Mount this to the server, by using rufus to create a bootable USB, or by mounting it to your servers virtual CD ROM in the IPMI, iDRAC for Dell and iLO for HPE

Once the server has booted ESX, you’ll have this screen, select enter to continue

Accept the EULA with F11

It will then scan for bootable devices, for a production system this should be something in RAID 1
Examples are Dell’s BOSS card
For HPE G11 you should have the NS204i-U, or for G10 systems the NS204i-P, which is a PCIe card

As this is a lab, I have a virtual disk, and will be using the 400GB one by making sure its highlighted in Yellow and clicking Enter to Continue

Select your keyboard layout and hit Enter

Set a root password, use something easy to use, we can set a secure random one later

You may get a CPU warning depending on your hardware
Press Enter

Then click F11 to install

Once thats done, reboot the server when prompted and unmount your media

Once thats done, reboot the server when prompted and unmount your media

When the host boots, it should look like this, press F2 to login

Enter the root credentials and press enter

Scroll to Configure Management Network and press enter

Press Enter on Network Adapters and ensure that a connected Nic is selected, these should all be configured the same on the switch

In my case VMNIC0 is connected, and I will be using this for management, so I will press Escape and leave it as it is

Press enter on VLAN

And enter your ESXi management VLAN, I am using VLAN 1023
This is only needed if you have your VLANs trunked down, if your management VLAN is the native VLAN you can ignore this, as all my VLANs are trunked down, I am entering mine

On IPv4

Use the space bar to select the third option to set a static IP and add your management IP details in and press enter to Save

For IPv6, select disable on the first option, unless you are specifically using it, and press Enter

Add your DNS servers and the hostname for this server and press Enter

Add your domain under DNS Suffixes and press Enter

Now press Escape and enter Y to apply changes and reboot the host

Then, login on the WebUI at
https://fqdn
And login with the root credentials

Navigate to Host/Configure/Security & Users/Users, and click the root account and click Edit User to change the root password to something more secure

Then add the password
This needs to be 15 characters with the only allowed special characters being !@#$%^&*
Then click Save

Then we need to enable SSH, click Host/Configure/System/Services select SSH and click Start

Now we need to SSH into the host with the root credentials, using something like Putty and run the following to set the hostname/FQDN correctly for the certificate and renew it for the VCF deployment wizard

For my host, lab-vcf91-esx01, lets set the hostname with
esxcli system hostname set -H=<hostname>
So for my host this is

esxcli system hostname set -H=lab-vcf91-esx01

Then set the FQDN with

esxcli system hostname set -f=<fqdn>

Which for my host is

esxcli system hostname set -f=lab-vcf91-esx01.leaha.co.uk

Now renew the certificates with

/sbin/generate-certificates

And reboot the host with

reboot

When it comes back up, you will need to restart SSH for the cloud builder

Lastly, we need to setup NTP on all servers, you can use a windows App, DC or a docker container, for this

Head to Host/Comfigure/System/Time Configuration and click Edit under Network Time Protocol

Check the box to enable it, enter your NTP server and click ok

Then, under services, click NTP Daemon and click Edit Startup Policy

Check the radio button for Start And Stop With Host and click ok

We will need to repeat this on the remaining hosts

Before we proceed we need to check we have enough space on the first host to deploy the VCF installer appliance, your boot device will typically be 512GB or larger so there should be a good size local datastore created we can use for this as we cant use our vSAN disks

We can check this under Storage/Datastores
Mine is only 271GB but should be enough

This only seems to happen for virtual ESX hosts used in labs, when the build option tries to migrate the management vmk to a VDS it will fail

This does not need to be done on physical hardware

We need SSH and the ESX Shell, to enable this, click Host/Configure/System/Services, select ESXi Shell and click Start

Then open up the ESX console and press Alt + F1 to access the shell and login

Then run

esxcli network ip interface list | less

We should see vmk0, the management interface

We need to note the portgroup, which should be ‘Management Network’
We can press ‘q’ to exit this

Now remove the interface with

esxcli network ip interface remove –-interface-name=vmk0

Then recreate it with

esxcli network ip interface add -–interface-name=vmk0 -p "Management Network"

We can press Alt + F2 to switch back to the DCUI, press F2 and login as root

Press Enter on Configure Management Network

Press Enter on IPv4 Configuration

Use the third option to set a static IP and enter the details setup at the ESX deployment stage and press Enter

Then press Escape

And press Y here

Now back in the host UI, click Host/Configure/System/Services, select ESXi Shell and click Disable

Then repeat for the remaining hosts
 

Log into the first host and click Networking
If you set a VLAN for the management VLAN and the management components are going on the same VLAN, which I recommend, we will need to edit the VM Network to set this VLAN, click Networking, then click the three dots on the VM Network entry and click Edit Settings

Set the VLAN tag and click ok

Now click Host/Actions/Deploy OVF Template

Give the VM a name and click Upload Files

Double click the SDDC Manager OVA

Then click Next

Click Next

Accept the EULA

Select the default datastore and make sure Thin Provision is enabled then click Next

Make sure the VM Network is selected and click Next

Under Application enter a root and local user password, these need to be 15 characters with the only special characters being !@#$%^&*
For the hostname enter the FQDN and for NTP add your NTP server

For the networking section, select the IP version, likely IPv4, enter the SDDC Manager IP address, subnet mask, gateway, DNS domain and search domain path and DNS servers, comma separated, then click Next

And click Finish
Do not refresh your page while this is deploying

When thats uploaded, click Virtual Machines, right click the VM and click Power/Power On

Now we have the appliance deployed we need to download all the software binaries, log into the VCF Installer on
https://fqdn

Then click Depot Settings And Binary Management

On the Connect To The Online Depot widget, click Configure

Copy the service ID and then head to vcf.broadcom.com

Then click Software Depot Registration and click New Registration

Paste the Service ID from the VCF Installer and give the depot a name, then click Register

Copy the activation code and click Finish

Paste this into the Activation Code section in the VCF Installer and click Authenticate

At the bottom, select your release version, I am doing 9.1.0.0, and select everything apart from the SDDC Manager and click Download

When its all done, it should look like this

We can then click Return Home at the top left to get back to the main menu

As we proceed through we will need to add various appliances, ensure all are DNS registered as you go through it before you finish the deployment

On the Deploy Widget, click Deployment Wizard/VMware Cloud Foundatio

Click Next

As this is a brand new deployment from scratch we want to make sure we have Deploy A New VCF Fleet selected and click Next

Review the config and click Next when you are happy

This will kick off the validation

If anything fails it must be addressed, the only warning I got was over capacity, it assumes a 1:1 ratio on pCPU to vCPU which is a little overkill, but you are unlikely to hit this in production and my storage is a little lower, with thin provisioning it should be fine, but ensure you have enough storage on a production system

When you are happy, click Deploy

We can then watch it go through all of the stages
We can also click Review Passwords for all the generated credentials, ensure you save these

You can copy this as a JSON or CSV

When its done it will look like this and we can proceed to the VCF Operations UI

The one system we really do want HA on is the NSX manager cluster, we need to expand this with the SDDC Manager API, as of 9.0.x

Thankfully we dont need to do anything complex with this, as APIs can be very confusing if you are new, Operations has an API explorer with a nice template we can use to easily do this

Log into VCF Operations and click Build/Developer Center/APIs & SDKs then click API Explorer on the SDDC Manager API widget

Search for NSX and the bit we want to expand is the GET request for getting our clusters, this will give us our cluster ID which we need for the scale out operation

