Welcome back to vSphere 8 in the real world. Now we're going to discuss advanced host management.
So we're going to discuss host profiles. Host profiles are actually a pretty cool thing.
It allows us basically to create a file, a configuration of what our ESXi host should look
like, what you know configurations they should have, and then I can apply that configuration
to either an individual host, I can apply it to a cluster of hosts, I can apply you know to
different places. Now if I am applying a configuration or a host profile to a host,
I can obviously configure everything in that profile including IP addresses and things like
that. If I want to apply a host profile to a cluster, I can configure a lot of things. Like
I can configure for example my networking. I can say I want you know the port groups to be exactly
like this. I want my physical NICs to be attached to these port groups. I want my first you know
physical NIC applied to you know this port group and my fourth one applied to this port group and
I want this failover order and these VLAN tags, all that kind of stuff right. And storage, I want
to connect to this data store. I want to connect to you know this storage array and then mount this
data store so I can see the VMs on there. You know things that are going to be the same across
all the hosts I would configure. Things that I wouldn't want to attach to a host profile
if I'm going to attach it for example to the cluster is I don't want all my host names exactly
the same thing. I don't want them all to have the exact same IP address. I want their IP addresses
to be unique. Some things like that. So unique things that identify an individual host like
IPs and names I wouldn't want to assign to my host profile. So I can you know attach it to
the cluster and then when I attach you know say I want to apply to a VM or not to a VM sorry to a
host, I would then you know identify the unique things for that particular host like IPs and names
all right. So I can make a host profile really easy. What I'd want to do is go in there and I'd
want to configure a ESXi host to exactly the way I want it configured. I want to you know configure
my virtual networking, attach to all my data stores, any advanced settings I want to have
be across all my hosts. I go to my advanced settings and you know configure all those things.
I would do everything. Then I go to that host that I've just configured perfectly and I can right
click on it go to my host profiles and I can say I want to extract from that host a host profile.
Then it'll be my vCenter server. Then I can go to my cluster or to another cluster in my
environment and I can attach that host profile or I can attach it to a host specifically
and apply that host profile and the host in that cluster would all be configured the same. I need
to remediate and say you know is this configured correctly. It'll tell me here's all the things
that aren't right. You're missing this port group. You're missing this VM kernel configuration.
You're missing this data store. Here's the things you're missing. Here's the advanced
setting you didn't configure and I can say all right yep I see that remediate. Another remediation
will take place and I might end up having to reboot my host you know a time or two but then
it'll come up with all that. The advantage of doing that is let's say down the road I end up
wanting to make a change. I want to add just something simple. I want to add another data
store to 30 hosts. I don't have to go in and touch 30 hosts and add a data store to 30 hosts.
I can go into my host profile. I can add it to the host profile and then when I say to you know
compare and then remediate all the hosts in that cluster will get that new host profile right and
that means they'll get or not the new host profile update host profile and then they'll get
the data store right. So it allows me to you know make changes to a configuration in mass and
probably maybe even more importantly though is that it allows me to keep a consistent configuration
across the board. So if I have a for a company and they have compliance needs and part of my
compliance needs are I need to make sure that certain advanced configurations are turned off
or certain ones are on or I have certain values for certain things and I just need to ensure a
consistent configuration through my environment then when I get audited I can say okay how do
you ensure that you know these settings are applied to all your ESXi hosts. I can say I
have a host profile configured. That setting is in the host profile. I can show them the host profile.
I can show them the setting. I can show them that this profile is attached to this cluster.
All the hosts are in this cluster and I can show them that when I do a validation that they
all show up compliant right. So you can show documented what your configurations are and you
have a way of enforcing that configuration and verifying the configuration has been enforced.
