Hi,

We have just migrated/upgraded 2, linked mode, Windows 6.0 vCenters to 6.7 VCSAs. Everything seemed to go OK during the migrations but now they are complete there seems to be some problem with the trust or sharing of credentials between the 2 VCSAs. They still see each other as linked and VCSA 'A' is visible at the top level from VCSA 'B' and vice-versa. However attempting to expand the tree of the opposing site from either A or B gives the 'You have no priviliges to view this object or it does not exist' error message. This occours if we are logged in to either site and attempting to view the other and we get the same problem if we are logged in as 'administrator@vsphere.local' or if we are logged in as any AD account that should have the permissions to do this.

I.e. AD account 'X' is able to log in to both VCSA 'A' and VCSA 'B' and can explore the 'local' VCSA in full but can't view 'A' from 'B' and can't view 'B' from 'A'.

We can however see recent tasks intitated at either site, e.g. if we delete a VM snapshot at site 'A' (using VCSA 'A') and site 'B' (using VCSA 'B') then the recent tasks pane is populate with both tasks and in both VCSAs.

Has anyone applied the recent release patches for spectre, I wanted to make sure there are no issues before I apply them to my esxi hosts

Patches - release date 3/20/2018

EXXi550-201803401-BG    https://kb.vmware.com/s/article/52449

EXXi550-201803402-BG   https://kb.vmware.com/s/article/52450

Hi,

Has anyone had any luck deploying 8.1 Patch 2. We've had a number of cracks at getting this to function without success. The task gets to V.raVaWait4UpgradeExec and then never gets any further. The K8 pods are all still running throughout the process and nothing appears to get patched at all.

There are also 2 bundles available....

vrlcm-vra-8.1.0-8.1.0.9583.ovabundle

vrlcm-vra-8.1.0-8.1.0.9583.patch

Both appear the same and can be mapped in vRSLCM, although the ovabundle patch has a newer date. Not sure which we should be using, neither appear to do anything though!

Cheers

I've installed the trial version of VMware Workstation Pro 15.5.6 and tested shared VMs with success. After a reboot of Windows 10 Pro (Windows 10, 64-bit  (Build 19041.508) it just doesn't work anymore. I found out, that something with VMware Workstation Server is wrong:

First it writes "retrieving shared VMs location..." for a long time (1-2 minutes)

Then it fails with: the connection to the server could not be maintained due to long periods of inactivity.

But service is running:

What I tried so far without success:

• Repair installation
• Re-installation of VMware Workstation Pro (deleting C:\ProgramData\VMware before installing again)
• Restarting VMware Workstation Server or set to manually
• Set startup type: Automatic (delayed start) for the service
• Button Enable/disable Sharing pressed multiple times
• Disable firewall
• Changed the port from 443 to 4430

I have not made any changes to the hardware or software when it worked and I rebooted Windows.

Any suggestions?

Hi,

We're using Horizon 7.12 and NSX-T 2.5.0

Building instant clone pools on NSX-T segments. With the network selected for the pool . from the parent image.

On building the pool a number of the VMs appear not to connect to the network correctly.

Symptoms

vSphere VM object shows the NIC connected, disconnecting and reconnecting this makes no difference to the problem.

Guest OS shows 'Media Disconnected' in Windows 10.

Resetting the machines from View will sometimes fix this issue, sometimes it won't.

NSX-T shows the ports as operational state down!? If you admin down the ports for 30 seconds or more and then admin up the ports. The machines connect to the network and operational status goes green. View then blows them away again, obviously, they are instant clones, and they come back up broken again.

Seems entirely unreliable.

Anyone seen this?

Cheers.

When I connect my esxi host by remote location give no peer certificate found

Hello everyone

I got the following message every hour:

"Remote access for ESXi local user account 'root'  has been locked for 120 seconds..."

I found a lot of information how to figure this out:

Security.AccountLockFailures. Maximum number of failed login attempts before a user’s account is locked. Zero disables account locking.

Security.AccountUnlockTime. Number of seconds that a user is locked out.

But I didn't get out where to find the source IP who is trying to access our ESXi hosts. Isn't it in /var/log/auth.log ?

Thank you for your input.

