WilliamLam.com

Bypassing Minimum Storage Pre-Check for vDefend Security Services Platform (SSP) 5.2 Lab Deployments

by // Leave a Comment

After successfully deploying the vDefend Security Services Platform (SSP) 5.2 Installer, which I recently built some automation for, the next step is to deploy an SSP Instance. I was surprised to see there was a fairly hefty minimum storage pre-check of a little over 3.5TB, something I certainly hope my lab never gets close to consuming! Since thin provisioning is already used by default, ideally the minimum storage requirement should simply reflect what is needed for the selected form factor.


😅Fortunately, there is a workaround to skip the minimum storage pre-check and allow us to proceed with the SSP Instance deployment.

Disclaimer: This is not officially supported by Broadcom, please use only in a non-production environment for lab and learning purposes.

[Read more...]

Quick Tip - Improved NVMe Tiering Device Health Monitoring in VCF 9.1

by // Leave a Comment

Unfortunately, one of my consumer-grade NVMe SSD devices that I had configured for NVMe Tiering (Memory Tiering) in my VMware Cloud Foundation (VCF) 9.1.1 environment had recently degraded. While vCenter Server had raised an alarm stating “NVMe Memory Tiering device is not healthy.”, I had dismissed it since the alarm did not provide any additional details about the underlying issue.

In VCF 9.1, NVMe Tiering usage can be conveniently viewed inn the vSphere UI under the Memory tile for either a selected ESX host or vSphere Cluster, which summarizes both Tier 0 (DRAM) and Tier 1 (NVMe Tiering) usage.


When it comes to understanding the actual health of an NVMe device used for NVMe Tiering, I was not sure whether looking at the SMART data was still the recommended approach or if there was a better way?

[Read more...]

Using VCF Download Tool (VCFDT) with a Kerberos-Authenticated HTTPS Proxy

by // Leave a Comment

While modern authentication protocols like OAuth 2.0 and mTLS are the de-facto standard these days, Kerberos-based (GSS-API/SPNEGO) authentication is still commonly used within many enterprise organizations. The challenge is that many modern applications and development frameworks do not natively support Kerberos authentication or provide libraries that make integration straightforward, which can make supporting these environments difficult.

The VCF Download Tool (VCFDT) is one such example. While it supports connecting to an HTTPS proxy with basic authentication, it does not natively support Kerberos authentication. This is where Px can help by acting as an intermediary running locally on the same system as VCFDT, enabling it to connect through a Kerberos-authenticated HTTPS proxy.

Here is a quick visual (thanks to ChatGPT) that demonstrates the connection flow from the client system (client.vcf.lab) running VCFDT, which uses an authenticated keytab from the Kerberos server (kdc.vcf.lab) to authenticate with the proxy server (proxy.vcf.lab). Once authenticated, VCFDT can connect to broadcom.com through the proxy to download the required software binaries and metadata.

[Read more...]