Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

PSC 6.7 HA configuration for Management vCenter Server (Green Field deployment) with NSX-T Load Balancer (56584)

Last Updated: 7/7/2018Categories: InformationalTotal Views: 3807Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Purpose

This Document is created based on the below vSphere and NSX-T product versions.

vSphere: 6.7

NSX-T: NSX-T for Data Center 2.2

Resolution

Following are the steps that we need to perform to configure the Platform Service Controller High Availability for Management vCenter Server with NSX-T 2.2 Load Balancer.

Deploy PSC01 and connect to MGMT VLAN port.

Deploy PSC02 & connect to MGMT VLAN port and join into existing domain by pointing to PSC01 (same site and domain)

Deploy vCenter Server by pointing to PSC01 and then configure Cluster, vSAN and DVS networking. Migrate the VM Network from vSS to vDS.

Deploy and configure NSX-T Manager, Controllers, Edges (two) and other logical components.

Deploy and configure the Load Balancer for PSC’s with NSX-T bridge topology.

Prerequisites

Set the MTU to 1600 for the vDS where the PSC & vCenter VMs are connected (MGMT VLAN port on DVS).

NSX-T Manager is up and running.

NSX-T Controllers are installed and configured.

NSX Edges are installed and configured (two nodes)

ESXi host (separate host) is installed and configured for Bridge cluster. (PSC & vCenter VMs should not run on this host)

Configured Transport zones (overlay and vlan backed), uplink profile and transport nodes (Edge’s and ESXi host).

Configure Edge cluster with two Edge Nodes.

Bridge Topology:

Background story to choose Bridge Topology for LB configuration: The objective is to deploy PSC’s, vCenter and LB VIP on the same VLAN backed network and then configure the HA for both PSC’s by using NSX-T load balancer. But the NSX-T 2.2 does not support LB configuration when the Server (PSC’s), Client (vCenter) and LB VIP running on the same VLAN backed network because the LB is running on Tier-1 router and Tier-1 cannot be connected to a VLAN backed network.
To achieve this limitation, use the below Bridge topology and configure the L2-Bridge between Overlay Logical switch and VLAN backed network.

Configure Bridge with NSX-T

In the NSX Manager UI, navigate to Fabric > Configuration > Bridges.

Give the bridge cluster a name.

Select a transport zone for the bridge cluster. The transport zone must be of type overlay, not VLAN.

From the Available column, select transport nodes and click the right arrow to move them to the Selected column.

Create and configure Logical Switch (overlay)

Navigate to Switching and click on “+ADD”

From “Add new Logical switch” wizard, provide the Logical switch name and select the “Overlay” transport zone & keep the default values and then click on “ADD”

On the switch configuration page, select Related > Bridge Clusters.

Click ATTACH, select a bridge cluster, and enter a VLAN ID.

Create and configure Tier-1 Router

In the NSX Manager UI, Select Routing from the navigation panel.

Click Add and select Tier-1 Router.

Assign a name for the logical router.

(Optional) Select a tier-0 logical router to connect to this tier-1 logical router. If you do not yet have any tier-0 logical routers configured, you can leave this field blank for now and edit the router configuration later.

Select an edge cluster to connect to this tier-1 logical router.

Click Save.

Add Downlink Ports for the Tier-1 Logical Router

Click the tier-1 logical router link to create ports.

Click the Configuration tab.

Click Add under the Logical Router Ports section.

Assign a name for the logical router port.

Select Type as “Downlink”

Select the Logical switch from drop down which is created in previous steps

Enter the router port IP address in CIDR notation. (Since the logical switch is configured with bridge, Assign IP from the MGMT VLAN IP range)

For example, the IP address can be 172.16.10.1/24.

Keep the remaining default settings.

Click Save

Create and configure Tier-0 Router:

Select Routing from the navigation panel.

Click Add to create a tier-0 logical router.

Select Tier-0 Router from the drop-down menu.

Assign a name for the tier-0 logical router.

Select an existing edge cluster from the drop-down menu to back this tier-0 logical router.

Optional) Select a high-availability mode.

Click Save.

Attach Tier-0 and Tier-1

Select Routing from the navigation panel.

Select the tier-1 logical router.

From the Actions -> click on “Connect to Tier-0 Router”.

Select the tier-0 logical router from the drop-down menu and click on “Connect”.

Configure an Uplink interface / port to Tier-0 Router

Create a VLAN backed logical switch.

Navigate to Switching and click on “+ADD”

From “Add new Logical switch” wizard, provide the Logical switch name and select the “VLAN backed” transport zone & assign VLAN ID as “0” and then click on “ADD”

Connect a Tier-0 Logical Router to a VLAN Logical Switch

Select Routing from the navigation panel.

