and which overcomes the main difficulties of using OVF Tool directly on the command line. As this PowerShell script is delivered as a sample script, you can also adapt it as required for your specific needs although in most cases you won't need to modify it at all. The script calls the OVF Tool command but validates the settings and automatically constructs the correct command line syntax. The settings are taken from a simple .INI file. This script runs OVF Tool in a fully supported way for UAG deployment. Note that no password values or private key values are stored within the .INI configuration files.

The PowerShell script sets all configuration settings for OVF Tool at deployment time. This includes setting up the CA issued SSL Server certificate and all other possible settings. After UAG has been deployed by this script, there is no need to make configuration changes after deployment. UAG will be ready for production use on first boot. Using PowerShell and mastering configuration settings in a simple .ini file also simplifies the task or repeat deployments such as when upgrading UAG from one version to the next. You modify the .ova file reference in the .ini and re-run the PowerShell command. This automatically deletes the existing UAG appliance and replaces it with the upgraded image and automatically re-applies all of the initial settings from the .ini file.

What are the requirements for deploying UAG appliances using this script?

1. For UAG itself, a vSphere ESXi host and a vCenter Server is needed. Decide on the vSphere datastore to be used and the Network name to be used. If you are deploying a pre 3.3 version of UAG then a vSphere Network Protocol Profile (or IP Pool) must be associated with every referenced network name. This Network Protocol Profile specifies network settings such as IPv4 subnet mask, gateway etc. The deployment of pre 3.3 UAG appliances uses these values so make sure the values are correct. Note: In order to improve vSphere deployment flexibility, UAG 3.3 no longer uses NPPs or IP Pools. This means UAG can be deployed in environments where these are not set up. Instead, settings of IPv4 netmask, IPv6 prefix and defaultGateway (as required) must be specified in the .ini file instead. Refer to the network settings section below for details of the configuration of each UAG NIC for IPv4 and IPv6 combinations supported.
2. The PowerShell script runs on a machine running Windows 8.1 (or newer) or Windows Server 2008 R2 (or newer). This can be the vCenter Server itself if it is running on Windows, or can be a separate Windows machine.
3. The Windows machine running the script must also have the VMware OVF Tool command installed. Install OVF Tool 4.2.0 or newer. You can download it from here OVF Tool Software and Documentation.

How do I run the script?

• Download a version of UAG virtual appliance image from VMware onto your Windows machine. This is an OVA file. e.g. euc-unified-access-gateway-3.3.0.0-8539135_OVF10.ova. Refer to VMware Product Interoperability Matrixes to determine the latest version to download.
• Download the correct uagdeploy or apdeploy ZIP file attached below and extract the files into a folder on your Windows machine. Note that recent uagdeploy zip files are downloaded from VMware from the same location as the UAG images are downloaded. They are no longer attached to this page.
• On your Windows machine, open a PowerShell console and change directory to the location of your script.
• Create a .INI configuration file for your UAG virtual appliance. In this example, I am going deploy a new UAG appliance called UAG1. I have created a .INI file called uag1.ini which contains all the configuration settings for UAG1. You can use the sample .INI files contained within the uagdeploy ZIP file to create your .INI file and then modify the settings to the values you want.
• Make sure script execution is unrestricted for the current user. You can do this by running the command:
  set-executionpolicy -scope currentuser unrestricted
• You only need to run this once and only if it is currently restricted.
  If you get a warning about running this script, you can unblock that warning by running the command:
  unblock-file -path .\uagdeploy.ps1
  or
  unblock-file -path .\apdeploy.ps1
• Run the command .\uagdeploy.ps1 -iniFile uag1.ini as shown in the screenshot below. If you don't specify the -iniFile option, the script will default to ap.ini. You will be prompted to set a root password for the appliance and an optional password for the admin REST API. You will also be prompted for the vCenter password. Deployment takes around a minute depending on your host and storage performance. If you are prompted to add the fingerprint for the target machine, enter yes.

• When the script completes, the UAG appliance is ready to use. No further configuration steps are required.