So for compliance purposes that's really really important. So host profiles can solve a lot of
things. They can make your administrative tasks easier. They can help you ensure compliance. They
can help you prove compliance okay. So host profiles new installations of you know of similar
hosts again this is important like you may have for example a bunch of hosts that are let's say
they're a bunch of Dell servers and they're the exact same Dell server. You have another cluster
and the other cluster is a bunch of HP servers and the Dell servers have six network adapters and
you know four of them are 10 gig and two of them are one gig. But your HP servers actually have
eight NICs and there's four one gigs and there's four 10 gigs in there. So you'd have a different
configuration for your network adapters to your virtual switches for your HP services because of
the number of NICs they have versus your Dell servers. There may be other things about those
HP servers that are different than your Dell servers and so you would need a different host
profile because the configurations are different. So I can create one configuration or one you know
host profile for that group of Dell servers and I can create another one for my HP servers.
Now it doesn't have to be based upon HP and Dell. I could have just one model of Dell with a
certain network card configuration and I have a different set of Dells again but with that
you know with a network configuration that's different than the older generation for example
maybe. Maybe the older ones are a bunch of one gig NICs and my newer ones have fewer NICs but
there's a bunch of 10 gigs. Something like that maybe right. So you can based upon things like that
you might have a different host profile based upon the configuration of the hardware. Things
like that can be can be the case. So this will allow you to create different profiles for different
sets of hosts with different configurations and allows you to again ensure consistent
configurations across the board for all the hosts in that cluster okay or you know individual hosts
too. It can't be done on individual hosts. All right it allows you to again maintain compliance and
making control of your environment. So a recommended procedures is track the host configurations
and the profile value. So you're going to keep track of what's in there obviously. You might
have you know permission set so that only a couple of different admins are allowed to even look and
make changes to those profiles. Maybe you have six admins that can look at them and help you
ensure nothing's changed or check the values but only two can make changes or something like that
okay. Make incremental changes to your host profiles. So as small things come along oh we
need to add a data store. I can make a small change and add that. Even if you have a reason
to make a bunch of changes at once like oh this big infrastructure change has just happened
and now we've got several data stores and we need some more port groups and we need and we need
right. I wouldn't recommend going in and making all those changes the host profile in one big swoop
and pushing them out to all your hosts. I would suggest making one of the changes first. Maybe you
update your networking first and then you push that out and you test it and yep everything's
good. Everything still works. We have a good functionality. Then you add the data stores
and then you push that out and okay yep everyone sees the data stores. The network's still working.
We tested that already and now we see the data stores in all the hosts. Everything's good there
and then your next change and the reason why I don't recommend doing one big push doing small
incremental changes along the way maybe like one day and a few days later doing the next one kind
of thing is what if you make changes to your networking and data stores and something else
and then you push it out and the network is not working or I'm sorry the storage isn't working.
You can't see your storage or you lost the data store along the way. Did your storage
configuration changes cause that problem? Did the networking changes cause that problem? Was there
something else in your configuration that caused that problem? So make small incremental changes.
That's normally how it's going to happen anyway. Most of the time you make a small change
somewhere and you need to make that change on your host but if there is a reason to have a
larger number of changes still push them out incrementally to give you the ability to more
easily troubleshoot what the problem is. If you make five changes at once and then things break
what's one of those five changes cost your problem right incremental changes. Stem size your
environment make you know make a host profile and make sure all your hosts configure the same.
If you have you know four hosts and four of them are working you know three more working great
one's not and you can figure them all manually. Did you type something in wrong? Is there a hardware
failure? What's causing that problem? If you're using host profiles then most likely the configurations
are all identical so we can maybe now look at is there a hardware failure or something like that in
the environment right. Group hosts into a single profile based on similar hardware. So like I
mentioned earlier if we have you know one generation of DELs that have a certain network
configuration and certain memory configurations and things like that put that into one group and
then another group would be for you know a new batch of DELs. These new batch of DELs have
you know 10 gig NICs or 25 gig NICs and it has fewer adapters but there's faster faster ones
you know any kind of change that would be unique in that host profile that would be into a
different group and your groupings would be clusters there right. So and then ensure your
ESX host capacity is sufficient so they can handle whatever kind of maintenance you're putting in
there. What that means is when I'm applying host profiles the hosts might need to reboot. We're not
going to apply it to 30 hosts all at the same time and have all 30 reboot. I'm going to say apply
to these 30 hosts and it's going to go through and apply it to one or two or three at a time
and reboot them. So I need to be able to evacuate the VMs off of at least one of my hosts to apply
that profile if a reboot's necessary. Then you know the next the next if I can do two or three
at a time I can afford to evacuate two or three at a time the other 27 of my 30 can handle that
great. If all your hosts are completely maxed out and I can't move VMs off of any of my hosts
I might not be able to efficiently apply my host profiles and obviously right.