When I select "Clean up Disks..." for my vm, it says "Reclaimable space: 150GB". I click "Clean up now", it does its thing, and it says it succeeds in doing that. No error message. But when I go back to clean up the disk again, that 150GB is still there. I never get back that 150GB on my hard drive. Why is this, and how can I fix it?

I have ESXi 7.0 installed on a new server

• Client version: 1.34.0
• Client build number: 15603211
• ESXi version: 7.0.0
• ESXi build number: 16324942

I have an iSCSI datastore with a bunch of VMs from my old server which ran ESX 6.0. If I connect the iSCSI to the new server and register the VMs and run them, they work just fine.

I no longer want to use the iSCSI datastore, I want to retire it and use a local datastore instead. However, any attempt I've made so far to copy the VMs to the new datastore has not worked. The files copy over, but when I try to power on the VM I get this error:

• Key: haTask-19-vim.VirtualMachine.powerOn-2961284483
• Description: Power On this virtual machine
• Virtual machine: Web_Server
• State: Failed - Unable to enumerate all disks.
• Errors: Unable to enumerate all disks. The specified feature is not supported by this version.

I do not have a vCenter or a vMotion license, and I cannot find any kind of "migrate" option in the vSphere web UI. Is the any way at all that I can migrate the VMs to the new datastore and preserve their snapshot history? I don't understand why copying all the files over doesn't work.

ESXi root password is getting locked frequently

I found that no machine/agent is used to authenticate ESXi server:

I rebooted ESXi several times.

Same issue.

Earlier the ESXi version was:

VMware ESXi, 6.5.0, 8294253

I even upgraded ESXi to patch but still seeing same issues:

VMware ESXi 6.5.0 build-16576891, Update 3

[root@btp01esx16:/var/log] pam_tally2 --user root

Login           Failures Latest failure     From

root              250    09/14/20 05:29:57  unknown

[root@btp01esx16:/var/log] pam_tally2 --user root --reset

Login           Failures Latest failure     From

root              250    09/14/20 05:29:57  unknown

I see following lines are continuosly recorded on /var/log/auth.log

2020-09-13T04:49:32Z sshd[71851]: rekeyed inbound cipher

2020-09-13T05:49:32Z sshd[71851]: rekeyed outbound cipher

2020-09-13T05:49:32Z sshd[71851]: rekeyed inbound cipher

2020-09-13T06:49:33Z sshd[71851]: rekeyed outbound cipher

2020-09-13T06:49:33Z sshd[71851]: rekeyed inbound cipher

2020-09-13T07:49:33Z sshd[71851]: rekeyed outbound cipher

2020-09-13T07:49:34Z sshd[71851]: rekeyed inbound cipher

2020-09-13T08:49:34Z sshd[71851]: rekeyed outbound cipher

2020-09-13T08:49:34Z sshd[71851]: rekeyed inbound cipher

2020-09-13T09:49:35Z sshd[71851]: rekeyed outbound cipher

2020-09-13T09:49:35Z sshd[71851]: rekeyed inbound cipher

2020-09-13T10:49:35Z sshd[71851]: rekeyed outbound cipher

2020-09-13T10:49:36Z sshd[71851]: rekeyed inbound cipher

2020-09-13T11:49:36Z sshd[71851]: rekeyed outbound cipher

2020-09-13T11:49:36Z sshd[71851]: rekeyed inbound cipher

2020-09-13T12:49:37Z sshd[71851]: rekeyed outbound cipher

2020-09-13T12:49:37Z sshd[71851]: rekeyed inbound cipher

2020-09-13T13:49:37Z sshd[71851]: rekeyed outbound cipher

2020-09-13T13:49:38Z sshd[71851]: rekeyed inbound cipher

2020-09-13T14:49:38Z sshd[71851]: rekeyed outbound cipher

2020-09-13T14:49:38Z sshd[71851]: rekeyed inbound cipher

2020-09-13T15:49:39Z sshd[71851]: rekeyed outbound cipher

2020-09-13T15:49:39Z sshd[71851]: rekeyed inbound cipher

2020-09-13T16:49:40Z sshd[71851]: rekeyed outbound cipher

2020-09-13T16:49:40Z sshd[71851]: rekeyed inbound cipher

2020-09-13T17:49:40Z sshd[71851]: rekeyed outbound cipher

2020-09-13T17:49:41Z sshd[71851]: rekeyed inbound cipher

2020-09-13T18:49:41Z sshd[71851]: rekeyed outbound cipher

2020-09-13T18:49:41Z sshd[71851]: rekeyed inbound cipher

2020-09-13T19:49:42Z sshd[71851]: rekeyed outbound cipher

2020-09-13T19:49:42Z sshd[71851]: rekeyed inbound cipher

2020-09-13T20:49:42Z sshd[71851]: rekeyed outbound cipher

2020-09-13T20:49:42Z sshd[71851]: rekeyed inbound cipher

2020-09-13T21:49:43Z sshd[71851]: rekeyed outbound cipher

2020-09-13T21:49:43Z sshd[71851]: rekeyed inbound cipher

2020-09-13T22:49:44Z sshd[71851]: rekeyed outbound cipher

2020-09-13T22:49:44Z sshd[71851]: rekeyed inbound cipher

2020-09-13T23:49:44Z sshd[71851]: rekeyed outbound cipher

2020-09-13T23:49:45Z sshd[71851]: rekeyed inbound cipher

2020-09-14T00:49:45Z sshd[71851]: rekeyed outbound cipher

2020-09-14T00:49:45Z sshd[71851]: rekeyed inbound cipher

2020-09-14T01:49:46Z sshd[71851]: rekeyed outbound cipher

2020-09-14T01:49:46Z sshd[71851]: rekeyed inbound cipher

2020-09-14T02:49:46Z sshd[71851]: rekeyed outbound cipher

2020-09-14T02:49:47Z sshd[71851]: rekeyed inbound cipher

2020-09-14T03:49:47Z sshd[71851]: rekeyed outbound cipher

2020-09-14T03:49:47Z sshd[71851]: rekeyed inbound cipher

2020-09-14T04:49:48Z sshd[71851]: rekeyed outbound cipher

2020-09-14T04:49:48Z sshd[71851]: rekeyed inbound cipher

VMware ESXi, 6.5.0, 8294253

Hello All,

Recently deployed a fresh install of the latest VMCA, version 7.0.0-16749653 to be exact and I've been fighting to get the authentication proxy to join a host to an active directory domain far too long. I'm nearly out of options and pretty close to giving up, so if anyone could lend me a hand I would greatly appreciate it. I'm currently using what is considered the hybrid option regarding certificates and have only replaced the VMCA Machine SSL and included my enterprise root and sub CA, the 1 host I'm currently testing with is using certificates signed by vmca. I will start by listing the tasks I've completed to get the auth proxy setup to prepare for AD joins.

1. From appliance management, I went to Services >>  Selected 'VMware vSphere Authentication Proxy' service and manually started
2. I then enabled SSH Access on the VMCA and logged in >> enable client auth using the command '/usr/lib/vmware-vmcam/bin/camconfig ssl-cliAuth -e'
3. Next, added domain and service account to VMCA using the following command '/usr/lib/vmware-vmcam/bin/camconfig add-domain -d corp.domain.com -u svc_vmware' and entered password when prompted
4. I then followed the vsphere 7.0 security guide for generating a new certificate for vsphere auth proxy (https://docs.vmware.com/en/VMware-vSphere/7.0/vsphere-esxi-vcenter-server-70-security-guide.pdf pg 106)
5. I uploaded the newly generated rui.crt to the datastore of the host I was intending on joining
6. I then changed the 'Config.HostAgent.plugins.hostsvc.esxAdminsGroup' advanced system setting on the host I was intending on joining to match the AD group I created for Admins
7. Finally, I imported the previously mention rui.crt under the host's 'Authentication Services' tab using the 'Import Certificate' button and pointed it to the directory I uploaded it on the datastore using '[datastore]/vmcam/rui.crt' and filled in the ip address of the vmca auth proxy service
8. I forgot to mention, I ran into an issue due to our domain's hardening that was solved by forcing vmca to only send auth requests to ad using ntlmv2
9. So, I used the following settings for the join domain attempt  domain: corp.domain.com/domain/sites/chi3/servers and with 'using proxy server' selected the ip address of the vmca auth proxy service