.INI File Contents

The uagdeploy ZIPfile attached at the bottom of this post contains four example .INI files. uag1-basic.ini is a minimal .INI file which just contains the minimum settings needed. uag2-advanced.ini is a more complex configuration file showing additional settings available. uag3-securid.ini is an example of a configuration including RSA SecurID authentication. uag4-radius.ini is an example of a configuration including RADIUS authentication. You should start with just a basic .INI file to ensure that this deployment method works in your environment. You can then add more advanced settings in your .INI file and repeat the deployment. If you have already deployed the named UAG appliance, then running the script again will power off the appliance, delete it, and will redeploy it with the current .INI settings. This is a useful capability to use when either upgrading the appliance to a newer version, or just to change any of the settings.

Basic .INI File Example

##############################################

[General]

name=UAG1

source=C:\APs\euc-unified-access-gateway-3.1.0.0-6645767_OVF10.ova

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/esx1.myco.int

ds=Local Disk 1

netInternet=VM Network

netManagementNetwork=VM Network

netBackendNetwork=VM Network

honorCipherOrder=true

[Horizon]

proxyDestinationUrl=https://192.168.0.209

##############################################

The following table describes each configuration setting. These must be arranged in the .INI file under the appropriate Group Name shown in the first column and as shown in the sample .INI files.

Configuring UAG as a Web Reverse Proxy for VMware Identified Manager

UAG (or Access Point) 2.6 and newer can be used as a Web Reverse Proxy in front of VMware Identity Manager version 2.6 (and newer). Make sure you use a 2.6 (or newer) version of UAG or Access Point e.g.

source=euc-unified-access-gateway-3.1.0.0-6645767_OVF10.ova

For exact up to date information on UAG and Access Point compatibility, refer to the VMware Product Interoperability Matrixes.

For this setup, remove the entire [Horizon] section from the .ini file and replace it with a new [WebReverseProxy] section. Use the values shown in the sample uag10-vidm.ini file in uagdeploy ZIP file below. Set the proxyDestinationUrl to the URL of the Identity Manager server. If that service does not use a trusted CA signed SSL server certificate then you will also need to add the proxyDestinationUrlThumbprints value. Leave all other values in [WebReverseProxy] exactly as shown in the sample uag10-vidm.ini.

The setup requires "split DNS" to be setup where the URL hostname for an external user resolved to the address of UAG, and the same URL hostname for an internal user resolves to the address of the Identity Manager server.

Configuration Settings

Standard SSL, TLS and Cipher Settings

UAG is deployed with the following settings:

• SSL 2.0 disabled
• SSL 3.0 disabled
• TLS 1.0 disabled
• TLS 1.2 enabled
• TLS 1.2 enabled

• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA

Managing SSL Server Certificate Files

Deploying a trusted certificate authority (CA) signed SSL server certificate on UAG gives users the assurance that they are connecting to a trusted environment. It also significantly reduces the security risk of a so called man-in-the-middle attack between the user and the service.

If you don't specify a certificate in the [SSLCert] section of the .ini file, UAG will generate a self-signed SSL server certificate. This will work, and can be useful for initial testing, but a self-signed certificate will not be trusted by Horizon  and other clients and therefore users will receive a warning when connecting via UAG.

For production environments, it is best to obtain an SSL server certificate from a trusted CA for use on each UAG appliance.

If you have the PEM format files for the SSL server certificate (including any intermediate CA certificates and root CA certificate) you can reference the files in the pemCerts and pemPrivKey values as described later in this section.

From UAG version 3.0, the deployment of the SSL server certificate became much simpler for customers who have their trusted CA certificate and private key in PKCS#12 (.p12 or .pfx) format. From UAG version 3.0, it is no longer necessary to convert the .p12 or .pfx file to PEM format using openssl commands as described below. Instead, you can now just reference the .p12 or .pfx file directly from within the .ini file. In the .INI file, add the following lines.

[SSLCert]

pfxCerts=mycaservercert.pfx

When the script is run, these certificates and private key will be automatically deployed to the new UAG appliance. The referenced pfxCerts file should contain the SSL server certificate with private key, and any intermediate certificates required. During deployment you enter the password associated with the .p12/.pfx file.

If there are multiple certificates with private key, then you can specify which one to use with the pfxCertAlias keyword.