Expand the request and click Execute, you dont need to fill anything out

We can see the cluster object, you can click the link to expand it

Now we can see our single node, and we have the ID we can copy for later
In my case my ID is 8f4739c3-f002-493b-ae7c-731c1247344a

Now we need the POST request to scale out the cluster

We have two main parameters we need, the cluster ID and the body, for the cluster ID, enter your ID

We then need to add the body, the template for it is this
Remove the IPv6 entries, like mine below, if you arent using it

{
  "nsxManagerSpecs": [
    {
      "name": "",
      "networkDetailsSpec": {
        "dnsName": "",
        "gateway": "",
        "ipAddress": "",
        "ipv6Gateway": "",
        "ipv6PrefixLength": 0,
        "subnetMask": ""
      }
    },
    {
      "name": "",
      "networkDetailsSpec": {
        "dnsName": "",
        "gateway": "",
        "ipAddress": "",
        "ipv6Gateway": "",
        "ipv6PrefixLength": 0,
        "subnetMask": ""
      }
    }
  ]
}

We then need to fill our the variables like below, for each manager

• name – Hostname
• dnsName – FQDN
• ipAddress – IPv4 Addres
• gateway – Network Gateway
• subnetMask – Subnet Mask

This is what I did for my managers

{
  "nsxManagerSpecs": [
    {
      "name": "lab-vcf91-nsx02",
      "networkDetailsSpec": {
        "dnsName": "lab-vcf91-nsx02.leaha.co.uk",
        "gateway": "10.1.23.1",
        "ipAddress": "10.1.23.162",
        "subnetMask": "255.255.255.0"
      }
    },
    {
      "name": "lab-vcf91-nsx03",
      "networkDetailsSpec": {
        "dnsName": "lab-vcf91-nsx03.leaha.co.uk",
        "gateway": "10.1.23.1",
        "ipAddress": "10.1.23.163",
        "subnetMask": "255.255.255.0"
      }
    }
  ]
}

Then click Execute

We’ll see it showing as in progress now

We can view the status from Build/Tasks and then by clicking our VCF instance

Now we have the extra appliances deployed we need some Edge VMs to do the network transport
We need two DNS registered FQDNs for this

Its here that we need our Uplink VLANs for BGP
I would recommend having ToR 1 owning Uplink 1 as the BGP neighbor on this subnet, and ToR 2 owning Uplink 2
In my lab, I only have 1 OPNsense router, so it my case it will own both Uplink VLANs

In vCenter, click the vCenter its self then Networks/Transit Gateways and click Setup Network Connectivity

Select the Span to be the default, we can use spans to limit connectivity between certain vCenters within an NSX instance, but the default will set it for all, then set the Connection to Centralized Connection and click Next

Check the Select All Box, reviewing the prerequisites, and click Continue

Give the Edge cluster a name, select the Large form factor, this will be needed for the Supervisor, and click Add

Enter the node FQDN, select the cluster, optionally add a resource pool, leave host affinity on No, we can configure this later, select a datastore
Then for the management IP select IPv4 only and click Static for the assignment, enter the management IP in CIDR address, add the gateway, then add the VM Management port group we set during the deployment, if you need to check its the port group vCenter is on

For the uplinks, uncheck the box to use the host overlay network the active/standby pNICs should alternate like this and will be populated by default

Enter the Edge TEP VLAN, for the IP Type, select IPv4, select IP pool, then click the three dots and click Create New

Give it a name and click Set under Subnets

Click Add Subnet/IP Ranges

Add an IP range for TEPs, then add the network in CIDR notification, gateway, DNS servers and DNS suffix then click Add

Then click Apply

Add a description and click Save

Now click Run Check to check the VLAN MTU

Then click Apply

And repeat for the second Edge Node, we wont need a new IP pool as we can select the new one from the drop down

Once thats done it should look like this

At the bottom we can remove the toggle to set our own passwords if we want to, when you are happy, click Next

We then need a name for the gateway, enter a name for the T0 gateway, keep HA on Active/Standby, this is very difficult to change later, and Active/Active isnt supported for the supervisor with VPC, routing needs to be BGP, and we then need a local AS number, this must be unique on your network

My lab router has ASN 65535 and thats all I have
But you might want something like ToR1 on 65534 and ToR2 on 65535
I used 65532 for the edge cluster

For gateway uplinks click Set

Now we need to enter the details for the Uplink 1 VLAN
Enter the VLAN ID, interface CIDR, this is the UP the Edge will have and much be unique, gateway IP the ToR has, and enter the ASN number configured on ToR1, then click Next

Repeat for Uplink 2 and click Apply

The same config should be applied to the other Edge node
Uplink 1

Uplink 2

When its done it should look like this

We then need our VPC connectivity, we need two large subnets, I recommend /16s, these must not overlap anywhere else on your datacenter, that can be split out as needed within VPCs, these blocks should not overlap anywhere else on your network
For VPC External IP Blocks, click the three dots and click Create New

Enter a name and add the CIDR, I opted for 10.102.0.0/16 and click Save

Repeat for the transit gateway blocks clicking the three dots and click Create New

Add a name and the IP block, I opted for 10.103.0.0/16, then click Save

Then click Next

Review the config and when you are happy, click Deploy

You will need to update your BGP config on the ToRs with the addresses the Edges have on each uplink VLAN so BGP is then communicating properly

We can click View Details to see the deployment

This takes us to Configure/Networking/Edge Clusters

This K8S cluster hosting a large sum of components can be scaled if you did a simple deployment when building the VCF instance, the key difference is the K8S control plane consists of a single server, 4vCPU/10GB, and can be scaled to a HA 3 node cluster

I would recommend scaling this to HA on the control plane in a production environment

Its also worth noting, during this deployment I did notice one additional worker node, the 12vCPU/24GB VMs, get deployed so scaling this can have larger requirements than just the control plane cluster

Also, after scaling this to medium, the worker nodes were slowly replaced

I would recommend scaling this if you are planning to scale components running on this platform beyond the minimum, this includes

• Log Management
• Real Time Analytics
• Identity Broker
• Salt
• Software Depot

To begin, log into VCF Operations and head to Build/Lifecycle/VCF Management and click VCF Services Runtime

Click Actions/Scale

Select the Medium Size, unless your VCF Fleet is massive Large is very overkill, check the box to acknowledge potential service interruption and click Next

We can add additional IPs if needed, as we deployed this with an IP pool of 30, meant for the larger scales, we can just click Next as we have plenty of IPs

And click Finish

Now that we have the environment and Log Management deployed, we need to onboard our domains so they log to the Log Management cluster

Head to Operate/Administration/Integrations, expand VMware Cloud Foundation, and click the three dots on your VCF instance and click Edit

Click Domains, here we will then see all our domains, you will be on the vCenter by default, under Log Operations, click Activate Log Collection, and select the radio button to bring them directly into the cluster

On vSAN, if you have it, check the box for Enable SMART Data Collection

And for NSX do the same as vCenter and click Save

Now that we have the environment and Log Management deployed, we need to onboard our domains so they log to the VCF Operations For Networks cluster

Head to Operate/Administration/Integrations, expand VMware Cloud Foundation, and click the three dots on your VCF instance and click Edit

Click Domains, here we will then see all our domains, you will be on the vCenter by default, under Log Operations, click Activate Network And Flow Collection, select our collector, then click the check box to Enable NetFlow on the vCenter

Click Enable

Repeat for the Antrea IPFIX and check the box

And click Enable

Click NSX at the top, and check the box for Activate Network And Flow Collection, select the collector and check the box to enable IPFIX

Then check the bot for latency collection and click enable

Then click Save

This section was done on another environment due to licensing constraints, FQDNs will not match the rest of the guide

