VCF 9.1.1 Lab
12 guides
expand_more
VCF 9.1.1 Lab
12 guidesVCF 9.1.1 Lab Rebuild
The starting page for the VCF 9.1.1 lab rebuild. What the guide is, how it is written, how to read it, and the list of pages as they are added.
The Hardware
Eight machines in two clusters: four identical AMD mini-workstations for the management cluster on vSAN ESA, and four different Intel machines for workloads on NFS. Fleet totals, memory per host with NVMe tiering, a table per cluster, and the five things the hardware decides before the build starts — including where the lab departs from the docs.
Kickstart: One USB Key, Eight Hosts
The ESX install for the lab. The kickstart is rendered from the host inventory, not written by hand, and a check fails the build if anyone edits it. The root password is a pointer until the moment the USB key is written. Covers writing the key, the unattended install, the kickstart line by line against the VCF host preparation requirements, and the lab-only settings for consumer AMD hardware.
Networks, Names and Addresses
The reference page for the rebuild. What the external VLAN serves and why everything above it is dynamic while the VLAN itself is not. Five VLANs for bring-up and why the management network is a VLAN and not an overlay, what the distributed gateway's external VLAN demands of the physical network, three DNS zones, sixteen component names, the two node ranges that must hold no names, and how all of it was proven before the Installer was opened.
The VCF Installer: Drive It from JSON, Check It in the Wizard
The VCF Installer for the 9.1.1 rebuild. The deployment is driven from a JSON file and the wizard is used to check it, and the build found a reason for each half of that rule. Covers the depot and binaries, the Plan choices for Full Stack VPC with Distributed Connectivity and vSAN ESA, the Installer's own JSON template, a first validation run that failed on one check and skipped fifteen, a clean second run on lab hardware, and the distributed gateway network that validation does not test.
Bring-Up: Five and a Half Hours, 320 Subtasks
The VCF 9.1.1 bring-up from Deploy to a complete instance: 2026-09-17 23:00 to 04:21, eight milestones, 320 subtasks, none failed. Why subtask counts predict nothing about duration, the connectivity error that is not a failure, how to watch progress without the browser session, what the instance could and could not do when it finished, and what the Installer left behind for the credential store.
Distributed Connectivity: What the Physical Network Owes the Instance
The part of distributed connectivity that lives on the gateway and the switch. Why this model uses no Edge cluster and no BGP, and why the distributed VXLAN model does. Six requirements taken from the documentation, each with a check that produces evidence: the VLAN and its gateway, ICMP redirects across all three sysctl scopes, the hairpin, zoning, and proving the external VLAN is trunked to the TEP uplinks without opening SSH on a host. Plus the Network span field and what selecting it does.
The VNA Cluster: Where Stateful Services Live When There Is No Edge
The distributed transit gateway is instantiated in every host's datapath, which is what lets traffic leave the host directly and also means there is nowhere for a connection table to live. So stateful services move to a VNA cluster. The dependencies, the two-node deployment at a size below the recommendation, a recommendation that reads like it asks for a new VLAN and does not, two API details, and a throwaway VPC used to measure the data path end to end.
The Second Cluster, As Built
The second cluster as it exists on 2026-09-19, every figure read from vCenter after the build: hosts, EVC, the distributed switch, VMkernel addressing, six NFS datastores with their tags and folder, and how it was built. It was built in vCenter and is not managed by SDDC Manager. The page ends with what that limits, why SDDC Manager's add-cluster validators would not run on these hosts, and the plan to rebuild it through SDDC Manager.
Attaching the Second Cluster to NSX
NSX host preparation for pgvcf1-cl02, done from the cluster's own Network Configuration page in vCenter. The five inputs, which of them differ from the dialog's defaults and why, what NSX on DVPG does, what preparation created, a second tunnel endpoint per host on an uplink with no NIC behind it, and packet loss from one host traced to a switch-port setting.
Avi Load Balancer: One Controller, NSX Cloud in VPC Mode
Avi goes in before the Supervisor, because the Supervisor's VPC wizard has no load balancer field — NSX picks Avi only if it is already registered. The values used and why, the seven steps from the Service Engine network to a VPC enabled for Avi, what to see at each one, and the result: virtual services with VIPs allocated by NSX out of the external IP block, on a distributed transit gateway with no Edge cluster.
Two Supervisors on VPC Networking
Activating a Supervisor on VPC networking with a distributed transit gateway and Avi — no Edge cluster, no Tier-0, no BGP. The values that can never be changed and are therefore decided first, storage policies whose names become StorageClass names, the seven wizard steps with what each one takes, what happens in the 25 minutes after Finish, and the second Supervisor activated from a configuration file.
VCF 9.1 Lab
4 guides
expand_more
VCF 9.1 Lab
4 guidesDeployment (Bring-Up)
Deploy the VCF Installer appliance then work through the redesigned VCF 9.1 four-stage wizard (Introduction → Plan → Prepare → Deploy): deployment path, sizing, prerequisites and FQDN pre-fill, the full Prepare config (hosts, networks, vCenter, vSAN ESA, VDS, NSX, SDDC Manager), validation, and the deployment spec JSON reference.