So here we're seeing an overview so I create a host profile I went to I create you know my
my golden host I did my configuration I extracted my host profile and I'm going to attach that host
profile either to the cluster which would then make it apply to all the hosts in the cluster
or I can attach it to an individual host okay. In order to create the profile I'm just going to
choose my host that I've configured that's perfect I'm going to right click on it I'm going to go to
host profiles I'm going to say I want if I'm going to create what I want to extract the host profile
from that golden image I can also import a host profile meaning I've already done the extraction
from somewhere else and now I'm going to go to a different vCenter maybe for example and I'm going
to import that image into it. So these I have a vCenter that is my prod and I have a separate
vCenter for my my test dev and the hardware is the same in both which is ideal for you know
a test of environment to have the same environment as your production is. I can create my my golden
image in my test dev and I can create those profile I can do all my testing on there yep
storage works networking works VMs are functioning properly communication on the network is good
all these things are good then I can extract it out of that particular vCenter import it into the
other vCenter that's my production with this tested host profile and just deploy it out to
those hosts in production right. I might want to deploy it out to one or two to start with and just
do another test in production and then say okay yep I'm going to deploy it everywhere
right so import it in or extract it out some of how you're doing that select the reference host
that you want to extract if you're doing an extraction and then give your profile a name
just give it a few minutes it'll extract it out and then you'll find it in vCenter.
So then once we create it we can go in and we can say we want to attach a host profile so for that
we would go for example to our cluster we'd go to configuration we go to host profiles and then we
could say we want to attach a host profile to this cluster and then we have the option of doing
things like want to verify if it's compliant it will host a compliant find out what's not compliant
and then do we want to remediate that we want to apply the host profile to those hosts in that
cluster okay. So editing the settings if you want to edit the settings of a host profile
we're going to go to our little our little you know Big Mac icon in the corner and then we have
policies and profiles click on that then you'll go down to host profiles and you'll see all the
host profiles you have created in there maybe we have host profiles already created that we've but
we want to make some tweaks or some changes to that we can actually just copy them from right
there too and then go to that copy and make whatever changes that will be applicable to where
we want to apply it to maybe you know we have these two to the host they're basically identical
they're you know this cluster a and cluster b have almost the exact same hardware the difference is
the network cards in a cluster b are slightly different but I configured a exactly how I want a
I export it I can make a copy for that maybe I change the name for you know the cluster b or
something and then I make the changes to the networking and then I can attach it to cluster b
and cluster b have a different host probably profile than a but I use a as the the template
to get started with because again they're almost identical right so that's some of the things we
can do there too so um so an example we can go in there to that host profile like I said after
you've gone to our big mac and gone to our policies and settings gone to those profiles
and we can just choose the host profiles that we want to edit it right we can just even just look
at the settings that are in there then and say okay yeah the networking is what I want
my vm network is the way I want and my custom port groups for my vm kernels these are what I want
these are the network cards attached to them that's what I'm looking for you know my advanced
configurations that's what I'm looking for we verified it's all good and we can make changes
as we need to along the way too right and then we can apply save and apply those changes if I
made any that I like them okay so then we're going to go through and check compliance right
um we can say all right I've attached this host profile to a cluster I want to check compliance
and if it says no verification possible uh does it mean that things aren't consistent it means
it couldn't check for some reason there's something about it that's not that's not right
that whatever didn't check um so non-compliant means that there's inconsistencies right and you
can ask for what are the inconsistencies and then we can say oh yeah okay I see that and maybe
maybe when you brought that profile over from your test dev environment you put it in production
and you want to go check for compliance and you see what the compliance like oh I forgot about
that change I forgot that thing that's different in production versus my test dev that should be
different let me go ahead and let me um change this host profile to fix that problem so it
doesn't make that change in my production environment or it makes a different change
in my production environment and then let me apply it right so you do have a way of verifying
