WilliamLam.com

VCF 9.1 - Auditing vCenter Server Connections using the Connection Utilization API

by // Leave a Comment

vCenter Server has had the ability to audit vSphere logins, whether through the API or UI, for nearly two decades using vSphere Events, which provide detailed information on who connected, when the login occurred and the client IP address associated with the session.

While looking up something in the latest vSphere 9.1 Automation REST API, I came across a new Connection Utilization API that provides visibility into all HTTP and HTTPS connections established with vCenter Server.

While most organizations deploy vCenter Server on a dedicated management network as a best practice, it does not eliminate the possibility of unexpected or unauthorized connections. Having additional visibility into those connections and the ability to audit them can help organizations quickly identify and investigate suspicious activity.

[Read more...]

Quick Tip - Deploy OVF/OVA with Basic Authentication Endpoint

by // 4 Comments

As part of rebuilding my VMware Cloud Foundation (VCF) 9.0.1 environment, a refresh of my VCF (Offline) Software Depot was needed to include the latest 9.0.1 binaries including various OVF/OVAs like Data Services Manager (DSM).

My VCF Software Depot has been configured with basic authentication, which is a requirement for the VCF Installer. This meant before I can import the DSM OVA into vCenter Server, I typically would need to download a local copy of the OVA, which got me thinking about this workflow ...

Can an OVF/OVA be deployed directly from a web server that requires basic authentication? 🤔

[Read more...]

Quick Tip - Auditing configured Per-VM EVC (Enhanced vMotion Compatibility) 

by // Leave a Comment

A request came in last week to help automate the inventory of vSphere Virtual Machines (VMs) that have been configured with the Per-VM EVC (Enhanced vMotion Compatibility) capability.


It is important to understand that if a VM is not configured with Per-VM EVC, it will automatically inherit the configured EVC-mode from the vSphere Cluster. While there are several vSphere API properties that will give you information about the EVC details for a VM, the quickest way to check whether a VM has Per-VM EVC configured is by looking at the FeatureMask property.

Here is a quick PowerCLI snippet that demonstrates the use of this vSphere API:

$vms = Get-View -ViewType VirtualMachine -Property Name, Runtime

foreach ($vm in $vms) {
    if($vm.Runtime.FeatureMask -ne $null -and $vm.name -notmatch "vCLS-") {
        Write-Host "Per-VM EVC Enabled for $(${vm}.name)"
    }
}

Here is an example output when running this script and you can adjust the output based on your needs including exporting it to CSV list/etc.