Just to note, the Active Directory service account I created as a user for the join was given delegate control using the following the steps outline in the microsoft kb https://support.microsoft.com/en-us/help/932455/error-message-when-non-administrator-users-who-have-been-delegated-con

I have also tried making different adjustments using the camconfig and camregister scripts, but receive the same results. Here is the current output for 'camconfig status':

          Default Domain Name: corp.domain.com

          Default Domain User: svc_vmware

          vCenter Server Address: 172.31.2.60

          vCenter Server User: Administrator@vsphere.local

          vCenter Server Port: 80

          SSL Settings:

                   Certificate File: /var/lib/vmware/vmcam/ssl/certs/rui.crt

                   Private Key File: /var/lib/vmware/vmcam/ssl/certs/rui.key

                   Client Authentication: Enabled.

          Success.

I receive the following errors

          VMCA Tasks 'The specified vSphere Authentication Proxy server is not reachable, or has denied access to the service.'

          VMCA /var/log/vmware/vmcamd/vmcamd-syslog.log:

                  2020-09-13T18:36:36.645515-05:00 info vmcamd  t@140698414208768: Creating machine account for Host 'host1.corp.domain.com', OU 'domain/Sites/chi3/servers'

                    2020-09-13T18:36:36.978725-05:00 info vmcamd  t@140698414208768: VmCamLdapMoveAccFromDomainBaseDn failed. (50)(Insufficient access)

                    2020-09-13T18:36:36.978903-05:00 notice vmcamd  t@140698414208768: [../../../server/vmcam/api.c,742]

                    2020-09-13T18:36:36.978996-05:00 info vmcamd  t@140698414208768: VmCamSrvCreateMachineAccount failed. (50)

                    2020-09-13T18:36:36.979082-05:00 notice vmcamd  t@140698414208768: [../../../server/vmcam/httpserv.c,231]

                    2020-09-13T18:36:36.979133-05:00 info vmcamd  t@140698414208768: VmCam HTTPS request Handler failed with 50

                    From the same log file, not sure if this is relevant to the issue, but I also see the following error upon restarting the vmcam service

                    2020-09-13T16:41:59.227138-05:00 info vmcamd  t@140698934294272: Exceptions in CAMAdapterMainLoop: Crypto Exception: error:02001002:system library:fopen:No such file or                     directory: unable to load BIO

                    I've also tried joining the machine without specifying the location of the OU and receive the following from vmcamd-syslog.log

                    2020-09-13T18:43:21.933127-05:00 info vmcamd: Creating machine account for Host 'host1.corp.domain.com'', OU ''

                    2020-09-13T18:43:22.283499-05:00 notice vmcamd: [../../../server/vmcam/api.c,810]

                    2020-09-13T18:43:22.283650-05:00 info vmcamd: VmCamSrvCreateMachineAccount failed. (5)

                    2020-09-13T18:43:22.283954-05:00 notice vmcamd: [../../../server/vmcam/httpserv.c,231]

                    2020-09-13T18:43:22.284037-05:00 info vmcamd: VmCam HTTPS request Handler failed with 5

          VMCA /var/log/vmware/vpxd/vpxd.log:

                    2020-09-13T18:43:21.892-05:00 info vpxd[53087] [Originator@6876 sub=vpxLro opID=kauto] [VpxLRO] -- BEGIN task-3066 --                          activeDirectoryAuthentication-1021 --                          vim.host.ActiveDirectoryAuthentication.joinDomainWithCAM --

                   2020-09-13T18:43:22.296-05:00 info vpxd[53087] [Originator@6876 sub=vpxLro opID=kf178jvj-6875-auto-5b0-h5:70003448-64] [VpxLRO] -- FINISH task-3066

                   2020-09-13T18:43:22.296-05:00 info vpxd[53087] [Originator@6876 sub=Default opID=kf178jvj-6875-auto-5b0-h5:70003448-64] [VpxLRO] -- ERROR task-3066 --                          activeDirectoryAuthentication-1021 -- vim.host.ActiveDirectoryAuthentication.joinDomainWithCAM: vim.fault.CAMServerRefusedConnection:

                   --> Result:

                   --> (vim.fault.CAMServerRefusedConnection) {

                   -->    faultCause = (vmodl.MethodFault) null,

                   -->    faultMessage = <unset>,

                   -->    errorCode = 1225,

                   -->    camServer = "172.31.2.60"

                   -->    msg = "The specified vSphere Authentication Proxy server is not reachable, or has denied access to the service."