Select the tier-0 logical router.

From the Configuration tab, add a new logical router port.

Type a name for the port, such as uplink.

Select the Uplink type.

Select an edge transport node.

Select a VLAN logical switch.

Type an IP address in CIDR. (Assign any dummy IP here eg 172.168.16.1/24)

Create and Configure Load Balancer

From your browser, log in to an NSX Manager.

Select Load Balancer > Add.

Enter a name and a description for the load balancer.

Select the load balancer virtual server size and click “OK”

Attach the newly created load balancer to a Tier-1 logical router

Select the load balancer and click Actions > Attach to a Logical Router.

Select an existing Tier-1 logical router from the drop-down menu. The Tier-1router must be in the Active-Standby mode.

Click OK.

Create a Health Monitor

Navigate to Load Balancing -> Server Pools -> Active Health Monitors.

Click “+ADD” to create a health monitor.

Monitor Properties:
Provide Name: “TCP”, select “LbTcpMonitor”
Health check protocol: “LbTcpMonitor”
Monitor Port: 443

Click next and then finish.

Add a Server Pool for Load Balancing

Navigate to Load Balancing > Server Pools > Server Pools -> Click on “ADD”

General Properties -> Provide the Pool Name and select ROUND_ROBIN for Load Balancing Algorithm and click Next.

SNAT Translation -> Translation Mode as “Auto Map” and click Next

Pool Members:

Select the Static option in the Membership Type.

Under Static Membership, click ADD to add the pool members (PSC’s)

Enter the Member name and the IP of PSC1. Ensure that the state is set to Enabled.

Click ADD again to add the second member.

Enter the Member name and the IP of PSC2. Ensure that the state is set to Enabled.

Click Next and select TCP for Active Health Monitor.

Click Finish.

Configure Virtual Server

From your browser, log in to an NSX Manager at https://nsx-manager-ip-address.

Navigate to Load Balancing > Virtual Servers > Virtual Servers and click ADD.

General Properties:

Provide Name for Virtual server

Application Type: Select Layer 4 and then select “TCP” from drop down.

Application Profile: select “nsx-default-lb-fast-tcp-profile”

Click Next

Virtual Server Identifiers:

IP Address: provide the IP address for Virtual server.

Port: 443, 389, 636, 2012, 2014, 2020

Click Next.

Server Pool: Select the Server Pool which is created in previous step.

Load Balancing Profiles: select “nsx-default-source-ip-persistence-profile” for Source IP.

Configure Route Advertisement on a Tier-1 Logical Router

From your browser, log in to an NSX Manager

Select Routing and Click a tier-1 logical router.

Select Route Advertisement from the Routing drop-down menu.

Enable route advertisement by clicking Edit and making sure the Status button is Enabled

Change to “Yes” for all the routes

Click on “Save”

Configure Static route on PSC VMs

NSX-T Load balancer will use 100.64.x.x to perform the health check for Server Pool members(PSC’s). But there is no route for 100.64.x.x network on Server Pool members(PSC’s), So the LB will not be able to reach servers and it fail to perform the health check.

Please use the below command to add the static route on both the PSC’s.

SSH to both the PSC’s and execute the below commands on both the PSC’s.

# ip route add 192.168.201.22 via 192.168.201.32 dev eth0 Replace 192.168.201.22 with Virtual Server IP. Replace 192.168.201.32 with Tier-1 Down link Port IP. # ip route add 100.64.240.1 via 192.168.201.32 dev eth0 Replace 100.64.240.1 with Tier-1 “LinkedPort_Tier-0” port IP. Replace 192.168.201.32 with Tier-1 Down link Port IP.

But the above configuration is not persistent when the PSC got rebooted. Please use the below procedure to make persistent routes on both the PSC’s.

SSH to both the PSC’s and change the directory.

# cd /etc/systemd/network/

Add below highlighted new sections at the bottom of the file using vi editor:

# vi 10-eth0.network
[Match]
Name=eth0
[Network]
Gateway=192.168.201.253
Address=192.168.201.26/24
DHCP=no
[DHCP]
UseDNS=false
[Route]
Gateway=192.168.201.32
Destination=192.168.201.22
[Route]
Gateway=192.168.201.32
Destination=100.64.240.1

# systemctl restart systemd-networkd
# route -n

Restart the service.

After Configuring the Load Balancer by using NSX -T, please perform the below tasks to confirm that the LB is accessible from PSC’s and LB IP/FQDN is re directing to PSC home page when accessing from browser.

