Upgrading a vCenter Server Appliance (VCSA) to version 6.7

Last week VMware launched vSphere 6.7. In this blog post I show how easy it is to upgrade a vCenter Server 6.x appliance to a new vCenter Server 6.7 appliance using the graphical interface (GUI) upgrade. The GUI upgrade uses a two stage process:

  • Stage 1: Deploy a new vCenter Server 6.7 appliance
  • Stage 2: Transfer the services and configuration data from the old to the new appliance

Upgrading the vCenter Server Appliance includes deploying a new appliance (version 6.7). The configuration and data is transferred from old (6.0 or 6.5)  appliance to the new vCenter Server 6.7 Appliance.  The old appliance is still available in a powered down state in the vCenter Server inventory after the upgrade.

vSphere 6.7 is the last release to include vCenter Server for Windows. After this release, vCenter Server for Windows will not be available! So make sure that all new deployments and upgrades are using the the vCenter Server Appliance (VCSA)!

New enhancements

Some cool enhancements of the vCenter Server 6.7 appliance are:

  • The vCenter Server with Embedded PSC supports Enhanced Linked Mode. This gives the following benefits:
    • No load balancer required for high availability and fully supports native vCenter Server High Availability.
    • SSO Site boundary removal provides flexibility of placement.
    • Supports vSphere scale maximums.
    • Allows for 15 deployments in a vSphere Single Sign-On Domain.
    • Reduces the number of nodes to manage and maintain.
  • vSphere 6.7 supports repointing a vCenter Server to another external Platform Services Controller in the same SSO site and different SSO site within the same SSO domain
  • vSphere 6.7 supports repointing a vCenter Server (Appliance only) to another external Platform Services Controller in a different SSO domain.
  • The vSphere Appliance Management Interface (VAMI) on port 5480 has some great new enhancements:
    • Upgraded Clarity interface
    • Dedicated monitor tab
    • Services tab. See the status of the VCSA services and the ability to: stop, start and restart services. So no CLI is needed for that anymore!
    • Backup scheduler. The backup scheduler let you schedule a backup of the VCSA and select how many backups are retained. The supported protocols for backup locations are: FTP, FTPS, HTTP, HTTPS and SCP.
  • The vSphere Client (HTML5) has updated and includes new workflows on Update Manager and vSAN for example.

Before upgrading

Before upgrading make sure to check this:

  • Check the compatibility of the VMware and third party products you are using. When writing this blog the following VMware products are not compatible (yet) with vSphere 6.7:
    • NSX
    • Horizon. Horizon 7.4 is not compatible with the Instant Clone API used in vSphere 6.7. Instant Clone support for vSphere 6.7 will be available in an upcoming Horizon release.
    • VMware Integrated OpenStack (VIO)
    • VMware vSphere Integrated Containers (VIC)
    • vCloud Director
  • For the upgrade order of multiple VMware products see the “Update sequence for vSphere 6.7 and its compatible VMware products (53710)” KB, link
  • It’s only possible to upgrade the vCenter Server Appliance version 6.0 or 6.5 to 6.7.
  • It’s not supported to upgrade from 6.5 U2 to 6.7! It will be provided in a future release! With vSphere 6.7 Update 1 (not available yet) it’s possible to upgrade from vSphere 6.5 U2 to vSphere 6.7 U1.
  • For vSphere 5.5 you must first upgrade to vSphere 6 or vSphere 6.5 before upgrading to vSphere 6.7
  • Make sure you have enough capacity in the cluster to add an extra vCenter Server Appliance (VCSA). The old appliance can be removed when the upgrade is successful. Here’s an overview of the hardware specifications needed.
  • In vSphere 6.7, only TLS 1.2 is enabled by default. vSphere 6.7 disables TLS 1.0 and TLS 1.1 protocols for improved security. Some applications might support only the older protocols. To revert TLS 1.0 and TLS 1.1 protocols use the TLS reconfigurator tool. The tool can be found in the appliance under: /usr/lib/vmware-TlsReconfigurator/VcTisReconfigurator.
  • Windows 2003 and XP are no longer supported.

