WilliamLam.com

Improved Workaround for NSX Edge Deployment & Upgrade to VCF 9.0.2 running AMD Ryzen CPUs

by // Leave a Comment

If you are using an AMD Ryzen (Consumer) CPU for your VMware Cloud Foundation (VCF) lab environment, you have most likely have applied one of the required workarounds for either installing an NSX Edge (HERE) or upgrading an NSX Edge (HERE).

For those planning to install or upgrade to the latest VCF 9.0.2 patch release, which was just released today, you may come across this issue as shown in the screenshot below when attempting an NSX Edge upgrade.


While I have yet to run through the VCF 9.0.2 upgrade myself, a similar configuration file tweak from within the NSX Edge VM will be required. A colleague recently shared a more optimal trick for bypassing the non-supported AMD processor check, which would be simpler to implement for lab environments.

Disclaimer: This is not officially supported by Broadcom, please use at your own risk.

[Read more...]

Quick Tip - Correlating VCF Component to Bundle ID/Name

by // Leave a Comment

A VMware Cloud Foundation (VCF) release consists of a collection of VCF components that is categorized as either an installation or patch/upgrade file. In VCF 4.x/5.x, a VCF component would contain two different identifiers, a UUID as well as something called a Bundle ID (e.g. bundle-XXX where XXX is some numeric number). In VCF 9.x, the old Bundle ID format is no longer used and simply converges with using the UUID, uniquely identifying a given VCF component.

When a customer downloads a VCF release, they only need to deal with the VCF release version (e.g. 5.2.1.0 or 9.0.1.0) and not the individual bundle IDs. With that said, if you need to download a specific VCF component, especially when using the VCF Download Tool (VCFDT), then it would helpful to understand the specific VCF component ID whether this is for VCF 4.x/5.x or VCF 9.x

[Read more...]

TLS Chain of Trust when using SSL Inspection with VCF Download Tool (VCFDT)

by // Leave a Comment

SSL traffic inspection is commonly deployed by Enterprises to ensure that they have visibility into encrypted connections, enabling their organization to reduce security risks and enforce acceptable use policies.

When using the VCF Download Tool (VCFDT), the connection must first terminate at your SSL inspection system and you may come across the following error: Unable to connect to the Depot Server


Taking a closer look at the VCFDT log file, we can quickly identify the problem which is due to validating the certificate chain from the SSL inspection system as you can see from this snippet:

Error checking certificate chain CN=depot.vcf.lab, OU=R&D, O=WilliamLam, L=Palo Alto, ST=CA, C=US, SerialNumber=91513477326140466830150858710326987151105506009,CN=WilliamLam-RootCA, OU=R&D, O=WilliamLam, L=Palo Alto, ST=CA, C=US, SerialNumber=659677038159141611554120742063414354480349425756 for validity.
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

To resolve this problem, we need to add the Root CA signing certificate into Java keystore that VCFDT can use to establish the chain of trust.

[Read more...]