SSH to both PSC’s (PSC01 and PSC02) and execute the below openssl command with Load Balancer IP / FQDN.

openssl s_client -connect test-psclb.nfvra1.com:443

You see output similar to:

root@test-psc-1 [ ~ ]# openssl s_client -connect test-psclb.nfvra1.com:443
CONNECTED(00000003)
depth=1 CN = CA, DC = vsphere, DC = local, C = US, ST = California, O = test-psc-1.nfvra1.com, OU = VMware Engineering
verify return:1
depth=0 CN = test-psc-1.nfvra1.com, C = US
verify return:1
---
Certificate chain
0 s:/CN=test-psc-1.nfvra1.com/C=US
i:/CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=test-psc-1.nfvra1.com/OU=VMware Engineering
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIEBzCCAu+gAwIBAgIJAMTWjWk4cfe0MA0GCSqGSIb3DQEBCwUAMIGcMQswCQYD
VQQDDAJDQTEXMBUGCgmSJomT8ixkARkWB3ZzcGhlcmUxFTATBgoJkiaJk/IsZAEZ
FgVsb2NhbDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExHjAcBgNV
BAoMFXRlc3QtcHNjLTEubmZ2cmExLmNvbTEbMBkGA1UECwwSVk13YXJlIEVuZ2lu
ZWVyaW5nMB4XDTE4MDUxMTA3MzAxNloXDTI4MDUwNTA3MzAxNVowLTEeMBwGA1UE
AwwVdGVzdC1wc2MtMS5uZnZyYTEuY29tMQswCQYDVQQGEwJVUzCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBALD6eRYkJC44+x5oGu/3N2DTgmxYqXLx3Ig8
lL8NfIrrnoHIe3i+gsTJvOwOkNCwlS3L2d4vPXKo2RJLh5dLD/k8k2O1vUrfqlMp
jBGahXW/6d/mCqDZMRQL7MjX+WJMbT3s/FoSkpwnmAfxNI7NiadqNHamUQlbx+H5
tgPOrN88FAYp1pJdIwGZ6UBLQSidfzgCN108NdDDQs19bmXMzXWIUPEVGskLmjhX
wxB/47OQI0JBAe5hRblfE1pw4SLjAGkN7aaaz75f+j/eFjBTGlzh/iNO1aoG6+YP
inNRFNI+ww1maTQrT0/uQgFsSmaS/vjLl7qVRR6QlA6w6c9DWrUCAwEAAaOBuTCB
tjALBgNVHQ8EBAMCA6gwIAYDVR0RBBkwF4IVdGVzdC1wc2MtMS5uZnZyYTEuY29t
MB0GA1UdDgQWBBTkk3yLmNA/U3xT2/0vAgsdzUGDVzAfBgNVHSMEGDAWgBRrm4/K
AkDBZgbKyo206Dj99ouHFDBFBggrBgEFBQcBAQQ5MDcwNQYIKwYBBQUHMAKGKWh0
dHBzOi8vdGVzdC1wc2MtMS5uZnZyYTEuY29tL2FmZC92ZWNzL2NhMA0GCSqGSIb3
DQEBCwUAA4IBAQBK60zx3eScmJUE6mrgiDz4TQGkZn1Vtkc6f5UXSBTszCdoI6CR
eD7dS6fUtiKOXUBSGlql0ayF08sZjfk9gbD4gOLqBKLOiZSv+jWunOaKhAAFArhI
xthP1fCZG52Q6FwjlkchkkLZvdgkHsDSiBVgE7qjFiqvKMmSW3lD8KVqy5sWdHgD
FmxgdRgVc8hUpBVCPpdFCgQsVLRVioGUjlLrpIYkfIISeDrT/3eovGvLw8nquWKZ
BVg3UDeWJyxaitsWnLIuSHuiXvfP9chGNFEamp1e+hK6/TCLuir2uwVEYN8RTxZu
JAmx4o8Ny+6ya8+jA+TEeTigur8QLOanF+GX
-----END CERTIFICATE-----
subject=/CN=test-psc-1.nfvra1.com/C=US
issuer=/CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=test-psc-1.nfvra1.com/OU=VMware Engineering
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1515 bytes and written 433 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID:
Session-ID-ctx:
Master-Key: 99FD874339EC18A57EB60D3181EFFAEB8EF0675708EDC306676BEE5E4EF888B319432FCAE14E1233FBD7C4F8ADFDDFAF
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1526024218
Timeout : 300 (sec)
Verify return code: 0 (ok)

From browser, try to access the Load Balancer IP / FQDN, URL: https://test-psclb.nfvra1.com, should be able to access and display the PSC home page.

If the above two steps are working as expected please proceed the below next tasks.