Its worth noting, vDefend licensing is no longer done by a key in NSX, it requires a different licensing server deployed by the Security Services Platform, requiring 6vCPU and 24GB RAM
It has been excluded from this section due to it being a paid add on and will be included in the vDefend configuration guide, though there is no ETA on this

To license our environment we need to log into VCF Operations and click Manage/Licensing/Licenses & Registration then click Continue

Then click Start

Click Connected and click Continue

Now click Start again under Registration

Log into the Broadcom portal and click Start
The screenshot below may automatically appear

We can use the VCF Operations name and click Save

Click Start on Generate Activation Code

Click Copy to copy the code, then click Finish

In VCF Operations click Start on Enter Activation Code

Paste the code in and click Activate

Now under Add Licenses To License Server, click Start

In the VCF portal, under Add Licenses, click Start

Select your licences and click Confirm

In VCF Operations, click Download

You should get a pop up, when thats come through, click Close

And click Finish

In the VCF Portal, click Mark As Completed

In VCF Operations, scroll down, select your vCenter and click Assign Primary License

Select the license and click Assign

Repeat click Assign Addon License/VMware vSAN for vSAN

Select the license and click Assign

Open the management domain vCenter and click the three lines in the top left, then click Global Inventory Lists

On the left, click Hosts

We first need a network pool, if you are expanding a cluster thats already been created, there will already be a pool that can be used, in that case you can skip this part, but if you are adding a workload domain a new pool will be required, for a new cluster you may or may not need a new pool
Pools must not have overlapping IP ranges
Click the Network Pools section and click Create Network Pool

This part will depend on what you are deploying storage wise, but you’ll pool for vMotion and one for your storage, for this cluster I am using vSAN, it also needs a name
Hosts will also need to be setup like in the ESX section

When you have your networks enter the VLAN, MTU, which likely is 9000, but this will match what you did in the deployment, then add the gateway in CIDR notation, its worth noting here, neither of my networks actually have a gateway, then enter an IP range for hosts
When you have the address ranges, you’ll need to click Add

It should then look like this with the network range added

We then need to repeat for vMotion and click Save

Then we need to commission a host, in vSphere click the three lines in the top left and click Global Inventory Lists

Click Hosts/Unassigned Hosts/ click Commission Host

Check and prerequisites, you will need to select all before continuing
When you are happy click Proceed

Add your host FQDN, select the storage type, select the network pool we created earlier, enter the root credentials and click Add
If your hostname is over 15 characters click Acknowledge, this can be ignored as hosts shouldnt be domain joined

Repeat for all hosts to commission, a non vSAN cluster requires at least two hosts, while vSAN requires at least three hosts, though I recommend four

At the bottom, click the toggle to confirm the fingerprint and click Validate All

Then click Validate All

Once thats validated, click Next

Then click Commission

When its done it should look like this

This will need to be done via VCF Operations, click Operate/Inventory, by default you will be on the simplified view, so click Details View

Expand VCF Instances and select your VCF instance, then click Add Workload Domain/Create New

Check the prerequisites and click Proceed

Give the workload domain a name and select Full Deployment With Cluster

We can disable the supervisor for now, it can be manually configured later like in section 7, credentials will be automatically generated and can be extracted after the domain has been built from the Operations UI, click Next

Add the vCenter FQDN, this will need to be on the same network as the management domain vCenter, enter an SSO domain fort he vCenter, the default vsphere.lcoal wil be fine then click Next
This will default to a large vCenter with 8vCPU and 30GB RAM

Give the cluster a name and click Next

Select our new cluster image and click Next

We then need to setup our NSX instance, I would always recommend HA in production

We get a couple of options, in VCF 9.1 we no longer require a dedicated NSX instance for the first workload domain and we now have the option of joining this to the management domain NSX instance

There are a few of things to note here

Firstly, you likely deployed the medium size for NSX during the deployment, this only supports two vCenters and I cant find the correct way, if possible, to scale this up

Secondly, everything in NSX will generally be available across domains, some people prefer separation, in which case we would want a dedicated NSX instance, though we can use the new Spans features to localize VPCs to particular domains

Thirdly, if you reuse a given NSX instance, the hosts will need access to the TEP VLAN the NSX is configured to use

If you are only deploying a single workload domain, this easily fits into the management domain NSX instance, so I would use this, it will save a lot of resources, if you are planning many workload domains, deploying a dedicated NSX instance here makes more sense, and then using the large size to accommodate up to 16 vCenters 

If you deploy a new NSX instance you will need a VIP FQDN plus three more, one for each node and these will need to be on the same VLAN as the management domain vCenter

I will be adding my instance to my existing NSX manager as I have a single workload domain and this is more resource efficient, if I need to isolate VPCs I can use the Spans feature

Select the Join Existing NSX Manager Instance and select the NSX instance, then click Next

We then need to choose our storage type, I have planned for vSAN ESA, so I select that and clicked Next

For vSAN, the default vSAN HCI is what you likely want, if you are unsure use this option, if you know you need a vSAN storage cluster select that and click Next

We then need to select our hosts, I am using all four I added earlier, then click Next

We then need to select our networking topology, I recommend 6 NICs using the storage and NSX traffic separation, but if you have only 4 NICs, what I would consider to be the minimum, use storage separation

Now, while we have the defaults, this doesnt actually let you edit the settings, and the issue there is the NSX TEP addresses will be using DHCP when we want an IP pool like the management domain during the deployment, so click Create Custom Switch Configuration at the bottom, and we will manually set up the topology

Click Create Distributed Switch

Add a VDS name and set the MTU, this should be 9000, but in line with what was set for the management domain, for Type, I would use VDS Uplinks, we need 2 uplinks, select the vmnics you want to use then click Configure Network Traffic Type/Management
One of these uplinks should be bound to the vSwitch on the default ESX install

Give the port group a name and select the load balancing policy of route based on physical NIC load then click Save Configuration

Click Configure Network Traffic/vMotion

Give the port group a name and select the load balancing policy of route based on physical NIC load then click Save Configuration

Scroll to the bottom and click Create Distributed Switch

Click Create Distributed Switch

Give the VDS a name, set the MTU the same, which should be 9000, for the Type I recommend VDS Uplink, select the two uplinks you want to bind for storage and click Configure Network Traffic/vSAN
If you chose NFS configure that here

Give the port group a name and set the same load balancing option then click Save Configuration

Then scroll to the bottom and click Create Distributed Switch

Click Create Distributed Switch one last time

Give the VDS a name, set the MTU to the same, at 9000, for the Type I recommend VDS Uplinks, then add the remaining uplinks, then click Configure Network Traffic/NSX

Leave the default boxes checked, all three should be, give the overlay transport zone a name, add the host TEP VLAN as the Transport VLAN, set the IP Allocation to Static IP Pool and create a new pool
Then give the pool a name, set the CIDR, IP range and gateway

Give the VLAN transport zone a name, the uplink number should match the number on the VDS, in our case, 2, and set the NSX and VDS uplinks to match

Give the NSX uplink profile a name and set the Teaming Policy to Load Balance Source and click Save Configuration

Scroll down and click Create Distributed Switch

Then click Next

Review all the info and when you are happy click Finish

Once the validation has passed click Finish

We can click View SDDC Manager Tasks on the pop up to track the progress

Ideally, you want one collector/cloud proxy per domain, this isnt a hard rule, and it can be more efficient to reuse existing cloud proxies for data collection rather than deploying more increasing resource requirements

Here we will go through deploying a new proxy, if you wanted one, and in the next sub section, setting up the workload domain to use it