If you have a certificate file with private key and certificate trust chain all in one PKCS#12 format file with either a .p12 or .pfx file extension, then with UAG 3.0 and newer you can use it use it directly without conversion as described above. For UAG and Access Point versions below 3.0 you must convert the PKCS#12 format file into the two PEM format files. PEM format is still supported for UAG 3.0 and newer and can still be needed if you have PEM format files. You can convert from PKCS#12 to the two PEM files with openssl (which you can download from Shining Light Productions - Win32 OpenSSL) by running the following example openssl commands which start with a PKCS#12 file called mycaservercert.pfx.

openssl pkcs12 -in mycaservercert.pfx -nokeys -out mycaservercert.pem

openssl pkcs12 -in mycaservercert.pfx -nodes -nocerts -out mycaservercertkey.pem

openssl rsa -in mycaservercertkey.pem -check -out mycaservercertkeyrsa.pem

Edit mycaservercert.pem and remove any unnecessary certificate entries. It should contain the one SSL server certificate followed by any necessary intermediate CA certificates and root CA certificate.

The pem file may contain text between the certificates such as "Bag Attributes". These lines are not necessary and can be removed. Make sure the .pem file does not contain any single-quote/apostrophe characters. These must be removed.

In the .INI file, add the following lines.

[SSLCert]

pemCerts=mycaservercert.pem

pemPrivKey=mycaservercertkeyrsa.pem

When the script is run, these certificates and private key will be automatically deployed to the new UAG appliance. The private key PEM file should be deleted from the Windows machine once UAG has been deployed.

If you find that the deployment of UAG works when you don't specify the PEM files (i.e. for UAG to use a self-signed SSL server certificate) but fails when you supply your own certificate as described above, then follow these steps. It could be caused by a missing intermediate or root certificate in your specified PEM file.

• Log into the console of UAG as user root and enter the root password you chose when you ran the uagdeploy.ps1 script.
• Using an editor such as vi, look at the log file /opt/vmware/gateway/logs/admin.log
• If you see entries saying "Unable to build the certification path" and "No issuer certificate for certificate in certification path found" it means that you having missing intermediate or root certificate entries in the PEM or .p12/.pfx file specified for.

• To correct this, you must make sure that any required intermediate certificates and/or root certificate are present in the PEM file and then re-run the uagdeploy.ps1 script.

Network Setting for each NIC (UAG 3.3 and newer)

The table above shows the 11 IPv4 and IPv6 combination modes supported in UAG 3.3 and newer for each NIC with examples for the first NIC (eth0). The same settings can be applied to the second (eth1) and third (eth2) NICs as required.

NIC0 - eth0 - ipMode0, ip0, netmask0, vcip0, v6Prefix0.

NIC1 - eth1 - ipMode1, ip1, netmask1, vcip1, v6Prefix1.

NIC2 - eth2 - ipMode2, ip2, netmask2, vcip2, v6Prefix2.

Troubleshooting Deployment Problems

1. I get a security warning about running scripts downloaded from the Internet

Verify that the PowerShell script is the script you intend to run, and then from the PowerShell console, run the command:

unblock-file .\uagdeploy.ps1

2. I get an error saying "ovftool command not found".

Make sure you have installed the OVF Tool software on your Windows machine and that it is installed in the location expected by the script. OVF Tool Download.

3. I get an error saying "Invalid Network in property netmask0" or "Cannot initialize property 'netmask0'. Network 'VM Network' has no associated network protocol profile"

The message may state netmask0, netmask1 or netmask2, Check that a value has been set in the .INI file for each of the three networks (netInternet, netManagementNetwork and netBackendNetwork),Also check that a vSphere Network Protocol Profile has been associated with every referenced network name. This specifies network settings such as IPv4 subnet mask, gateway etc. so make sure the associated Network Protocol Profile has correct values for each of the settings.

4. I get a warning message about the operating system identifier being not supported (id: 85)

The full message is: The specified operating system identifier 'SUSE Linux Enterprise Server 12.0 64bit' (id:85) is not supported on the selected host. It will be mapped to the following OS identifier: 'Other Linux (64-bit)'.

This can be ignored. It is mapped to a supported operating system automatically.