Post-Deployment: Identity & SSO (OIDC)
Replace the 9.0.2 direct AD/LDAP identity source with OIDC federation to authentik (auth.pgnet.io). Configure the authentik OAuth2 provider and a custom upn scope, run the VCF Operations Configure VCF SSO wizard (Generic OIDC, JIT, pre-provisioned groups), then assign the vcf-admin group to roles in vCenter, VCF Operations, and NSX.
Post-Deployment: Certificates
Configure the Microsoft CA (or OpenSSL) in Fleet Management → Certificates, review the default VMCA certificates issued during bring-up, replace them with CA-signed certificates across VCF components, and use the new 9.1 auto-renewal controls to keep them current.
Appendix: Deployment Spec (JSON)
The full VCF 9.1 deployment spec JSON for the pgnet.io lab — importable into the VCF Installer wizard. Companion to the Deployment (Bring-Up) guide.
VCF 9.0.2 Lab
15 guides
expand_more
VCF 9.0.2 Lab
15 guidesLab Environment Overview
At-a-glance reference for the entire pgnet.io lab: 3-node consolidated VCF 9.0.2 cluster on AMD Ryzen hardware, 11-VLAN network schedule, full service inventory with FQDNs and IPs, DNS/identity strategy with BIND 9 and Active Directory, and links to every detailed guide.
Architecture & Planning
Pre-deployment planning for a 3-node consolidated VCF 9.0.2 cluster. Covers hardware BOM, lab-specific workarounds (vSAN ESA Mock VIB, AMD Ryzen), VLAN schedule across 11 networks, full DNS validation table, and identity strategy using BIND 9 with AD forwarding.
Infrastructure Preparation
Physical switch config for jumbo frames and VLAN trunking, then automated ESXi bootstrapping via Kickstart — disk wipe, OS install, vmk0 networking, SSH hardening, Memory Tiering, vSAN ESA Mock VIB, and AMD Ryzen workarounds across all three hosts.
Deployment (Bring-Up)
Deploy the SDDC Manager OVA then run the VCF bring-up wizard: depot connection, deployment spec (hosts, vSAN ESA, NSX, network profiles), full JSON config reference, and troubleshooting commands for DNS, NTP, and MTU validation.
Post-Deployment: Identity & SSO
Configure the AD identity source over LDAPS, create the embedded identity broker SSO domain, map AD groups to VCF roles, and assign administrator access across vCenter, NSX Manager, and VCF Operations.
Post-Deployment: Certificates
Register the Microsoft CA in Fleet Manager, generate CSRs for SDDC Manager, vCenter, and NSX, submit to the CA, import signed certs, and run the Replace Certificates workflow to propagate trust.
Post-Deployment: Networking (BGP & NSX Edge)
Configure FRR BGP on the physical router, deploy two NSX Edge nodes via the VPC wizard, set TEP pool, configure the Tier-0 Gateway with BGP ASN 65001, and wire up dual uplinks on both pgen1 and pgen2.
Post-Deployment: Supervisor Deployment
Deploy the Supervisor cluster from vCenter using VCF Networking, configure management network, vSAN storage policy, NSX VPC settings, and validate the Supervisor API endpoint — prerequisite for all VKS workloads.
Post-Deployment: Lab Features
Lab-only extras — enable root SSH on SDDC Manager via the vcf.sddc-root Salt state, and register a secondary vSphere cluster as a lifecycle deployment target to free up VCF domain resources.
Operations
Early operations notes: alert policy configuration, suppression of expected non-redundancy warnings, and placeholder sections for ongoing alerting as the environment matures.
Logs Deployment & Use
Deploy VCF Operations for Logs from SDDC Manager, configure DNS/NTP/identity prerequisites, set up SSO, then configure log forwarding for vCenter, ESXi, NSX Manager, and SDDC Manager.
Automation
Initial VCF Automation setup: SSO via embedded Identity Broker, certificate standardisation, organisation and project config, capacity and networking quick start, and connectivity validation. Tenancy and VPC provisioning noted as ongoing.
NSX & Network Operations
NSX Day 2 ops and VCF Operations for Networks onboarding — platform and collector appliance connection, identity config, BGP peering validation, and collector health checks. Requires BGP and NSX healthy from Part 4.
VKS & Supervisor Services
Deploy the full Supervisor services stack: VCF CLI context, Local Consumption Interface, Contour ingress, CA Cluster Issuer via cert-manager, Harbor with CA-issued TLS, and Argo CD operator — with ordered CLI and vCenter steps.
Appendices
Reference appendices: FRR BGP config for the UDM router, full ESXi Kickstart script with all lab workarounds, SDDC Manager bring-up JSON, and an appliance credentials reference for all VCF component FQDNs.
Individual Guides
Salt
SaltStack integration — deploying the Salt master, configuring minions, and automating configuration management.
A Private Documentation Assistant on VCF 9.1
The whole build: from VCF 9.1 with NSX to a local AI service that reads thousands of pages of product documentation and answers with document, version and page — on one consumer GPU passed through to a VKS worker.
Windows AD Deployment
Deploying Windows Server, promoting to domain controller, and integrating Active Directory with the VCF stack.