NSX and vCenter appliances are deployed into the management domain, and thats the bulk of the data we are collecting, and as such, the default workflow will also deploy the collector into the management domain, on the same network, so its as close to the data sources as possible#

Log into VCF Operations and click Build/Lifecycle/VCF Management/Components and click VCF Operations

Click Actions/Add Cloud Proxy

Enter an FQDN, this must be registered in DNS, select the size, Small will be fine for most scenarios, enter the VCF Operations password and click Re-Generate

You can use the eye to see the password and save it, you wont be shown it again

Select our VCF instance and click Add

By Default, the workload domain should get integrated after about an hour or so, but lets properly configure this with our new collector, Ops For Logs and Networks

In VCF Operations click Operate/Administration/Integrations, expand VMware Cloud Foundation, then click the three dots on your VCF Instance and click Edit

Make sure System Managed Credentials is checked, select our new workload domain collector, and make sure Operational Actions is enabled, then check Activate Log Collection and click the vSAN tab

Ensure its enabled and SMART data is being collected then click the NSX tab

Ensure NSX is activated, if you have Operations For Networks, also enable that, I didnt redeploy it when I rebuilt my lab, so I left it, then click Save in the bottom left

Before we can start, we need a new Edge cluster in the workload domain to keep all its networking local

We will also need two FQDNs registering on DNS, for the network, I will be using the same network as my ESX management, in a similar style to the management domain, but you can choose any port group in the workload domain, my ESX management VLAN in the workload domain is different from that of my management domain

In the workload domain vCenter, click the vCenter object on the left, and click Configure/Networking/Edge Clusters/Add Cluster

Give the cluster a name and set the form factor to Large then click Add

Enter the node FQDN, select the cluster, optionally add a resource pool, leave host affinity on No, we can configure this later, select a datastore

Then for the management IP select IPv4 only and click Static for the assignment, enter the management IP in CIDR address, add the gateway, then select the port group you want for management, you can use the ESX management one, but I recommend a dedicated port group on for VM Management, this should be ephemeral

For the uplinks, uncheck the box to use the host overlay network the active/standby pNICs should alternate like this and will be populated by default

Enter the Edge TEP VLAN, for the IP Type, select IPv4, select IP pool, then click the three dots and click Create New

Give it a name and click Set under Subnets

Click Add Subnet/IP Ranges

Add an IP range for TEPs, then add the network in CIDR notification, gateway, DNS servers and DNS suffix then click Add

Then click Apply

Add a description and click Save

Now click Run Check to check the VLAN MTU

Then click Apply

And repeat for the second Edge Node, we wont need a new IP pool as we can select the new one from the drop down

Once thats done it should look like this

At the bottom we can remove the toggle to set our own passwords if we want to, when you are happy, click Save

When its done it should look like this

Before we can get our T0 gateway configured for external connectivity at the vCenter we need the uplink segments, and we need 4 to match the existing ones but for the uplink VLANs for our new workload domain 

Open the NSX GUI at the VIP address and log in with admin account

Head to Networking/Connectivity/Segment Connectivity/Segments and click Add Segment

Give it a name, and select the same transport zone as the other segments, the nsx-system-vlan-transport-zone, add the VLAN tag for uplink 1 and select the pre created teaming-1 Uplink Teaming Policy and click Save

Click No here

Repeat for three additional segments, 1 per edge per uplink VLAN
For the second VLAN, in my case 1047, use Teaming-2 like this

When your done it should look like this

Now we have our cluster, we need a new T0 gateway, if we reuse the gateway from our initial deployment, then all traffic leaving NSX will go via our other domain, which we dont want

To do this, open the NSX GUI, on the VIP FQDN and log in with the admin account

Click Networking/Connectivity/Tier-0 Gateways/Add Gateway/Tier-0

Enter a name, select the HA mode as Active/Standby, else NAT wont work causing issues with the Supervisor and K8S, select our new edge cluster and click Save

When you see this popup, click Yes, as we need to edit a few things

Expand Interfaces & GRE Tunnels and click Set

Click Add Interface

The first interface will be for the first edge on the first uplink VLAN, give it a name, add an IP in CIDR notation for that VLAN, in my case 1046, and select the segment for teaming-1 on that VLAN for edge01, then select the Edge Node, and click Save

We then need to repeat for all Edge nodes so that there is 1 interface per segment, one per VLAN per Edge

You should get something like this, click Close

Now for BGP, like before, this depends on how you have it setup, but we will be using the same concept as the management domain with a local AS number unique to this cluster, going over two BGP VLANs, which each of your ToR switches would own one each

This will not cover the BGP side outside of NSX

Expand BGP and set the local AS number, and by BGP neighbors on the right, click Set

Click Add BGP Neighbor

Add the BGP peer IP and remote AS number, then add the source addresses from the drop down that match the subnet and click Save

Then repeat for the other VLAN, your remote AS will likely be different for these peers, as mine is a single device for my lab, they ahev the same AS number

When you are done it should look like this, click Close

Now expand Route Redistribution and click Set

Click Add Route Redistribution

Click Set

Check all boxes and click Apply

Then click Add

Click Apply

Click Save

Then click Close Editing

Now we have an edge cluster, we can create a new transit gateway and connectivity profile to utilize at our workload domain

On the vSphere networking tab, right click Virtual private Clouds and click New Transit Gateway

Give the gateway a new name, leave the span on default, select Centralized Connection, for the HA mode, use Active Standby, else the Supervisor and K8S workloads will not work properly with NAT, for the Edge cluster, select our newly deployed cluster, and click Next

Select the radio button for Create New, then give the external connection a name, then select our new T0 gateway, then for VPC external blocks click the three dots and click Create New

Add a /16 block of IPs to be globally accessible over your datacenter and click Save

For Private Transit Gateway blocks click the three dots and click Create New

Add another /16 that doesnt overlap anywhere and click Save

Enable Default Outbound NAT and click Save

By default all VPCs land in the default transit gateway and connectivity profile, this is fine for the initial domain, but not so much for our workload domain

To create a new VPC click the networking tab in vSphere and right click Virtual private Clouds/New VPC

Give the VPC a name, and assign a private IP space, this wants to be another /16 that doesnt overlap anywhere else on the datacenter, this /16 can, be reused over all VPCs, which I typically recommend

Expand Advanced Settings and make sure for the connectivity profile we select the one for our new transit gateway and click Save

Now when we create subnets they will be attached to the correct Edge cluster with the local IP ranges and we dont end up with lots of cross domain routing

We’ll cover more on creating networking in the NSX configuration guide

We need to log into the SDDC Manager UI on
https://fqdn
We will then get redirected to login with the management domain vSphere SSO accounts

Click Inventory/Workload Domains and select the workload domain which is having its cluster expanded, I will be doing this on the vcf9-wld01 domain

Click Actions/Add Cluster

Enter a cluster name, and select the existing datacenter then click Next

Select our image, I will be using the same as my first workload domain cluster, then click Next

Select your storage type

For vSAN select the vSAN type, this will typically be vSAN HCI unless you know you need a vSAN storage/Compute cluster, then click Next

Select our hosts and click Next

We then need to select our networking topology, I recommend 6 NICs using the storage and NSX traffic separation, but if you have only 4 NICs, what I would consider to be the minimum, use storage separation

Now, while we have the defaults, this doesnt actually let you edit the settings, and the issue there is the NSX TEP addresses will be using DHCP when we want an IP pool like the management domain during the deployment, so click Create Custom Switch Configuration at the bottom, and we will manually set up the topology

