• Installed vSphere environment

• Binaries are downloaded from https://support.broadcom.com

• vCenter version at least 9.0.x

Start the Installation process

• Connect to your vCenter UI, go to “Inventory”, right-click on your cluster and select “Deploy OVF Template…”

• In the “Select an OVF template” screen, select “Local file” and click “UPLOAD FILES”

• Within the file browser, select your downloaded OVA file and click “Open”

• Proceed with “NEXT”

• Give the new VM a name, a location and proceed with “NEXT”

• Select a compute resource (host or cluster) and click “NEXT”

• Ignore the certificate warning and click “NEXT”

• Accept the license agreement and click “NEXT”

• Configure the appliance size and click “NEXT” but keep in mind that you should use at least “medium” for production environments.

• Configure the storage placement for your log appliance and proceed with “NEXT”.

• Customize the virtual network your VM should run on.

• Customize additional settings for the appliance and proceed with “NEXT”.

  • Initial root password - This will be used as an initial password for the root user account.

  • Hostname - The hostname or the fully qualified domain name for this VM. Leave blank if DHCP is desired.

  • Default Gateway - The default gateway address for this VM. Leave blank if DHCP is desired.

  • Domain Name - The domain name of this VM. Leave blank if DHCP is desired.

  • Domain Search Path - The domain search path (comma or space separated domain names) for this VM. Leave blank if DHCP is desired.

  • Domain Name Servers - The domain name server IP Addresses for this VM (comma separated). Leave blank if DHCP is desired

  • Network 1 IP Address - The IP address for this interface. Leave blank if DHCP is desired.

  • Network 1 Netmask - The netmask or prefix for this interface. Leave blank if DHCP is desired.

• Review the summary and click “FINISH”

Wait for the deployment to be completed.

• Power on the VM and connect to the URL.

On the initial SETUP, click “NEXT” to start the process.

• On the next screen you can choice to start a new deployment or join an existing one. In our case, we start a new deployment.

Wait for the initial configuration to be completed.

After a couple of minutes, you must specify the admin credentials.

Specify your mail server or your http post system, leave blank if you want to do this later

Correct time is essential, so configure your time source.

I do not have a SMTP server ready, so I will skip that, but you can configure SMTP if you want to.

You can change the SSL certificate right now, I am fine with the default self-signed certificate so I will skip that.

Select “FINISH” to end the initial setup wizard.

After clicking “FINISH” you have to integrate VCF Operations for Logs with your vSphere environment.

• To configure vSphere Integration click on “Configure vSphere integration »”

• On the upper right corner, select “ADD VCENTER SERVER”

Provide the following information then click “TEST CONNECTION” and if successful, click “SAVE”

Close the screen with the “<-” in the upper left, then you should see something like this.

Congratulations!

You have completed the basic deployment of VCF Operations for Logs!

Deployment:

Download VCF Installer from https://support.broadcom.com

e.g. https://support.broadcom.com/group/ecx/productfiles?subFamily=VMware%20Cloud%20Foundation&displayGroup=VMware%20Cloud%20Foundation%209&release=9.0.2.0&os=&servicePk=537791&language=EN

• Connect to your vCenter Web UI

• Right-click your cluster and select “Deploy OVF Template” from the context menue.

  

• Click on “Local file” and then on “UPLOAD FILES”

  

• Browse to your Download folder, select the .ova template and click “Open”

  

• Proceed by clicking “NEXT”

  

• Select your compute resource für your Installer and click “NEXT”

  

• Review details and proceed with “NEXT”

  

• Accept the License afreements an click “NEXT”

  

• Select the datastore where you ant to install your VM and proceed with “NEXT”

  

• Select the network of your choice and click “NEXT”

  

• Customize the Template by filling out the required fields like hostname, NTP and passwords, proceed with “NEXT”

  • root user Password
  • local user password
  • Host Name
  • NTP Servers
  • Network 1 IP Address
  • Network 1 Subnet Mask
  • Network Default Gateway
  • DNS Domain Name
  • Domain Search Path
  • Domain Name Servers

  

• Review the “Ready to complete” page and start the Deployment with “FINISH”

  

Configuration:

After successfully deploying the appliance, you must do some minor configurations regarding the depot settings.

The VCF Installer has no binaries für vCenter, ESX and other components included. After configuring the depot settings, VCF Installer can download the required binaries from either an online or an offline depot.

• Login into VCF Installer with user admin@local and the password you have specified earlier.

  

• To configure your depot settings, click on “DEPOT SETTINGS AND BINARY MANAGEMENT”

  

  Now, you have 2 Options!