what the settings are without pushing the settings and potentially breaking something
you can you can check it first you can schedule compliance checks right so you can say every so
often maybe once a week or something you want to go through and do a compliance check um and if
things are out of compliance you can you know see it in your alert so you can go in there and check
and see what happened why why is this host no longer in compliance if someone make a manual
change to the host that took it out of compliance and you can see what that change is and say oh
yeah we need to keep that change I need to change my host profile to match that change the person
made on that host or nope that shouldn't be that is not our company standards our company policy
that's out of compliance that brings us out of compliance with our you know crediting body or
whatever the case may be we're going to go in and change that all right so you can schedule to
happen every so often you can see the result the results of that and you know make sure that you're
you stay in compliance your host profiles are still set up correctly for you to
and the host remediation a non-compliance uh we've built in a compliance check on the host so
you can make sure the hosts are set up correctly um if you want to bring the host in line you can
you can do that you can say you want to remediate right then it resets the host parameters to match
that profile and again sometimes a reboot is going to be necessary required a part of that process
so here's the process goes you know uh select the host right click uh and you can say to you want to
remediate right the host may reboot it's going to check the compliances you know that comes back up
again and if it needs to reboot again it might be rebooting more than once as it goes through that
part of that process um that's not super common unless it's like just like a lot of changes are
auto-deploy also uses host profile so auto-deploy is a way that um you can do one of two things you
can tell it that you want it to always auto-deploy meaning when the host comes up uh it pixie boots
every single time and it connects to an auto-deploy so you know dhcp gives it this information it can
find the auto-deploy server auto-deploy server um is going to tell it to connect to this tv
tftp server and bring over the image it's going to boot up that from this auto-deploy server now
if you're you know automatically kind of dynamically booting up every single time
how are you going to you know have a configured host it's going to use a host profile on your
auto-deploy host to get them up and going every single time you can also use auto-deploy
to actually install to a disk as well um and then your host profile can just configure that
host it comes up installs it to disk host profile applies and now we've got a nice consistent
configuration on all my hosts every time okay so uh duplications um so you can uh you can use your
host profiles to create machines that are exactly the same you can copy your host profiles between
v centers you can copy them and make changes so even the same v center clusters are very very
similarly configured but you can account for uniquenesses and hardware configurations and
things like that right but it allows you to ensure that a baseline to set for like your
more advanced security settings and things like that so that's a little bit more about
that a baseline to set for like your more advanced security settings and things like that
so why would you want to import a host profile because you spent a lot of effort creating that
host profile and another environment to get it exactly right maybe it took you a lot of time to
configure that and you can save that time over on a different v center server by importing that
you can also not only save time you can ensure consistency so i configured the host profile
over here and when i got it exactly the way i want it i export it import it into another v center
server and now i can ensure consistent configurations between the two or between the three or
how many times i import it in so it allows me to save time and allows me to ensure consistency
across my environment um so again to import or export we're going to select the host that we
want to import the profile to or we want to export it from if we're going to do an export
select the appropriate file for doing the import select the host profile
we can name the new profile because we're importing it and we can call it something
different if we wanted to and then we can say okay and that'd be importing in that new host profile
to export the host profile so why would you want to export a host profile
because you want to import it someplace else you could do as a backup you could do as a backup to
get it offline um just to make sure that that host profile is protected and consistent so if
something happens down the road and you're like the host profile stumbles to be that way you can
import it in a new one but most of the time you're exporting it because you want to import it someplace
else so that just makes sense right it makes sense that before you can import a host profile
someplace else you have to have exported it first so it allows you to keep a consistent configuration
across your environment okay and you can reapply those profiles as needed
so configuring an hba to boot so if we're going to um if we're going to do a boot from sam then