Preparing a certificate for PSC's

Access PSC1 node from SSH and execute the below commands:

# mkdir /certs
# cd /certs/

Create a file by using the below command and copy the below content and modify the DNS entries.

# vi psc_ha_csr_cfg.cfg
[ req ]
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
[ v3_req ]
basicConstraints = CA:false
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = DNS:test-psc-1.nfvra1.com, DNS:test-psc-2.nfvra1.com, DNS:test-psclb.nfvra1.com

[ req_distinguished_name ]
countryName = US
stateOrProvinceName = CA
localityName = Palo Alto
0.organizationName = VMware
organizationalUnitName= NFV
commonName = test-psclb.nfvra1.com

Generate a Certificate Signing request and Private Key

# openssl req -new -nodes -out /certs/psc-ha-vip.csr -newkey rsa:2048 -keyout /certs/psc-ha-vip.key -config /certs/psc_ha_csr_cfg.cfg

Generate a certificate from VMCA
# openssl x509 -req -days 3650 -in /certs/psc-ha-vip.csr -out /certs/psc-ha-vip.crt -CA /var/lib/vmware/vmca/root.cer -CAkey /var/lib/vmware/vmca/privatekey.pem -extensions v3_req -CAcreateserial -extfile /certs/psc_ha_csr_cfg.cfg

# cp /var/lib/vmware/vmca/root.cer /certs/cachain.crt

Validate the certificate

Verify that the Subject CN value is the correct Load Balanced FQDN.

Verify that all PSC FQDNs and Load Balanced FQDN are present in the DNS value

# openssl x509 -in /certs/psc-ha-vip.crt -noout -text

Replacing the default Machine SSL Certificate

Launch the Certificate-Manager and select Option 1, then select sub Option 2.

# /usr/lib/vmware-vmca/bin/certificate-manager

Provide the paths to the psc-ha-vip.crt, psc-ha-vip.key and cachain.crt files created in the previous section.

Please provide valid custom certificate for Machine SSL.

File : /certs/psc-ha-vip.crt
Please provide valid custom key for Machine SSL.

File : /certs/psc-ha-vip.key
Please provide the signing certificate of the Machine SSL certificate

File : /certs/cachain.crt

Copy the /certs folder from PSC1 to PSC2

From PSC1 # scp -r /certs/ root@PSC2 IP:/

Repeat above step (a) for PSC2.

Run the PSC HA 6.5 Scripts

updateSSOConfig.py:

Important: Ensure you perform this step on all PSCs(PSC1 & PSC2) participating in the HA instance.

# cd /usr/lib/vmware-sso/bin
# python updateSSOConfig.py --lb-fqdn=test-psclb.nfvra1.com

updateLsEndpoint.py:

Important: You only need to perform this step on a single PSC node. (peform on PSC1)

# cd /usr/lib/vmware-sso/bin

Run the updateLsEndpoint.py script, passing in your Load Balanced FQDN, Administrator User name and Administrator Password as variables.

# python UpdateLsEndpoint.py --lb-fqdn=test-psclb.nfvra1.com --user=[email-masked] --password=VMware123$

Validate PSC HA 6.7

Run the following command to return the Site ID

# python /usr/lib/vmidentity/tools/scripts/lstool.py get-site-id --url http://localhost:7080/lookupservice/sdk 2> /dev/null

Run the following command to list the cs.identity endpoints, passing in the site name recorded in the previous section

# python /usr/lib/vmidentity/tools/scripts/lstool.py list --url http://localhost/lookupservice/sdk --site psc-lb --type cs.license 2> /dev/null | grep URL

Note: A total of 8 cs.license endpoints should be updated with the PSC HA VIP (4 per PSC).

Verify the cs.identity endpoints. Run the following command to list the cs.identity endpoints, passing in the site name recorded earlier.

# python /usr/lib/vmidentity/tools/scripts/lstool.py list --url http://localhost/lookupservice/sdk --site psc-lb --type cs.identity 2> /dev/null | grep URL

Note: A total of 16 cs.identity endpoints should be updated with the PSC HA VIP (8 per PSC).

Repoint vCenter Server from PSC01 FQDN to PSC LB FQDN.

Run the following commands from vCenter server to repoint the vCenter from PSC01 to the PSC LB VIP FQDN.

# /usr/lib/vmware-vmafd/bin/vmafd-cli set-dc-name --server-name localhost --dc-name psc-ha-vip.domain.com

Restart Services:

# service-control --stop --all

# service-control --start --all

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

No results for undefined

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

Related Versions:

VMware NSX-T Data Center 2.x

VMware NSX-T Data Center

Take Our Survey

Support Assistant