Click Create Distributed Switch

Add a VDS name and set the MTU, this should be 9000, but in line with what was set for the management domain, for Type, I would use VDS Uplinks, we need 2 uplinks, select the vmnics you want to use then click Configure Network Traffic Type/Management
One of these uplinks should be bound to the vSwitch on the default ESX install

Give the port group a name and select the load balancing policy of route based on physical NIC load then click Save Configuration

Click Configure Network Traffic/vMotion

Give the port group a name and select the load balancing policy of route based on physical NIC load then click Save Configuration

Scroll to the bottom and click Create Distributed Switch

Click Create Distributed Switch

Give the VDS a name, set the MTU the same, which should be 9000, for the Type I recommend VDS Uplink, select the two uplinks you want to bind for storage and click Configure Network Traffic/vSAN
If you chose NFS configure that here

Give the port group a name and set the same load balancing option then click Save Configuration

Then scroll to the bottom and click Create Distributed Switch

Click Create Distributed Switch one last time

Give the VDS a name, set the MTU to the same, at 9000, for the Type I recommend VDS Uplinks, then add the remaining uplinks, then click Configure Network Traffic/NSX

Leave the default boxes checked, all three should be set the transport VLAN for NSX, and for IP Allocation, select Static IP Pool, then click Re-Use An Existing Pool and select the pool used for the first cluster in our workload domain

You can optionally create a new pool with a different VLAN if required

Give the VLAN transport zone a name, the uplink number should match the number on the VDS, in our case, 2, and set the NSX and VDS uplinks to match

Give the NSX uplink profile a name and set the Teaming Policy to Load Balance Source and click Save Configuration

Scroll down and click Create Distributed Switch

Then click Next

Review all the info and when you are happy click Next

Once the validation has passed click Finish

To scale VCF Automation out from a single node deployment to a three node medium cluster, in VCF Operations, click Build/Lifecycle/VCF Management/VCF Automation

Click Actions/Scale

Select the target size, Medium, check the box to acknowledge a potential service outage and click Scale

We can scale the Identity Broker out to a three node cluster from VCF Operations

To change this, click Build/Lifecycle/VCF Management/Identity Broker

Click Actions/Scale

Select the size as Medium, check the box to acknowledge a potential service interruption and click Scale

What I have added below is not an exhaustive guide of everything that can be added, for a full list, look at Veeam’s documentation on their API, various bits on information have been gathered from it, can be found here

Its also worth noting, section 1.1.1 covers the base and single request, other sections in 1.1 add additional requests, any time you make any changes in the management pack builder and want to re install the pack, you must uninstall the pack, which removes all data and will break any dashboards, and re install it
So I would recommend adding all requests off the bat, having too many metrics isnt really an issue anyway

1.1.1 – Setup And Licensing Request

In this section we will cover setting up the base and adding a single request, additional requests will be added later

1.1.1.1 – Adding The Source

Details on here were only possible due to Daniel Krieger’s guide here, so be sure to check it out

I would recommend adding an API user to VBR for this if you use the backup viewer role this can generally read most things, but some bits like licensing it cant

To start building the pack, for 9.0.x, we need to head to Developer Center/Management Pack Builder and click Create New Design

Give it a name and click Create

We then need to click Add Source

We then need a few bits

• Our collector, dont use the Ops built in collector, use the dedicated cloud proxy appliance collector if its available
• The VBR server FQDN
• The port, which for VBR, the API is accessible on 9419
• TLS needs to be no verify
• We need Custom authentication type here
• And add a variable called password, and enter the password for the user this pack will use, in my case, a dedicated API user with administration permissions – some values cant be read with read only

Make sure you then enable the toggle for Use Session Authentication and click Next

Now we need the HTTP method, this needs to be POST, and add an API path of
api/oauth2/token

Now expand the Advanced Settings, we’ll need a few things here

For the header, we need to set Content-Type needs to be
application/x-www-form-urlencoded

We need to add a new header called, x-api-version, and set its value to
1.3-rev1

And a third header called, accept, with a value of
application/json

Lastly we need a body which should look like this
username=<username>&password=${authentication.credentials.password}&grant_type=password&refresh_token=&code=&use_short_term_refresh=&vbr_token=

As I am using the Windows user, api, I changed the username to api like this
username=api&password=${authentication.credentials.password}&grant_type=password&refresh_token=&code=&use_short_term_refresh=&vbr_token=

Back at the top we can now click Make Session

And with a bit of magic, we should see the test response with a new bearer token and it marked as a success, when thats done, click Next

For global Settings, we need to change the Content-Type to the same as we has previously, which is
application/x-www-form-urlencoded
We also need to add a header called x-api-version, and the value needs to be
1.3-rev1
Lastly, click Add Variable in the Session Fields part at the top, the default value will have our access token pre populated
Then click Next

We then need to test the release, for this, we need to change the HTTP method to POST, and the API path is
apt/oauth2/logout

Now expand Advanced Settings and Add another HTTP header called Authorization with the value
Bearer ${authentication.session.access_token}

Now click Release Session to test, this should say success, then click Next

We can now test the API, so to start with lets get our VBR license details, keep the HTTP method on GET and use this API path
api/v1/license
If you get error 403 this is usually caused by not having permissions to view what the API is requesting

We need to expand Advanced Settings and add the same header from before, called Authorization, with the value
Bearer ${authentication.session.access_token}

When we click Test Connection, we should see our licensing information in the output, when you are happy, click Save Source

1.1.1.2 – Requests

Now we have the source configured, click the red exclamation mark on Requests

Click Add Request

Lets start with one for our license
For the API path fill in
api/v1/license
And give the request a name

Then, under Advanced Settings we need to add a header called Authorization again with the value
Bearer ${authentication.session.access_token}

The click Make Request

This should run, and give us the same results as our test, click Next

On the Pagination section, we can configure this, but I just disabled it, I am not 100% if/where its needed
When you are happy, click Save Request

We can add additional requests, but for now I am leaving this blank to come back to later for more data

1.1.1.3 – Objects

Click the red exclamation mark on Objects

Click Add new Object

Give the object a name, I called this License Spread, you can change the icon which I did, then click Next

How we need to define this object attributes is going to depend on what you are requesting, in my case, I am doing licensing spread, so I want everything on instanceLicenseSummary.objects*
When you are happy, click Next

I left this on default, then click Next

I only had Type available here, so I selected those and clicked Save Object

We then want another for our licensing info, since we cannot overlap both on the same object click Add New

Give this a different name, I went for License Info, we can also change the icon if needed, and click Next

This time we can add several of the metrics at the bottom like so and click Next

Click Next here

Here I added the instance name as the Support ID, as this should be unique if you have multiple VBR servers, this may need tweaking, and for the Object Identifier add everything and click Save Object

1.1.1.4 – Verify And Install

I am skipping over events, for now I want to get the data into VCF Ops and create a dashboard, so lets click Verify and click Perform Collection

We can now see thats run successfully and is pulling some data in, we can click the number links to see the data
When you are happy, click Install

Then click Review Configuration

We set the Port to 9419 and the SSL Configuration to No verify then click Save Configuration
Its worth noting, if you add other requests this will need setting each time you try to install it

Then click Install

Once thats done we can click View Management Pack

1.1.1.5 – Adding Our VBR Server

Now the pack is built and setup, we need to connect our VBR instance

Click our new Veeam type

Give it a name and enter the FQDN of the VBR server

Click the + icon and add the credential for accessing the API, in this case, given we defined the API user in our management pack, we need the password for this account, then click ok

Then select our collector, and click Validate Connection

This should be successful, click ok

Then click Add at the bottom

We will then need to click the three dots on our new object and click Start Collecting