Platform Services Controller (PSC) hardware sizing

Option Environment vCPU Memory (GB) Default Storage (GB)
Platform Services Controller 2 4 60

vCenter Server Appliance (VCSA) hardware sizing

Option Environment vCPU Memory (GB) Default Storage (GB)
Tiny Up to 10 hosts or 100 VMs 2 10 250
Small Up to 100 hosts or 1000 VMs 4 16 290
Medium Up to 400 hosts or 4000 VMs 8 24 425
Large Up to 1000 hosts or 10000 VMs 16 32 640
X-Large Up to 2000 hosts or 35000 VMs 24 48 980
  • Use a temporary fixed IP address
  • Make sure that you have the SSO administrator and root account information of the existing VCSA
  • Have a backup of the VCSA
  • Disable Fully Automated DRS during the upgrade

The upgrade steps

In the following steps a single vCenter Server  Appliance with an embedded PSC and vCenter Server role will be upgraded to version 6.7.

  • Mount the VCSA ISO (VMware-VCSA-all-6.7.0-8217866.iso)
  • Navigate to the <drive letter>:\vcsa-ui-installer\win32\ folder and open the installer.exe
  • Choose for the upgrade option. With the option you can upgrade a PSC and vCenter Server appliance.

  • 1. The upgrading process will enter “stage 1”, deploy the appliance.

  • 2. Accept the End user License Agreement.

  • 3. Connect to the source vCenter Server 6.x appliance and ESXi server.  Enter the SSO and root username of the VCSA and the ESXi server that manages the source appliance. Accept the certificate warning.

  • 4. Select the deployment target. I use the same ESXi host where the source VCSA is running. Accept the certificate warning.

  • 5. Set up the target appliance VM name and root password. The upgrade will maintain the original FQDN name of the VCSA. This name will be used as VM name in the VCSA inventory and can be changed later!

  • 6. Select the (new) size of the new appliance.

  • 7. Select the datastore

  • 8. Configure the network settings. Make sure to use an new temporarily IP address for the upgrade. After the upgrade the new appliance will use the original IP address!

  • 9. Click finish to start stage 1

 

 

 

 

 

  • After a while the following message appears and you’re ready to continue to stage 2.

  • 1. Introduction. Stage 2 will copy data from the source vCenter Server Appliance to the new deployed appliance.

  • 2. A pre-upgrade check will run, after the pre-upgrade check has finished warning messages will be shown such as:
    • Disable Fully Automated DRS during the upgrade
    • Files that cannot be used with Update Manager 6.7 will not be copied from the source.
    • An NSX extension has been found that may not work after the upgrade

  • 3. The data types that needs to migrated can be selected. A new cool thing is that the amount of time that’s involved is displayed for the Configuration data.

  • 4. Configure the VMware Customer Experience Improvement Program (CEIP)

  • 5. Ready to start fase 2 by selecting “I have backed up the source vCenter Server and all the required data from the database.

  • A shutdown warning is displayed, the source VCSA will be shut down.

  • The data transfer and appliance setup is running

  • A couple of messages will be displayed about for example Auto Deploy and that TLS 1.0 and TLS 1.1 are disabled in vSphere 6.7.

  • Stage 2 is completed and the vCenter Server Appliance is deployed.

  • Now you can access the vCenter Server by using vSphere Client (HTML5), the vSphere Web Client or VMware Appliance Management Interface by using the original FQDN of the vCenter Server Appliance.

After the upgrade the VCSA is upgraded to version 6.7.

vMotion between two vCenter Servers with different SSO domains

Last week i did my first vMotion between two vCenter Servers with different SSO domain by using PowerCLI. This functionality is also known as “cross vCenter vMotion” and is not included in the vSphere Web Client yet. Without downtime it’s possible to live migrate VMs from one vCenter Server to another. Cool stuff!

Before starting the following requirements must be met:

  • VMware vSphere 6.0 and later for the source and destination environment
  • PowerCLI 6.5 and later
  • vSphere Enterprise Plus license per ESXi host
  • An active connection to the source and destination  vCenter Server

I created a simple script to vMotion the VMs between the two SSO domains. See the more information section for more advanced PowerCLI scripts from for example William Lam and Romain Decker.

In the script the following variables must be defined:

  • Source vCenter Server, username and password
  • Destination vCenter Server, username and password
  • VM name will be moved
  • Destination vSwitch
  • Destination Portgroup
  • Destination datastore

Only VMs with one NIC are supported

PowerCLI example script

Import-Module VMware.PowerCLI
 
#Variables
$sourceVC = 'sourcevc'
$sourceVCUsername = 'administrator@vsphere.local'
$sourceVCPassword= 'password!'
 