                   --> }

                   --> Args:

                   -->

                   --> Arg domainName:

                   --> "corp.domain.com"

                   --> Arg camServer:

                   --> "172.31.2.60"

I apologize for the long-winded post, but I figured I would receive better responses if I provided in-depth detail. Anyways, any and all insight thoughts, suggestions, and options welcome and appreciated, as I would love to move past this as soon as possible.

Thanks in Advance,

James

Your POS website sucks!!!!

Your program won't hang on to the mouse cursor. I keep popping back out and it never seems to stay bound. Just let me click in the box... And stay there!!!! The cursor is slow like a retard but it shows proof of concept.

Let me do my schoolwork please.

I need you to put out a product that works.

Even slow as molasses is still moving.

Yay more ReCAPCHA. Just put more in between me and help please!!!

I have the following pVLAN setup on my VMWare vDS (6.5)

3000 Primary VLAN (Promiscuous)

3001 Secondary VLAN (Isolated)

3002 Secondary VLAN (Community)

I am trying to figure out how to get traffic outside the VMware vDS environment to my router connected to the physical switching environment. The uplink port on my router is tagged VLAN 3000, but not as a promiscuous port (my Cisco 3850's don't support pVLANs). If the pVLAN traffic is only leaving the vDS to reach the internet does my physical switch need to be pVLAN aware?

Hi All,

I'm working on brand new ESXi 7.0.0 deployment and have run into an issue when deploying vCenter 7.

When browsing to the vCenter UI I receive a "no healthy upstream" error.

I can access vCenter Server Management without issue.

I've done some googling and have been pointed towards certificate issues however my Leaf and Root certs are showing as valid.

All of the services which are set to Automatic start are running without any errors or warnings.

Is there a documented fix for this issue?

Hello,

I setup CentOS 7 in an virtual machine of VMware workstation with NAT.

In IPv4, everything works (including ping to other addresses, Internet access etc…). In VMware Virtual Network Editor, for NAT, in IPv4,

the IP range and default gateway are automatically provided. But for IPv6, only the prefix is provided fd15:4ba5:5a2b:1008::/64, there is no indication of gateway.

So I assign to the server the static IP fd15:4ba5:5a2b:1008::6/64, but I do not know how to fill the IPv6 default gateway (IPV6_DEFAULTGW directive).

And I cannot ping6 to external IPv6 address like ipv6.google.com.

[code]

#cat /etc/sysconfig/network-scripts/Ifcfg-eth0

TYPE="Ethernet"

PROXY_METHOD="none"

BROWSER_ONLY="no"

BOOTPROTO="none"

DEFROUTE="yes"

IPV4_FAILURE_FATAL="no"

IPV6INIT="yes"

IPV6_AUTOCONF="no"

IPV6ADDR="fd15:4ba5:5a2b:1008::6/64"

#IPV6_DEFAULTGW="fd15:4ba5:5a2b:1008::2"  # don't know how to fill the value

IPV6_DEFROUTE="yes"

IPV6_FAILURE_FATAL="no"

IPV6_ADDR_GEN_MODE="stable-privacy"

NAME="ens33"

UUID="583c9e4b-5df6-48c6-acf2-4f04a2470d53"

DEVICE="eth0"

ONBOOT="yes"

IPADDR="192.168.145.6"

PREFIX="24"

GATEWAY="192.168.145.2"

DNS1="8.8.8.8"

DNS2="1.1.1.1"

IPV6_PRIVACY="no"

[/code]

[code]