5. How do I configure UAG for RSA SecurID authentication?

Add the following two lines to the [Horizon] section of your .ini file:

authMethods=securid-auth

matchWindowsUserName=true

Add a new section at the bottom of your .ini file containing:

[SecurIDAuth]

serverConfigFile=C:\temp\sdconf.rec

externalHostName=192.168.0.90

internalHostName=192.168.0.90

The IP addresses should both be set to the IP address of UAG. The sdconf.rec file is obtained from RSA Authentication Manager (RSA-AM) which should be fully configured according to RSA documentation.

Make sure you are using UAG 2.5 or newer and that the RSA-AM server is accessible on the network from UAG.

If there is a firewall between UAG and your RSA Authentication Manager server, make sure it isn't blocking the communication. This is normally UDP 5500 from UAG to RSA-AM and the reply traffic.

Rerun uagdeploy PowerShell command to redeploy your UAG configured for RSA SecurID. Refer to VMware UAG RSA SecurID Authentication Setup Video for a full step-by-step description of this setup. Also Refer to the RSA Ready Certification Document for VMware UAG.

Note that when RSA SecurID is configured in the .INI file, then after deployment when UAG first starts up, it performs a check against RSA-AM. If RSA-AM is not available, or if DNS cannot resolve the hostname of RSA-AM referenced in the sdconf.rec file, or if a firewall is blocking the UDP port for this communication, this startup will fail. When this initial handshake fails, the RSA SecurID component on UAG remains disabled. You can open up the sdconf.rec file with a text editor and although it is a binary file, you can see the RSA-AM hostname(s). If you suspect a communication failure, you can log in to the console of UAG as root and run nslookup with that hostname to verify that it can be resolved. Once you have resolved any environment issues, just rerun the PowerShell command to redeploy UAG.

If you need to redeploy UAG with the PowerShell command when it was previously configured for RSA SecurID, then you must first "clear node secret" on RSA-AM so that trust can be re-established.

6. How do I configure UAG for RADIUS authentication?

Add the following two lines to the [Horizon] section of your .ini file:

authMethods=radius-auth

matchWindowsUserName=true

Add a new section at the bottom of your .ini file containing:

[RADIUSAuth]

hostName=192.168.0.100

authType=PAP

authPort=1812

radiusDisplayHint=XXX Token

For more information on these and other settings, refer to the sample uag4-radius.ini file in the latest uagdeploy ZIP file below. Also refer to the [RADIUSAuth] descriptions in the table above.

Make sure you are using UAG 2.5 or newer and that the RADIUS server is accessible on the network from UAG.

If there is a firewall between UAG and your RADIUS server, make sure it isn't blocking the communication. This is normally UDP 1812 from UAG to to the RADIUS server and the reply traffic.

Rerun uagdeploy PowerShell command to redeploy your UAG configured for RADIUS.

Note that when RADIUS is configured in the .INI file, then after deployment when UAG first starts up, it performs a check against the configured RADIUS server. If the server is not available or if a firewall is blocking communication, this startup will fail.

7. How do I configure UAG for Client Device certificate authentication?

Add the following line to the [Horizon] section of your .ini file:

authMethods=certificate-auth && sp-auth

Add a new section at the bottom of your .ini file containing:

[CertificateAuth]

pemCerts=C:\Users\Administrator\Documents\SSL\CA Certs\north-ca-256.cer

The .cer file is the public certificate authority (CA) certificate that was used to issue required client device certificates.

A client device certificate must be installed in the user or computer certificate store on the system where the Windows Horizon Client is installed. This proves the identity of the client computer. Unless the client supplies a valid certificate issued by this CA, then UAG will reject the connection with an error as shown below.

Client devices that do supply a valid certificate will get the normal user authentication prompt.

This feature is typically used to ensure that only Windows domain joined client computers can connect to desktops and applications via UAG. The client device certificates can be managed automatically as part of a Windows client machine enrolment policy.

For the Cryptographic Service Provider (CSP) specified in the certificate issuing template, use the "Microsoft Enhanced RSA and AES Cryptographic Provider". This supports SHA256 certificates and TLS 1.2. SHA1 is generally now considered too weak for authentication purposes so you should use SHA256.

For Windows to be able to use the certificate for client authentication purposes, the user on the client computer must have read access to the certificate private key. It is not necessary or desirable to make the private key exportable. The Key Usage of the certificate must include "Digital Signature" and "Key Encipherment (a0)".