we'll need to configure our hba as a boot device and then we can apply the host profile to you know
configure that so um cisco ucs does something very similar very very much like this i am able to
replace a blade for example in a cisco ucs system and i can then in the cisco ucs software apply a
cisco ucs profile to the hardware which is going to configure the hardware for that blade to kind
of match what i'm replacing and then it can do a boot from sam it's going to get that new
configuration or that new operating system and then the host profile from the old blade can be
applied to the new blade and now that blade is exactly the same in this scenario i would apply
the same ip address the same host name the same everything on that blade so now when this blade
fails and i replace it with a new one i have the exact configuration right in order to do that if
i'm doing a boot from sam i have to configure the hba for this for this server to do a boot from
sam so all you do is go into the bios of the hba and you're going to give it the um the the sans
you know information and one information and point to the right one where the uh that's going to be
booting from and of course you can figure the one or the you know the sans so that one is
accessible if you have any kind of zoning configured or something like that so it's accessible um by
that particular hba so integrations uh host may need to reboot right during these remediations
so when you do this remediation or this integration uh host is going to go in the maintenance mode
which is going to you know take all the hosts out of it then it's going to be remediated and then
it you know it may come back up again so you might use like drs to help uh get all the vms off of it
so you can put it in the maintenance middle so you can remediate so parallel remediation means i
actually in that scenario where i had these 30 hosts i'm going to remediate all 30 of them
it actually doesn't do all 30 at once it might do two or three depending upon your your cluster
availability at once v sphere seven wasn't able to do parallel remediations that was removed at
these for seven um probably some kind of you know issue with the stability of it they fixed that and
we can again do uh parallel remediations with v sphere eight so eight we can do multiple host
remediations at once again not an entire cluster but multiple members of a cluster and again that
will be based upon the availability of resources for the vms that i'm trying to um to remediate on
okay so auditing has improved quite a bit also with this so host profiles it used to be kind of
more generic um and we didn't have a lot of you know visibility into what kind of changes were
made but it has been enhanced it's been enhanced for a few versions now so now we can see on host
profiles um who did what you know what did they change when did they change it where were they
you know changing it on and uh how did they access and do this right so basically most importantly is
who made the change and what did they change and when did they change it those are really
important things there right and uh the more advanced logging options now allow us to do that
and here's an example this kind of shows you that you know somebody went in and you go into the audit
log you can see that uh a um host profile has changed and you know a certain device a certain
nick was changed from this configuration to that configuration it was set to auto detect you know
the speed and now it's set to you know uh full you know duplex one gig but it's static set there it
can't do 100 meg or something like that so we discussed with host profiles we discussed you
know duplications of them importing and exporting them hbas and integration let's go ahead and jump
over into our lab environment and do a quick demo of host profiles so over here in our demo
environment i have my host if i go over to configuration and under system i have host profiles
if i go to attach i have no host profiles here none at all so what i need to do is i need to
either import or create a host profile so let's create a host profile now let's assume in this
scenario this host is my golden image this is exactly how i want all my other hosts configured
with the exception of things like i don't want to use the same host name i don't want it to
use the same ip addresses on the vm kernel ports or i don't want it to
have the same mac address or things like that but all the things that i do want to be standardized
across all my hosts this guy already has configured so i want to do i want to export
this from this host my host profile so now right click on this guy go down to host profiles
and extract those profile now let's assume for a moment that this is the cluster that has my
dell r610s in my production cluster
so this is my production profile for my dell r610s and let's say okay
this is going to come up it's going to take a moment usually takes about a minute or so it could
take longer to be quicker depending on how quick your systems are and how big that you know the
configurations are going to look
all right so i completed pretty quick and if i want to look at that host profile before i try
attaching it to anything i go to my big mac over here i go to policies and profiles
host profiles and here is my my dell r610 production profile now let's say that this
profile is basically exactly what i want but i need to customize another version of this