Then give it ~15 mins for data to come in

1.1.2 – Adding More Requests

To get back to the menu to add more requests, click Developer Center/Management Pack Builder then click our Veeam design

Then click Requests on the top timeline bar, then click Add New

1.1.3 – Get Job States

Make sure the HTTP Method is GET, the API path is
api/v1/jobs

Add a name for the request

We need the variable Authorization into the header with this value adding
Bearer ${authentication.session.access_token}

Then click Make Request

This will return an output and report as successful, then click Next

Disable pagination and click Save Request here

Click Objects in the timeline bar at the top and click Add New

Give it a name and optionally change the default Icon and click Next in the bottom right

Then expand the Get Job States request, if you chose a different name, yours will be different

And select the below, then click Next

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use ID and Name then click Save Object

1.1.4 – Repository States

Make sure the HTTP Method is GET, the API path is
api/v1/backupInfrastructure/repositories/states

Add a name for the request

We need the variable Authorization into the header with this value adding
Bearer ${authentication.session.access_token}

Then click Make Request

When thats run ok and returns data, click Next

Disable pagination and click Save Request here

Click Objects in the timeline bar at the top and click Add New

Give it a name and optionally change the default Icon and click Next in the bottom right

Then expand the Get All Repository States request, if you chose a different name, yours will be different
And select the below, then click Next

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use ID and Name then click Save Object

1.1.5 – Backup Server Info

Make sure the HTTP Method is GET, the API path is
api/v1/serverInfo

Add a name for the request

We need the variable Authorization into the header with this value adding
Bearer ${authentication.session.access_token}

Then click Make Request

When thats returned data, click Save Request

Click Objects in the timeline bar at the top and click Add New

Give it a name and optionally change the default Icon and click Next in the bottom right

Then expand the Get Backup Server Info request, if you chose a different name, yours will be different
And select the below, then click Next

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use Name then click Save Object

1.1.6 – Config Backup Status

Make sure the HTTP Method is GET, the API path is
api/v1/configBackup

Add a name for the request

We need the variable Authorization into the header with this value adding
Bearer ${authentication.session.access_token}

Then click Make Request

When thats run ok and returns data, click Next

Disable pagination and click Save Request here

Click Objects in the timeline bar at the top and click Add New

Give it a name and optionally change the default Icon and click Next in the bottom right

Then expand the Config Backup Status request, if you chose a different name, yours will be different
And select the below, then click Next

We also want to expand Get Backup Server Info and select name, this will give us a name identifier for later

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use Name then click Save Object

1.1.7 – Get All Restore Points

Make sure the HTTP Method is GET, the API path is
api/v1/backupObjects

Add a name for the request

We need the variable Authorization into the header with this value adding
Bearer ${authentication.session.access_token}

We also need a Query parameter to limit these for our platform, our options are

“VMware” “HyperV” “CloudDirector” “WindowsPhysical” “LinuxPhysical” “Tape” “CustomPlatform” “EntraID” “UnstructuredData” “Test” “MongoDb” “AWSEC2” “AzureCompute” “GCE”

I am doing this for VMware, so I added the parameter name platformNameFilter with the value VMware

Then click Make Request

When thats successful click Next

Disable pagination and click Save Request here

Click Objects in the timeline bar at the top and click Add New

Give it a name and optionally change the default Icon

Then expand the Get All VMware Restore Points request, if you chose a different name, yours will be different
And select the below, then click Next

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use ID and Name then click Save Object

I repeated again, but using the filter UnstructuredData, for my NAS backups for a new request

We then need another object, give it a name and click Next in the bottom right

Then expand the Get All File Restore Points request, if you chose a different name, yours will be different
And select the below, then click Next

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use ID and Name then click Save Object

You can repeat for other types like physical hosts

What you can also do, as this for vSphere VMs, as they exist within the VCF Operations Inventory is define a new Relationship to match the Veeam VM entries to VMs, click Relationships/Add New

On the right hand side enable the toggle to use All Objects, then add vCenter Virtual Machine, and for the property look for Configuration|Name and click that, at the bottom give the relationship a name

Then click Add

For the Child Object, look for the VMware Backup Restore Points object and for the property click Name

Then click Add

Now click Save Relationship

While the above was tested and working properly in VCF Operations 9.0.x, I did notice it had broken after upgrading to Ops 9.1, when checking back in on the management pack, now located in Build/Developer Center/Management Pack Builder, the Objects section has a vCenter Virtual Machine option, not sure if I missed it before

If you click into that

Then click Next

From the Get All VMware Restore Points API request the below, and click Next

Leave this at the default and click Next

Then set the Object Binding to be the name from the API request on the left and the Configuration|Name for the vCenter VM on the right, and click Save Object

This will fix the issue and the relation works as intended, it is work noting, if you verify the management pack and go to the Install section, you now have the option to upgrade the management pack in Ops 9.1

1.1.8 – Get All Managed Servers

Make sure the HTTP Method is GET, the API path is
api/v1/backupInfrastructure/managedServers

Add a name for the request

We need the variable Authorization into the header with this value adding
Bearer ${authentication.session.access_token}

Then click Make Request

When thats run ok and returns data, click Next

Disable pagination and click Save Request here

Click Objects in the timeline bar at the top and click Add New

Give it a name and optionally change the default Icon and click Next in the bottom right

Then expand the Get All Managed Servers request, if you chose a different name, yours will be different
And select the below, then click Next

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use ID and Name then click Save Object

1.1.9 – Get Email Settings

Make sure the HTTP Method is GET, the API path is
api/v1/generalOptions/emailSettings

Add a name for the request

We need the variable Authorization into the header with this value adding
Bearer ${authentication.session.access_token}

Then click Make Request

When thats run ok and returns data, click Next

Click Objects in the timeline bar at the top and click Add New

Give it a name and optionally change the default Icon and click Next in the bottom right

Then expand the Get Email Settings request, if you chose a different name, yours will be different
And select the below, then click Next

Also expand Get Backup Server Info and select name as this will give us an identifier we need later

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use Name then click Save Object

1.1.10 – Get All Proxies

Make sure the HTTP Method is GET, the API path is
api/v1/backupInfrastructure/proxies

Add a name for the request

We need the variable Authorization into the header with this value adding
Bearer ${authentication.session.access_token}

Then click Make Request

When thats run ok and returns data, click Next

Disable pagination and click Save Request here

Click Objects in the timeline bar at the top and click Add New and click Next in the bottom right

Give it a name and optionally change the default Icon

Then expand the Get All Proxies request, if you chose a different name, yours will be different
And select the below, then click Next

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use ID then click Save Object

1.1.11 – Get Security Best Practices Analyzer Results

Make sure the HTTP Method is GET, the API path is
api/v1/securityAnalyzer/bestPractices

Add a name for the request

We need the variable Authorization into the header with this value adding
Bearer ${authentication.session.access_token}

Then click Make Request

When thats run ok and returns data, click Next

Disable pagination and click Save Request here

Now this gets us the results, but not when it ran, create another request, we need the same HTTP header with our Bearer token, but the API path should be
api/v1/securityAnalyzer/lastRun

Then click Make Request

Here we can see its run time was, for me, yesterday at 2200, click Save Request

Click Objects in the timeline bar at the top and click Add New

Give it a name and optionally change the default Icon and click Next in the bottom right

Then expand the Get Security Analyzer Results request, if you chose a different name, yours will be different
And select the below, then click Next

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Best Practice, and for the Object Identifiers, use ID then click Save Object

We cant combine the last scan run time we got in our other request, into the one with the results, but we can create another object so the data is in Operations

Click Objects in the timeline bar at the top and click Add New

Give it a name and optionally change the default Icon and click Next in the bottom right