8. I get an error saying "Locator does not refer to an object"

This means that the target= value (used by vSphere OVF Tool) is not correct for your vCenter environment. Refer to the table above for examples of the target format used to refer to a vCenter host or cluster. If you are not sure of the names to use, you can start with the top level object, e.g. by specifying:

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/

This will then show a list of possible names to use at the next level. You can then expand it, one level at a time based on this list.

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/Cluster1/

or

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/esxhost1

or

target=vi://administrator@vsphere.local:PASSWORD@192.168.0.21/Datacenter1/host/my folder/esxhost1

Note that folder names, host names and cluster names used in the target value are case sensitive.

9. I get an error saying "Transfer failed and Error: failed to send http data"

This will happen if your target entry references an ESXi hostname that cannot be resolved by your local computer.

This will also happen if you are using a version of vSphere OVF Tool that is not compatible with the version of vSphere and vCenter you are using. I have seen this error after upgrading vSphere to version 6.5 where I was using an older 4.1.0 version of OVF Tool which is not compatible. In this case, the solution was to upgrade to OVF Tool version 4.2.0 or newer - see OVF Tool Software and Documentation.

For any questions on UAG, post a message on the discussion section of the Horizon community forum.

この記事では、vm-supportの作成方法をご紹介致します。

※正式な手順はVMware KBをご参照ください

vc-supportログとセットでvm-supportログを生成するも、vm-supportが正常に同梱されない時や生成されない時など、

指定のESXiホストのvm-supportログだけを取得する際に利用できます。

vSphere Web Clientを利用されている方は下記をご参照ください

VxRail: vm-suuportログ取得手順（vSphere Web Client利用）

vSphere Web Clientを利用して、単体ESXiホストからのvm-supportログ生成手順

     1. vSphere Clientにログイン

     2. Home > Host and Clusters > 対象ESXiを右クリック > Export System Logs..を選択

     3. Export System LogsのMenuにて、"EXPORT LOGS" のボタンを選択

          ※ブラウザにて新しいtabが開きますので、Pop-up windowは許可するようにしてください

          　 また、新しいtabはログの生成が完了するまで閉じないでください

     4. ログの生成が完了すると、ダウンロードが開始されるのでログを保存（ご使用のブラウザにて挙動が違いますのでご注意ください）

               a. Chromeの場合は、自動でダウンロードが開始されます

               b. Firefoxの場合は下記のようなPop-upが表示されます

※ダウンロードされたファイルの中に、vm-supportが保存されております

### VMware KB

正式な手順は下記KBの該当項目をご参照ください

Collecting diagnostic information for VMware products (1008524)

    ・VMware ESXi/ESX

VMworld 2019 San Francisco Podcast Booth Schedule

Notes: Sign-up is first come first serve. Slots are 1 hour long, and we have 1 podcast booth. It is also required that you bring your own gear. If you would like to have your Podcast posted on our Podcast page, or for more information, please contact the VMTN Community Manager, Jennifer Gonzales via email at jenniferg@vmware.com or on Twitter at @jennivmtn.

*There will be no AV tools provided. Please bring your own recording devices if necessary.

Version 1.3.2-14238188

• Fixed an issue with synchronization of dynamic type configuration in clustered environments

Version 1.3.0-7052852

• Fixed a possible dynamic type configuration corruption during server startup in clustered environments
• Compatible with vRealize Orchestrator version 7.1 and later

この記事では、VxRailでのvCenterで発生するアラートをSMTPを使用してメール通知する設定方法を紹介します。

※正規な手順に関しては、VMware Document及びKB等をご参照ください

1. vCenterへSMTPサーバ(メールサーバ)と送信者アドレス(sender)を設定

a. vCenter Server SettingsのMenuへ移動

     ・vCenter 6.0の場合

vSphere Web Client にLoginし、"Host and Clusters"を選択

左側の最上部に位置するvCenterを選択し

Manage > Settings > General でvCenter Server Settingsを表示、Mailの項目を押して展開(未設定の場合は下記の表示)

右側にあるEditを押す

     ・vCenter 6.5/6.7の場合

vSphere Web Client にLoginし、"Host and Clusters"を選択

左側の最上部に位置するvCenterを選択し

Configure > General でvCenter Server Settingsを表示、Mailの項目を押して展開(設定済の場合は下記の表示)