1. Connect to the online depot – Download binaries directly from Broadcom.com

2. Offline Depot – Download binaries from an internal web server (good for dark sites)

   You have to decide, which option you prefer, you cannot use both!

• Option 1: Connect to the online depot

  First, click on “CONFIGURE” to start the configuration for the online depot configuration.

  

• You must specify the Broadcom download token – proceed with “AUTHENTICATE”

  Optionally you can configure proxy and proxy authentication settings für accessing the internet.

  

• After successfully completing the configuration, you should see something like this.

  

• Option 2: Connect to an offline depot

Click on “CONFIGURE” to start the configuration for the offline depot configuration.

• Fill out the form and click “CONFIGURE”

  FQDN or IP Address – FQDN or IP Adress of your internal WEB Server

  Port – WEB Server port

  Username – WEB Server Username für accessing the internal depot

  Password – WEB Server Password

  For more Information, how too setup an internal depot server, please visit:

  https://knowledge.broadcom.com/external/article/312168/vcf-offline-depot-deployment.html

  

• After successfully completing the configuration, you should see something like this.

  

Downloading the required sources from your depot:

• Now you must specify the binaries for downloading. Scroll down to the “Binary Management” area and select the product and version you want.

  

• Make your choice and click “DOWNLOAD”

  

• Wait until the download status for each component is “Success”

  

• Now you are ready to deploy a new or import an existing environment.

  At the very top of the page, you can find the “< RETURN HOME” Link.

  

  To start a new deployment or import a existing vSphere environment, start the “DEPLOYMENT WIZARD” and follow the instructions.

  

Prerequisites

1. Download PhotonOS 5 minimal OVA from:

   OVA:

   https://packages.vmware.com/photon/5.0/GA/ova/

   or ISO:

   https://packages.vmware.com/photon/5.0/GA/iso/

2. Download VMware VCF Download Tool (Latest Version)

   https://support.broadcom.com/group/ecx/productfiles?subFamily=VMware%20Cloud%20Foundation&displayGroup=VMware%20Cloud%20Foundation%209&release=9.0.2.0&os=&servicePk=537791&language=EN

Deploy PhotonOS VM

Using OVA:

• Goto vSphere Client
• Right click your Cluster where you want to deploy your VM
• Select “Deploy OVF Template”

• Select “Local file”

• Select “UPLOAD FILES” and browse to your PhotonOS 5 minimal OVA
  e.g.
  

• Select “Open” to continue
  

• Select “NEXT” to specify a VM name and location for the VM
  

• Select “NEXT” to choose your compute resource

• Select „NEXT“ to review details

• Click “Ignore” on the certificate warning and then click “NEXT” to continue

• Accept the License agreements and continue with “NEXT”

• Choose a storage to deploy on – in my case, it is the one and only vSAN Datastore. Proceed by clicking “NEXT”

  

• Specify your Network (Port Group) and click “NEXT”

  

• Review the summary and click “FINISH”

• Power ON your VM
• Connect to your VM via the web console and login as user “root” with password “changeme”

• You have to change the root password immediately!

Set a static IP Address

Before you set a static IP address, obtain the name of your Ethernet link by running the following command:

networkctl

To create a network configuration file that systemd-networkd uses to establish a static IP address for the eth0 network interface, execute the following command

cat \> /etc/systemd/network/10-static-en.network \<\< "EOF"

\[Match\]

Name=eth0

\[Network\]

Address=192.168.0.2/24

Gateway=192.168.0.1

DNS=192.168.0.99 192.168.0.100

EOF

Change the new file’s mode bits by running the chmod command:

chmod 644 10-static-en.network

Apply the configuration by running the following command:

systemctl restart systemd-networkd

Change Hostname

Replace “depot.yourdomain.com” with the FQDN of your VM

Run

hostnamectl set-hostname depot.yourdomain.com

systemctl restart systemd-networkd

systemctl restart systemd-resolved

Update your System:

Run to check for Updates:

tdnf check-update

Run update:

tdnf update

Optional:

Install Network Config Manager

tdnf install network-config-manager 

Add a disk for storing the depot binaries

In vCenter, edit the properties of your depot VM and add a secondary disc.

I am using a 1 TB thin provisioned disk because I would store different versions and Upgrades on it.

• Install FS-Utility parted:

tdnf install parted

• Scan for New Disk: Log in to Photon OS via SSH/Console and run:

fdisk \-l

Note: The new disk will likely be /dev/sdb.