Then expand the Get Security Analyzer Last Run request, if you chose a different name, yours will be different
And select the below, then click Next

Make sure each label has the correct datatype, this will control if its a property or metric in most cases, here is what I chose, then click Next

We need some identifiers, for the Object Instance Name, set this to Name, and for the Object Identifiers, use ID then click Save Object

This dashboard does assume you have a single VBR instance, if you have multiple added some parts may show data differently, or need additional filtering

Here we will create the widgets to form this dashboard, the widgets are in no order, and can be re arranged in any way you like

The other thing that will be created is a widget for my VM dashboard which shows the restore points of a selected VM, if its backed up by Veeam, if its not, its empty

2.1.1 – Creating The Dashboard And The Licensing Widget

We first need to create a new dashboard, in VCF Operations click Infrastructure Operations then click Dashboards & Reports then click Create

Give it a Name and click Save

Then click Actions/Edit Dashboard

We now need to drag a Score Board onto the cavas

Click the pencil to edit it

Give it a name, then ensure Refresh Content and Self Provider are set to On, Box Columns is set to 4, visual theme you can change, I opted for Pastel
Then click Input Data at the bottom

Click the + icon

Search for License, and we should see the License Info name from the License Info Object Type, click that and expand Metrics and Properties and click all of the ones shown below

Click the Plus again

Then click Virtual Machines and click Metrics|Used Instance Number

And click the Plus one more time

And repeat for File Shares, if you have those, then click ok

Double click the first object, give the Box Label a name, set the Color Method to None and click Update

Repeat for the rest, you can drag them into any order, when you are happy, click Save

And when you are done you should get something like this

2.1.2 – Repository Capacity

We first need a Super Metric, head to Infrastructure Operations/Configurations and click Super Metrics

Then click Add

Give it a name and click Next

Search for repository states and click it

Then click Next

Now we need our formula, the Veeam API doesnt return a % free on the metric list, but we have the total capacity and the used capacity so we can calculate the used %

Make sure the toggle is set for unformatted text, then enter this in the box

100 - (${this, metric=free_gb} / ${this, metric=capacity_gb} * 100) 

Then click the unformatted toggle to reformat it, we can also click Preview to see what it will look like if you need, then add the % unit at the bottom, when you are happy, click Next

Select the default policy, if you miss this, the super metric wont be created
And click Create

This metric will take 5-10 mins to show through when creating the dashboard

We can then head back to our Dashboard editing

For a nice widget for our repository free capacity, drag a Top-N onto the canvas

Click the pencil to edit it

Give it a name, set Refresh Content and Self provider to On, then set the Bars Count to 10 or 15, Round Decimals to 2, Filter Old Metrics to On, the Top-N Options should Metric Analysis and select Top Highest Utilization
Then click Input Data

Make sure this is set to all and click Output Data

Click the +

Use the drop down to set our adapter to the Veeam adapter then click the Repository States object and click ok

Then we need to select our metric, find and double click our new super metric
If its not there, give it 10-15 mins, the metric needs to be populated on a data collection cycle

Add a label, ensure the unit is %, and add a custom Color Method, I went for 80/88/92% for my thresholds but you can change this, then click Additional Columns

Click the +

Use the adapter drop down to select our Veeam adapter, then search for and click Repository States, on the right, expand properties and click Type, then click ok

Now click Save

When you are done, you will end up with a widget like this

2.1.3 – VBR Info

Drag a scoreboard onto the canvas

Click the pencil to edit it

Give it a name, then set the following

• Refresh Content to On
• Self Provider to On
• Box Columns to 3
• Visual Theme to Pastel

Then click Output Data

Click the +

Change the Adapter Type to Veeam and click Backup Server Info, then click properties/Build Version, Name and Platform, then click ok

Click the + again

Set the Adapter Type to Veeam like before, then click Config Backup Status, then click Metrics/Encryption Is Enabled, Properties/ Is Enabled and Last Successful Backup Last Successful Time, then click ok

We can double click an object under the Box label to edit its display name and colour method, when its set, click Update

You can also drag them around to change the order, this is what I ended up with, when you are happy click Save

And you should end up with something that looks a little like this

2.1.4 – Security Analyzer Results

Drag a Distribution View onto the canvas

Then click the Pencil

Give it a name and set Refresh Content and Self Provider to On, then click Input Data

Click the +

Expand Veeam/Veeam World and click Veeam World then click ok

Then click Output Data

Click the + to create a new View

Give it a name, set the visualization to Donut Chart, set the Distribution Type to Discrete Distribution and click Next

For the Subject, search for and add, Veeam/Security Analyzer Results

Click Security Analyzer Results on the Selected Subject, then drag Properties/Status over to the middle section like so and select the Preview Source as Veeam World, we should see the chart populate

Now also drag over Note then click Create

Then hit Save

The widget will then look like this

If you click any section of the donut, we get extra information about the status, and here we can see the best practice and note, as part of the additional information we added, I made the widget longer and made the details box on the right take up about two thirds, when its done you’ll get something like this

And if we need to close the extra information, we get this

2.1.5 – Job Results

For this widget we will be configuring a pair, ideally I wanted a bar chart of the last 7 days with the number of failures and successes like in Veeam ONE, you can also configure that in Grafana so its a shame I couldnt find a way to do this in VCF Operations

This will have two widgets, failures in red, nice and clear so you can see if anything needs immediate attention, and another for successes in green

Drag a Distribution View onto the canvas

Click on the pencil to edit the widget

Give it a name, set Refresh Content to On and Self Provider to On and click Input Data

Click the +

Click Veeam/Veeam World and click ok

Then click Output Data

Click the +

Click Distribution

Give it a name, set the visualization to Donut Chart, set the colour to green, set the Distribution type to Discrete Distribution and click Next

For the subject, use the drop down to select Veeam/Backup Job States

Click Backup Job States, drag Properties/Last Result over to the middle box, if we wait or refresh the data we can see this is shown, and you can see the colour issue as failed jobs are populated, ensure the Preview Source int he top right is Veeam World, I have an entry for none, this is caused by a job in progress and will clear
Click Next

Click Next again

For the filter, on the Backup Job State Filter, use Property, Last Result, Current, Is and Success, this only includes succeeded jobs, then click Create

Then click Save

The widget will look like this, the only odd thing is the colour on the preview is correct, but on the actual widget, it uses the default, which is a pain

We can repeat again with another Distribution View, when you are back on Output Data, click the + again

Give it a name, set the Visualization to Donut Chart, and select the red colour, hopefully the bug with the colour not showing will be fixed in a later release, set the Distribution type to Discrete Distribution and click Next

Add a subject and from the drop down select Veeam/Backup Job States

Click Backup Job States as the selected subject, then drag Properties/Last Result to the middle section and set the Preview Source as Veeam World and the preview should look like this, then click Next

Click Next again

On the Backup Job State Filter, enter Properties, Last Result, Current, Is and Failed then click Create

Then click Save

The widget will then look like this

You can also click on the donut for more info, you get info on that

So if I click the failed donut, I can see what job failed

2.1.6 – Backup Job Stats

2.1.6.1 – Super Metrics

Before we start we will need a few super metrics as Veeam reports the data values in B, when I want GB, you can also add an extra /1024 to all super metric definitions for TB, but as my data values arent that large I didnt

To add a super metric, click Configurations/Super Metrics

Then click Add

We first need one for the read data, called Veeam – Session Read Size, add that title and click Next