右側にあるEditを押す

b. Edit vCenter Server SettingsにてMailの欄にMail Serverと送信者として設定するアドレスを入力

※アドレスはドメイン名 （@ 記号のあとの情報） を含む完全な E メール アドレスを入力してください

左側の"mail"を選択し、必要な情報を入力しOKを押す

c. 設定した値がGUIに反映されていることを確認

2. vCenterに定義されているアラート設定に、メールを送信する設定を追加

※下記例はESXiがvCenterへの応答がなくなった場合等に発生するアラートの"Host connection and power state"を例にしています

※アラートを見つける際には、虫眼鏡マークの"Filter"に文字列を入力すると見つけやすいです

a. vCenterに定義されているアラート(Alarm Definitions)一覧へ移動し設定を追加するアラートを選択

     ・vCenter 6.0の場合

vSphere Web Client にLoginし、"Host and Clusters"を選択

左側の最上部に位置するvCenterを選択し

Manage > Alarm Definitions を選びアラート一覧を表示、"Host connection and power state"の項目を選択

右側にあるEditを押す

     ・vCenter 6.5の場合

vSphere Web Client にLoginし、"Host and Clusters"を選択

左側の最上部に位置するvCenterを選択し

Monitor > Issues > Alarm Definitionsを選びアラート一覧を表示、"Host connection and power state"の項目を選択

右側にあるEditを押す

     ・vCenter 6.7の場合

vSphere Client にLoginし、"Host and Clusters"を選択

左側の最上部に位置するvCenterを選択し

Configure > More > Alarm Definitionsを選びアラート一覧を表示、"Host connection and power state"の項目を選択

右側にあるEditを押す

b. アラートが発生した際にメールを送信する設定を実施

     ・vCenter 6.0/6.5の場合

左側の"3 Actions"タブを選択

緑の"＋"を押して、Action列にて"Send a notification email" を選択

Configuration列にて、送信先のメールアドレスを入力

※複数のアドレスの場合は、コンマで区切りながら入力

アラームのステータス移行に関して"Once"か"Repeat"を選択しメールの送信するタイミングと頻度を選びます

     ・vCenter 6.7の場合

Name and Targets は変更せず、"NEXT"で項目を進める

Alarm Rule 1   にて"Send email notifications" にチェックをし、

”Email to”にて送信先のメールアドレスを入力（必要に応じて、Subjectも変更）

"NEXT" で進めて、Review にて"SAVE"

アラーム毎のステータス移行はアラートのTriggers欄を参照すると良いです(vCenter 6.0/6.5)

vCenter 6.7の場合は、上記の"Alarm Rule"に条件の記載があります

※下記は、"Host connection and power state"（左）、"Host memory usage"'(右)のtrigger例です

c. 設定したActionがGUIに反映されていることを確認

     ・vCenter 6.0/6.5の場合

"Host connection and power state"の詳細欄のActionsを押して展開

Send a notification emailと送信先アドレスが反映されていることを確認

     ・vCenter 6.7の場合

"Host connection and power state"を選択し、→(右矢印マーク)を押下し展開

Alarm rule欄を確認しSend emailと送信先アドレスが反映されていることを確認

### 補足情報

デフォルトで提供されているアラームに関しては、下記のVMware Documentで紹介されております。
※下記DocumentはvSphere 6.7(VxRail 4.7)ですが、Documentの右上のVersion選択でvSphere 6.5(VxRail 4.5)等の情報も参照可能です

・事前構成済みの vSphere アラーム
https://docs.vmware.com/jp/VMware-vSphere/6.7/com.vmware.vsphere.monitoring.doc/GUID-82933270-1D72-4CF3-A1AF-E5A1343F62DE.html

・デフォルトの vSAN アラームの使用
https://docs.vmware.com/jp/VMware-vSphere/6.7/com.vmware.vsphere.vsan-monitoring.doc/GUID-E7885CDE-654D-4732-A5FE-31D0AB2B2F57.html