$destVC = 'destinationvc'
$destVCUsername = 'administrator@vsphere.local'
$destVCPassword= 'password'
$destESXi = 'destinationesxi'
 
$vmname = 'vmname'
$Switchname = 'destinationswitch'
$NetworkName = 'destinationvlan'
$datastorename = 'destinationdatastore'
 
# Connect to the vCenter Servers
$sourceVCConn = Connect-VIServer -Server $sourceVC -user $sourceVCUsername -password $sourceVCPassword
$destVCConn = Connect-VIServer -Server $destVC -user $destVCUsername -password $destVCPassword
 
$vm = Get-VM $vmname -Server $sourceVCConn
$networkAdapter = Get-NetworkAdapter -VM $vm -Server $sourceVCConn
 
$destination = Get-VMHost -name $destESXi -Server $destVCConn
$destinationPortGroup = Get-VirtualPortGroup -VirtualSwitch $Switchname -name $NetworkName -VMHost $destination
$destinationDatastore = Get-Datastore -name $datastorename -Server $destVCConn
 
Move-VM -VM $vm -Destination $destination -NetworkAdapter $networkAdapter -PortGroup $destinationPortGroup -Datastore $destinationDatastore

With this script I migrated a couple of VMs between to vSphere 6.5 environment with different SSO domains without any downtime.

More information:

  • PowerCLI blog on the Move-VM cmdlet, link
  • William Lam, Automation Cross vCenter vMotion, link
  • Romain Decker Cross vMotion script from, link

What to know about vSphere 6.5 Update 1 before upgrading

vSphere 6.5 Update 1 is the first major update after the GA release of vSphere 6.5. Besides great new improvements such as vSAN 6.6.1 some nasty bugs are fixed. Here’s a short list you want to know before upgrading to vSphere 6.5 Update 1:

  • Upgrade from vSphere 6.0 Update 3 is now a supported upgrade path to vSphere 6.5.
  • Customers who are still on vSphere 5.5 will need to be on at least vSphere 5.5 Update 3b, build 3252642 in order to upgrade to vSphere 6.5 Update 1.
  • Discontinuation of third party vSwitch. Customers using 3rd patry switches such as Cisco Nexus 1000V, Cisco VM-FEX, , HPE 5900v and IBM DVS 5000v will need to migrate off those switches after vSphere 6.5 Update 1. So  vSphere 6.5 Update 1 is the final release that support these 3rd party switches!
  • General Support has been extended. This means that support for vSphere 6.5 will now end November 15, 2021.
  • vCenter Server Foundation will support from 3 host to 4.
  • With the vSphere 6.5 Update 1 you are prepared for the VMware Cloud on AWS (hybrid cloud) solution.
  • The vCenter Server needs to be running 6.5 U1 before upgrading your hosts to 6.5 U1.
  • The vSphere Client (HTML5) supports content library and OVF deployment operations (it’s still grayed out at the moment), as well as operations on roles and permissions, basic customization of the Guest OS, and additions to virtual machine, host, datastore, and network management.
  • A new version of vSAN 6.6.1 is added with new capabilities such as vSphere Update Manager (VUM) support. Manage vSAN software upgrades through integration with vSphere Update Manager.
  • vSAN Performance Diagnostic. This new feature is all about analyzing benchmarks and give recommendations.
  • New vSAN Licensing for ROBO and VDI. The vSAN licensing editions are expanded with an Enterprise model that allows encryption and stretched clusters.
  • Scalability improvements of vCenter Server:
    • Maximum vCenter Servers per vSphere Domain: 15 (increased from 10)
    • Maximum ESXi Hosts per vSphere Domain: 5000 (increased from 4000)
    • Maximum Powered On VMs per vSphere Domain: 50,000 (increased from 30,000)
    • Maximum Registered VMs per vSphere Domain: 70,000 (increased from 50,000)
  • vSphere 6.5 no longer supports the following processors:
    • Intel Xeon 51xx series
    • Intel Xeon 30xx series
    • Intel core 2 duo 6xxx series
    • Intel Xeon 32xx series
    • Intel core 2 quad 6xxx series
    • Intel Xeon 53xx series
    • Intel Xeon 72xx/73xx series

More information:

  • VMware ESXi 6.5 Update 1 Release Notes, link
  • VMware vCenter Server 6.5 Update 1 Release Notes, link