• Partition the New Disk: Use parted to create a partition table:

parted /dev/sdb mklabel gpt

parted /dev/sdb mkpart primary ext4 0% 100%

• Format the Partition: Create an ext4 filesystem:

mkfs \-t ext4 /dev/sdb1

• Mount the Disk:

  • Create a mount point:

  mkdir /depot/

• Mount the disk:

  mount /dev/sdb1 /depot

• Configure permanent mount (/etc/fstab):

  • Identify the partition UUID:

  blkid \-s PARTUUID \-o value /dev/sdb1

• Edit /etc/fstab:

vi /etc/fstab

• Add this line:

PARTUUID=\<your-partuuid-here\> /depot ext4 defaults 0 2

• Verify:

mount |grep \-i /depot

Install WEB Server

Run for installing the httpd binaries:

tdnf install httpd tar jq –assumeyes

Create Certificate for WEB Server

Create a working directory and build the ssl config file, replace the yellow parts with your values:

mkdir /root/http-certificates

openssl genpkey \-out /root/http-certificates/server.key \-algorithm RSA \-pkeyopt rsa\_keygen\_bits:2048

cat \<\< ‘EOF’ \> /root/http-certificates/ssl.cfg

\[req\]

distinguished\_name \= req\_distinguished\_name

req\_extensions \= req\_ext

prompt \= no

\[req\_distinguished\_name\]

C \= \<your country code\>

ST \= \<your state\>

L \= \<your locality\>

O \= \<your organization\>

OU \= \<your organizational unit\>

CN \=depot.yourdomain.com

\[req\_ext\]

subjectAltName \= @alt\_names

\[alt\_names\]

IP.1 \= 172.16.10.11

DNS.1 \= depot.yourdomain.com

EOF

Let´s create a .csr using the .key and ssl template:

openssl req \-new \-key server.key \-out server.csr \-config ssl.cfg

Now you should have 3 files

Submit the base64 .csr to the CA of your choice and the return file must be a full chained base64 formatted .crt file.

When you have the new certificate, move the .key and .crt file to a secure location where the apache web server can access it.

mv server.key server.crt /etc/httpd/conf/

Set the correct permissions:

chmod 0400 /etc/httpd/conf/server.key /etc/httpd/conf/server.crt

chown root:root /etc/httpd/conf/server.key /etc/httpd/conf/server.crt

Of course, the Apache configuration must also be adjusted accordingly, replace the yellow parts with your values.

sed \-i 's|\#LoadModule ssl\_module|LoadModule ssl\_module|' /etc/httpd/conf/httpd.conf

sed \-i 's|\#LoadModule socache\_shmcb\_module|LoadModule socache\_shmcb\_module|' /etc/httpd/conf/httpd.conf

sed \-i 's|\#Include conf/extra/httpd-ssl.conf|Include conf/extra/httpd-ssl.conf|' /etc/httpd/conf/httpd.conf

sed \-i 's|DocumentRoot "/etc/httpd/html"|DocumentRoot "/depot"|' /etc/httpd/conf/extra/httpd-ssl.conf

sed \-i 's|ServerAdmin you@example.com|ServerAdmin your-email-address@your-domain|' /etc/httpd/conf/extra/httpd-ssl.conf

sed \-i 's|ServerName www.example.com:443|ServerName depot.yourdomain.com:443|' /etc/httpd/conf/extra/httpd-ssl.conf

Edit the file /etc/httpd/conf/extra/httpd-ssl.conf

vi /etc/httpd/conf/extra/httpd-ssl.conf

On the very bottom, insert these lines directly before </VirtualHost>

\<Directory /depot/PROD/COMP\>

        AuthType Basic

        AuthName "Basic Authentication"

        AuthUserFile /etc/httpd/conf/.htpasswd

        require valid-user

\</Directory\>

\<Directory /depot/PROD/metadata\>

        AuthType Basic

    AuthName "Basic Authentication"

    AuthUserFile /etc/httpd/conf/.htpasswd

    require valid-user

\</Directory\>

\<Directory "/depot/PROD/COMP/Compatibility/VxrailCompatibilityData.json"\>

        \# VxRail VVS Cookie Validation (VCF 5.0)

        \<If "%{HTTP:Cookie} \== 'ngssosession=ngsso-token' "\>

        Require all granted

        \</If\>

\</Directory\>

\<Directory /depot/PROD/vsan/hcl\>

        Require all granted

\</Directory\>

        \# Those Alias statements are needed only for VCF 5.1.0.0.