### 参考文献

・アラーム アクションの指定

・アラーム アクションとしての E メールの送信

・vCenter Server アラームの電子メール アラートの構成 (2123925)

     https://kb.vmware.com/s/article/2123925?lang=ja

・メール送信元設定の構成

Cenforce 100

本記事では、ESXi / vCenter Sever Appliance / PSC のSSH有効化手順を紹介します。

各コンポーネントへのSSH接続はデフォルトで無効になっておりますので、障害調査や作業の際にSSHでのアクセスが必要になった際は手動で有効化する必要があります。

※サンプルスクリーンショットは適宜クリックで拡大してください

-ESXi(vSphere 6.5 / VxRail 4.5以前)

1. vSphere Web Clientにログイン

2. Hosts and Cluster(ホストおよびクラスタ) > SSHを有効にする対象のESXiホストを選択

3. Manage(管理) > Settings(設定) >Security Profile(セキュリティ プロファイル)を選択

4. Services(サービス)の欄より、SSHの状態を確認し、Edit(編集)をクリック

5. SSHの項目をクリックし、Start(開始)、OK

以上でESXiホストへのSSH接続が有効になります。

ログインの際はrootユーザを使用ください。

また、SSHクライアントにTera Termをご利用の場合はチャレンジレスポンス認証にて接続ください。

必要な対応が完了し、SSHを無効に戻したい場合は上記5.で"Stop(停止)"を選択してください。

-ESXi(vSphere 6.7/VxRail 4.7以降)

1. vSphere Clientにログイン

2. Hosts and Cluster(ホストおよびクラスタ) > SSHを有効にする対象のESXiホストを選択

3. Configure(設定) > System(システム) にあるServices(サービス)を選択

4. Services(サービス)のメニューより、SSHを選択し、Start(起動)をクリック

5. SSHの項目のDaemon(デーモン)欄がRunning（実行中）に変わったことを確認

以上でESXiホストへのSSH接続が有効になります。

ログインの際はrootユーザを使用ください。

また、SSHクライアントにTera Termをご利用の場合はチャレンジレスポンス認証にて接続ください。

必要な対応が完了し、SSHを無効に戻したい場合は上記4.で"Stop(停止)"を選択してください。

-VCSA(vCenter Server Appliance)、及びPSC(Platform Service Controller)

1. ウェブブラウザにて、"https://vCenter or PSC IP:5480" にアクセス。rootでログイン。

2. 左ペーンの"Access(アクセス)"を選択

3. メインパネル右上の"Edit"をクリック

4. "Enable ssh login(SSH ログインの有効化)"、"Enable bash shell(bash シェルの有効化)"をチェックし、OK

以上にてVCSA、またはPSCへのSSH接続が有効になります。

ユーザはrootにてログイン可能です。

5. Bash シェルの有効化

VCSA、PSCのCLIにアクセスすると、デフォルト設定ではApplianceシェルにログインします。

Applianceシェルでは実行できるコマンドが限られているため、一般的なUnixベースOSと同等の操作を行うためにBashシェルに遷移します。

VMware vCenter Server Appliance 6.0.0.30300

 

Type: vCenter Server with an external Platform Services Controller

 

Last login: Mon Aug 13 02:30:21 UTC 2018 from hostname.domain.com on pts/0

Last login: Mon Aug 13 02:30:54 2018 from hostname.domain.com

Connected to service

 

    * List APIs: "help api list"

    * List Plugins: "help pi list"

    * Enable BASH access: "shell.set --enabled True"

    * Launch BASH: "shell"

 

Command> shell.set --enabled True                                     ←Bashシェルを有効化

Command> shell                                                                    ←Bashシェルに遷移

    ---------- !!!! WARNING WARNING WARNING !!!! ----------

 

Your use of "pi shell" has been logged!

 

~中略~

 

vchostname:~ #                                                                                ←プロンプトのマーカが#になっている

vchostname:~ #

※下記VMware KBを利用し、デフォルトシェルをBashに変更することも可能です。

Toggling the vCenter Server Appliance 6.x default shell (2100508)

対応完了後にSSHを無効に戻したい場合は、4.のチェックボックスを外し、OKを選択してください。

以上

I have installed the Workstation Pro V15.1,  and I want to create a new virtual machine. When the software worked  at  hardware configuration step, I modified the display memory size from 1GB to 3GB,then I push the enter button, the software give a message 'Unknown fault". I can not operate the software, can not close the fault message window and can not operate next step.