# ip addr

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

    inet 127.0.0.1/8 scope host lo

       valid_lft forever preferred_lft forever

    inet6 ::1/128 scope host

       valid_lft forever preferred_lft forever

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000

    link/ether 00:0c:29:4c:b3:e6 brd ff:ff:ff:ff:ff:ff

    inet 192.168.145.6/24 brd 192.168.145.255 scope global noprefixroute eth0

       valid_lft forever preferred_lft forever

    inet6 fd15:4ba5:5a2b:1008::6/64 scope global noprefixroute

       valid_lft forever preferred_lft forever

    inet6 fe80::8318:1893:112e:ae94/64 scope link noprefixroute

       valid_lft forever preferred_lft forever

[/code]

[code]

# ip route show

default via 192.168.145.2 dev eth0 proto static metric 100

192.168.145.0/24 dev eth0 proto kernel scope link src 192.168.145.6 metric 100

[/code]

[code]

# cat /etc/resolv.conf

nameserver 8.8.8.8

nameserver 1.1.1.1

Without IPV6_DEFAULTGW directive:

[/code]

[code]

# ping6 ipv6.google.com

connect: Network is unreachable

With IPV6_DEFAULTGW directive:

# ping6 ipv6.google.com

PING fd15:4ba5:5a2b:1008::2(fd15:4ba5:5a2b:1008::2) 56 data bytes

From fd15:4ba5:5a2b:1008::6 icmp_seq=1 Destination unreachable: Address unreachable

[/code]

- I can ping6 another VMware machine which has ipv6="fd15:4ba5:5a2b:1008::7

- Of course I cannot ping6 the Ipv6 gateway with its wrong value fd15:4ba5:5a2b:1008::2.

My question is how to be able to do "ping6 ipv6.google.com". I assume I have to fill the IPV6_DEFAULTGW directive but with what value?

Is it possible from the prefix to deduce the gateway?

Many thanks in advance.

Hello folks,

I am dealing with the "deletion in progress"status in multiple objects such as Segments and Tier-0. I went over every single place on the NSX-T Global Interface and to each local region but i cannot find any relationship with these objects and it is saying that they are already deleted but they are still in the UI.

I went over the API Reference guide to look for maybe some orphaned existing relationships between the objects but i could not find anything. I went over:

• Logical Routers
• Locale Services
• Logical Ports
• Interfaces
• Switch ports

If i try to get the information from the objects using the header "include_mark_for_delete_objects" on the API Calls i can see that the objects are still there and when i try to delete them with force options or using X-Allow-Overwrite=true (For policy objects) it just says that the object does not exists.

Any ideas?

Hello folks,

I am facing a sync issue with a NTP Server hosted in a Windows Domain Controller.

If i log into the Edges or the NSX Managers as root and run timedatectl, I can see that the NTP server sync is on and pointing to the Domain Controller.

Furthermore if I run ntpq and list the peers i can see that is there but using the RFID as .LOCL. If i look into the associationID i can see that the server is rejecting the sync. Related to network connectivity this is a plain L2 segment without Microsegmentation on it.

From here I need to ask, is there any specific that needs to be configured on the Windows NTP Server for the services to sync with it? Also is it possible to specify the Edges and NSX Manager to sync with ESXi Host (I assume here if you leave the NTP Configuration empty it will pick the time using the VMware Tools Guest sync functionality but I am not 100% sure)

Any ideas?

So...I get this email from VMware saying my password is expiring soon and I should change it before it does.  I am easily able to change the admin password on the Web GUi, however when I go to the console and login as root it does tell me that my password expires in 6 days, but that's it....there are no further prompts to change the root password!

Do I have to wait for my current password to expire?  The email alert clearly states to NOT let the password expire:

Follow these steps to update the password:

1.   Log into Skyline Collector virtual machine console 

2.   Use current root user credentials

3.   Follow the prompts to update the password

To avoid interruption in the ability to log in, we highly recommend changing the password before it expires.

What's an admin to do???

Thanks,

Charlene

Hello,

I have a Windows vCenter 6.0, which STS Signing Certificate will be expired soon, what is the right procedure to renew the certification?

I have found some articles for this topic, but all of them are for vCenter 6.5 or vCenter 6.7, not for 6.0。

Thank you for your help !

BTW, i got some errors when running the checksts.py script.

After Upgrading windows 10 from 1909 to 2004 build 19041.207, ThinApp doesn't work anymore and any portable created with it doesn't work.

Please see the error message in the attached image.