        Alias /products/v1/bundles/lastupdatedtime /depot/PROD/vsan/hcl/lastupdatedtime.json

        Alias /products/v1/bundles/all /depot/PROD/vsan/hcl/all.json

        \# Needed only if UMDS downloads are presented

\<Directory /depot/umds-patch-store\>

        Require all granted

\</Directory\>

Create the Basic Authentication user and password

Next, we need to create the Basic Authentication user and password that will be used. replace username with whatever you want the user to be called

htpasswd \-c /etc/httpd/conf/.htpasswd depotuser

chown apache /etc/httpd/conf/.htpasswd 

chmod 0400 /etc/httpd/conf/.htpasswd

Test the configuration

httpd \-t

Service enablement and service start

systemctl start httpd 

systemctl enable httpd

Update iptables firewall

Edit the file /etc/systemd/scripts/ip4save. Add these 2 entries directly before the “COMMIT” entry.

\-A INPUT \-p tcp \-m tcp \--dport 443 \-j ACCEPT 

\-A INPUT \-p tcp \-m tcp \--dport 22 \-j ACCEPT

To apply these changes, the service must be restarted.

systemctl restart iptables

Optional cleanup:

Cleanup these files/folders:

rm \-rf /root/http-certificates

rm \-f /depot/index.html

VCF Installer Certificate

If you are using a self-signed TLS certificate or custom root CA, we need to perform an additional step by importing the root CA into the VCF Installer, so that a trust is established or you will not be able to connect to your offline depot.

Copy the root CA certificate (e.g. rootCA.pem) onto the VCF Installer filesystem and then run the following command which will add it to the trust store and then restart the VCF Installer services for the certificate to be trusted.

STOREPASS=$(cat /etc/vmware/vcf/commonsvcs/trusted\_certificates.key)

DEPOT\_ALIAS="vcf\_offline\_depot"

DEPOT\_CERT="/tmp/rootCA.pem"

keytool \-importcert \-alias $DEPOT\_ALIAS \-file $DEPOT\_CERT \-keystore /etc/vmware/vcf/commonsvcs/trusted\_certificates.store \-storepass $STOREPASS \-noprompt

echo 'Y' | /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager\_restart\_services.sh

VMware Download Tool

• Copy the tar.gz file to your VM
• Create a target directory for the vcf-download-tool

mkdir \-p /opt/vmware-download-tool

• Untar the binaries

tar \-zxvf vcf-download-tool-9.0.2.0.25151284.tar.gz \-C /opt/vmware-download-tool/

Create a token file with your vmware download token, replace the yellow part with your tocken.

Echo \<token\> \>\> /opt/vmware-download-tool/token

Initiate Download:

Goto /opt/vmware-download-tool/bin

cd /opt/vmware-download-tool/bin

This command downloads the install packages from the source:

./vcf-download-tool binaries download \--depot-download-token-file=/opt/vmware-download-tool/token \-d /depot \--vcf-version=9.0.2 \--automated-install \--type=INSTALL

Or, if you just want to download the upgrade packages

./vcf-download-tool binaries download \--depot-download-token-file=/opt/vmware-download-tool/token \-d /depot \--vcf-version=9.0.2 \--type UPGRADE

For a complete download tool description, please visit:

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-0/lifecycle-management/binary-management-for-vmware-cloud-foundation/what-is-the-vcf-download-tool-.html

Download ESX Upgrade Binaries

SDDC Manager is looking for ESX patches for a folder named umds-patch-store and is the default directory for ESX patching.

UMDS is integrated within vcf-download-tool but needs to be installed and configured.

Install Perl:

tdnf install perl

Install UMDS:

Goto /opt/vmware-download-tool/bin

cd /opt/vmware-download-tool/bin

./vcf-download-tool umds install

Configure UMDS

mkdir /depot/umds-patch-store

./vcf-download-tool umds run \-S \--add-entitlement-token \<your token\> 

./vcf-download-tool umds run \-S \-P /depot/umds-patch-store

./vcf-download-tool umds run \-S \-e embeddedEsx-9.0-INTL

./vcf-download-tool umds run \-S \-e embeddedEsx-8.0-INTL

./vcf-download-tool umds run \-S \-d embeddedEsx-7.0-INTL

./vcf-download-tool umds run \-S \-d esxio-8.0-INTL

./vcf-download-tool umds run \-S \-d esxio-9.0-INTL

./vcf-download-tool umds run vmware-umds \-D

For a complete list of options, please visit:

https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-0/lifecycle-management/binary-management-for-vmware-cloud-foundation/what-is-the-vcf-download-tool-/vcf-download-tool-update-manager-download-service–umds–commands.html

Set permissions on /depot

chown apache \-R /depot

find /depot \-type d \-exec chmod 0500 {} \\;

find /depot \-type f \-exec chmod 0400 {} \\;

NOTE: You must reset the permissions every time you download the portfolio

Restart apache

systemctl restart https

Next Step: Configure your SDDC Manager, Installer or another component to use this offline Depot.