Technical preview version of VMware vCenter Orchestrator Plug-In for Microsoft Active Directory

This is a patch release of the plug-in.

Version 3.0.9-10953259

• Added RoundRobinDNSServer option for Client side load balancing and fail-over capabilities.

Version 3.0.8-10511038

• Fix a thread leak in ActiveDirectory#searchForEntry()

Version 3.0.7-7624613

• Fix "Update an Active Directory Server" load balancing mode configuration properly not populated on vRealize Orchestrator 6.0.5
• Fix Action 'getLoadBalancingMode' in module 'com.vmware.library.microsoft.activeDirectory' failed : TypeError: Cannot read property "mode" from null (unnamed script#1)
• Added ActiveDirectory.getEntry() method  - Search  for ldap entry by it's distinguished name

Version 3.0.6-5491166

• Add  Client side load balancing and fail-over capabilities for persisted Active Directory connections.
• Fix After restarting vRO service plug-in configuration options "Search size limit" and "Search size limit per server"  are reset to their default values.

Version 3.0.4-4950206

• Fix UserGroup.memberOf method always return NULL

Version 3.0.2-4209033

• Added LdapFilter scripting object

    Note: 3.0.2-4209033 GA version of the plugin is available as part of vRealize Orchestrator Appliance 7.1

Version 3.0.0-4132888

• Added generic LDAP client (LdapClient).
• Added support for SimplePagedResultsControl. It allows the client to iterate through a potentially large set of search results in subsets of a specified

number of entries (i.e., "pages").

• Added support for non-persistent LDAP connections ().
• Added User.getSID() and UserGroup.getSID() scripting methods for retrieving objectSID attribute in folowing format format 'S-1-IdentifierAuthority-SubAuthority1-SubAuthority2-...-SubAuthorityn'
• Added getGUID() support for retrieving objectGUID formatted as dashed string
• Fix: ActiveDriectory.search() methods discards configured LDAP base
• Removed sub-domain entries from inventory tree of parent domain. (Deprecated since 2.0)

Notes : Compatible with vRealize Orchestrator 5.5.2+

Notes : Introduction to new feature available here  Active Directory plugin 3.0.0 - New and Noteworthy

Version 2.0.8-3635144

• Support for named Active Directory connection configurations

Version 2.0.7-3423847

• Fix : rename method for AD:User does not accept names that contain commas.
• Fix : ActiveDirectory "Base" setting discarded.

Version 2.0.6-3285066

• Fix : rename method for AD:User does not accept names that contain commas

Version 2.0.5-3151865

• Fix : Can not modify attributes of entry containing forward slash in the name.
• Fix : Configuration changes not propagated among vRO cluster nodes
• Added ActiveDirectory.rename() method for renaming/moving entries inside same domain.

Version 2.0.4-3014454

• Fix : ActiveDirectory.searchExactMatch not returning correct result when user name contain forward slash.

Version 2.0.3-2824604

• Fix : User.memeberOf not returning correct result when user is not from default domain

Version 2.0.2-2670588

• Fix : AD:UserGroup.userMembers return null when user name contain comma.
• Fix : AD:UserGroup.userMembers return null when the users are not part of default domain.

Version 2.0.1-2597988

• Fix : Configure "Active Directory plug-in options" workflow does not set default server.

Version 2.0.0-2543027 GA

• Add support for Multiple Active Directory hosts

Notes : GA version available for download from - VMware vCenter Orchestrator Plug-In for Microsoft Active Directory Release Notes

Notes : Compatible with vRealize Orchestrator 5.5.2+

Version 1.0.6-2315152

• Fixed validation warning messages in the AD plugin's workflows.

Version 1.0.5-1866388

• OU/AD objects from the AD plugin are getting lost/not-found. In configurations, a value with the attribute of AD:OrganizationalUnit reports "Not found"
• Fix "Object 'OU:DC=xxxx,DC=yyyy,DC=com' of type ActiveDirectory not found" for AD entities containing special characters like COMMA in CN value.

Version 1.0.4-760

• Plugin configuration performed trough workflows.
• Fix. Deleted ad object is still returned by the plugin.