for my my dell you know r810s what i can do is i can choose this profile
and i can say i want to duplicate the host profile but this one i'm going to say is for my dell
r810s but again my production profile i'll say okay to that
and this will take you know 30 or so seconds 40 seconds usually to copy
all right so that's done and then what i can do from here is i could go into
this profile and i could say i want to edit this guy
and anything i need to make changes to i can make changes from here
now maybe i don't want the networking to be applied at all the networking is you know i don't
want to be duplicated here i guess uncheck that and nothing network configuration related
is going to be duplicated or maybe their storage is very different so i can uncheck storage
i can also go in for example to networking and i could make changes here so
here i have my host port groups these are the ones that i created on this host i have my
i-steady port group and here's my ip address information so what do i want to do to make
sure my ip address are your unique i could say i want a user must explicitly choose
what to do with it prompt the user for an address if no defaults available
use dhcp maybe i'm just gonna go say you know what i don't want to go make a bunch of changes
maybe i'm just gonna go say you know what i don't want to go make a bunch of changes to all these
in reality probably wouldn't use dhcp on your iscsi adapter you know for your storage but
maybe i want to do that for my vmotion network i'm gonna go into my ip address changes right
and i can say on this guy use dhcp or i can say user specified right on there and dhcp will be
fine for all of them and then i could go in there and customize that uh if i needed to now i wouldn't
want to customize it and have this set like you know something different because then it'd be out
of compliance when i did my compliance check right let's see for iscsi here i can say if i want to
always create this object i created production product family matches so if they were from the
same uh like vendor and so forth i can you know match things like that i can also go in and you
know do things like if i want to change the vlan id maybe for this iscsi in this environment it
actually uses vlan 10 and for the vmotion network i know in this environment it's vlan 20 right so
there could be things that would be different in the environment most of the things are the same i
do want an iscsi host group right i do want a vmotion host group i want management okay uh
different things like that my network policies do i want to allow promiscuous mode or not that can
be the same can be different based on what i'm looking at right uh the nix that i'm you know
gonna have is active on there so once i've gone and made all those customizations now this is
going to be set for my uh my dell r 810 environment right so my 610 one was good to go i copied it i
made some changes to it for you know now it matches my 810 environment so now what i can do is go back
to my inventory and go to this projection where my 610s are
configuration host profiles and now if i go to attach i have those host profiles and i know this
is the one that's for that cluster i'm going to attach it it's going to show me the profile i
selected it's going to show me the hosts that i want to compare it to and now because i don't
have all different customizations you know set up on there i don't have um you know i haven't told
this guy what ip i wanted to use and things like that when i go to check the compliance on this
it's going to be a little bit out of out of compliance so i'm going to say i want to check
compliance let that run that usually will take about a minute or so it could take a little longer
depending on your environment and now i see that one host is out of compliance and obviously the
one that's not in compliance is the one that the profile did not come from the one that is in
compliance is the one that the profile came from because it's exactly the way that host is
configured so we're compliant there if i were to go into this host and make you know some changes
to that port group i would have renamed one of the port groups or something like that it would
then be out of compliance as well right what i could would normally maybe would do next if i
could take the time to go through and change this host profile so it's not perfect for this guy but
make it so it's a little more generic so it can match both of them i could then say okay now that
i've done all this let's remediate let's remediate and push out all that so that this one gets all
those changes that need it has all the right port groups all the right customization for my advanced
settings and all that are there i could push up that remediation once i put now of course when i
go to push up the remediation it's going to want to let me know that you know rebooting the host
might be necessary and things like that i could agree to that if drs is configured drs could
evacuate the host put it in maintenance mode for me all that kind of stuff remediate it then you
know bring it back out again so that's how you would configure host profile we can you know
extract one we can copy them we can attach them to clusters and then we could check for compliance
on them and then if you know if needed which most of the time it will be when you first
deploy these new you can do some remediation for me