We then need an Object Type, for this click Veeam/Backup Job States

Then click Next

Enable the toggle to change the data to unformatted

Then enter this value

${this, metric=session_progress_read_size}/1024/1024/1024

Then click the toggle again to format it

Select the unit to be GB, or TB if you opted for that, and click Next

Select the default policy and click Create

We then need to add another called Veeam – Transferred Size

With the same Object Type

Using this unformatted code for

${this, metric=session_progress_transferred_size}/1024/1024/1024

Like this, when re formatted, dont forget to add the Unit at the bottom of GB and click Next

And defining it in our default policy and clicking Create

We then need one more called Veeam – Processed Size

With the same Object Type

Using the following unformatted code

${this, metric=session_progress_processed_size}/1024/1024/1024

When formatted will look like this

2.1.6.2 – Object List

Drag an Object List onto the canvas

Then click the pencil icon to edit it

Give it a name and click Output Filter

Expand Object Types, search for and click Backup Job States then Additional Columns

Click the +

Change the Adapter Type to Veeam, select Backup Job States and click Properties/Type, then click ok

Now click Save

We should then end up with a list of all our jobs gathered by the adapter

2.1.6.3 – Job Data Metrics

Now we have the object list we can create some widgets that use it as input giving us a job selector and info on the dashboard, drag a Metric Chart onto the canvas

Click the pencil to edit it

We’ll create a pair of widgets like this, so lets start with data read from the backup job, give it a name, like Read Data, set Refresh Content to On, leave Self Provider as Off and click Output Data

Click the +

Set the Adapter Type to Veeam, then click Backup Job States/Super Metrics and click on the one we create for the Veeam Session Read GB, then click ok

Now hit Save

Now to use the selected job from our job list as the input for this widget, click Show Interactions at the top of the dashboard configuration page

Drag the output from the job list into the new widget’s input like so

Then click Hide Interactions

Now whenever you click on a job for this dashboard, the Read Data is pulled for that job

We can do another for transferred data, drag another Metric Chart onto the canvas

Click the pencil to edit it

Use the same settings on the configuration giving it a useful name, then click Output Data

Click the +

We are then going to do the same and change the Adapter Type to Veeam, click Backup Job States/Super Metrics and our other super metric we created, then click ok

And click Save

At the top click Show Interactions

And drag the output from the Veeam Job List onto the new widget, mine is called Transferred Data

Then click Hide Interactions

It should look like this

2.1.6.4 – Job Stats

Lastly we need a widget for the jobs info for some of the remaining metrics, drag a Scoreboard onto the canvas

Click the pencil to edit it

We then need to configure a few bits

• Add a widget name
• Set Refresh Content to On
• Box Columns should be set to 1
• Visual Theme should be set to Pastel

Then click Output Data

Click the +

Search for and click Backup Job States, then expand Properties, from there click Next Run, Repository Name, Session progress Bottleneck and Session Progress Duration and click ok

Double click the Box Label and set a label, change Color Method to None and click Update, then repeat on the rest

I ended up with something like this, then click Save

Now at the top, click Show Integrations

And connect the output from the Veeam Job List to the input on the Job Stats widget

Then click Hide Integrations

Now when we select a job we can see additional information about it
The only thing of note, is the next run doesnt get a value if the job runs only after another

2.1.7 – Managed Server Status

We can define a new view to show what the status of our managed server is, available or not, drag a new Distribution View onto the canvas

Give it a name and set both Refresh Content and Self Provider to On, then click Input Data

Click the +

Then click Veeam/Veeam World/Veeam World and click ok

Then click Output Data

Click the +

Give the view a name, set the Visualization as Donut Chart, set the Distribution Type to Discrete Distribution and click Next

Use the Add Subject drop down to click Veeam/All Managed Servers

On the Selected Subject, click All Managed Servers, then drag Properties/Status over to the middle column and change the Preview Source on the right to Veeam World, we will then see a visual representation of our server status, click Create

Then click Save

The widget should look like this

2.1.8 – Managed Server Info

For some information on our managed servers, drag a List View onto the canvas

Click the pencil to edit it

Give it a name, set Refresh Content and Self Provider to On and click Input Data

Click the +

Click Veeam/Veeam World/Veeam World and click ok

Then click Output Data

Now click the + to create a new view

Give it a name and click Next

On the Add Subject drop down, select Veeam/All Managed Servers

Then click All managed Servers for the Selected Subject, and from the left, drag Type, Is VBR Linux Appliance, Is Backup Server and Credential Storage into the middle box, you can re arrange them in the order you want

When you select a data point in the middle you can change the label on the right, eg I changed Is VBR Linux Appliance to Is VIA, Veeam Infrastructure Appliance

On the far right, if you change the Review Source to Veeam World, we can see the data, there is however, an entry for Veeam World, which we can leave for now, click Next at the bottom

Click Next here

If we look at the Veeam World Filter, and use Properties, VCF Operations Generated Properties/Object Type Classification, Current and Empty, and we refresh the preview, the Veeam World entry is now removed, click Create at the bottom

Then click Save

And we should get a widget that looks like this

2.1.9 – Proxy Info

Drag a List View onto the canvas

Click the pencil to edit it

Give it a name, set Refresh Content and Self Provider to On and click Input Data

Click the +

Click Veeam/Veeam World/Veeam World and click ok

Then click Output Data

Now click the + to create a new view

Give it a name and click Next

On the Add Subject drop down, select Veeam/All Proxies

For the Selected Subject, click All Proxies, then drag Metrics/Server Max Tasks Count and Properties/Type onto the middle section, we can drag to re arrange their order, then if we select an object from the middle area, on the right we can edit the label if needed

On the far right, change the Preview Source to Veeam World and we can see our populated values, we can ignore the Veeam World entry for now and click Next at the bottom

Click Next here

If we look at the Veeam World Filter, and use Properties, VCF Operations Generated Properties/Object Type Classification, Current and Empty, and we refresh the preview, the Veeam World entry is now removed, click Create at the bottom

Then click Save

Our widget should then look like this

2.1.10 – SMTP Info

For a status widget to show the SMTP configuration drag a Scoreboard onto the canvas, click the pencil to edit the widget

Give it a name, then set Refresh Content and Self provider to On, Box Columns to 1 and Visual theme to Pastel then click Output Data

Click the +

Change the Adapter Type drop down to Veeam, then click Email settings and under Properties click Email Settings From, Email Settings To, Notifications Enabled, SMTP Server Name and click ok

Double click the Box Label to change the name and set the Color Method to None and click Update

You can change the order by dragging them around, when you are happy click Save

And you should get something like this

2.1.11 – Restore Points

I added this widget to my VM dashboard, which will have a configuration guide with the main VCF Operations 9 article, but thats not been fully finished as of April 2026

Much like the job list, we have a list of all VMs in vSphere, as we have the relationship in section 1, the below widget can show the Veeam restore points for a selected vSphere VM, if the VM isnt backed up by Veeam, no data is given

Drag a Metric Chart onto the canvas

Click the pencil to edit it

Give it a name and set the Refresh Content to On, Self Provider should be Off, then click Input Transformation

Click Children, the default Depth of 1 will be fine, then click Output Data

Click the +

At the top, change the Adapter Type to Veeam, then click VMware Backup Restore Points and on the left click Metrics/Restore Points Count and click ok

Then click Save

At the top click, Show Interactions

Connect the output from the Powered On VMs list over to the Restore Points widget

Then click Hide Interactions

Now if we select a VM that Veeam is backing up, we can see the number of restore points, if the VM isnt being backed up by Veeam no data is displayed

The dashboard looks something like this

What widgets you have here will depend entirely on what you are bringing in metric wise

For me, this will be based on my Home Assistant management pack bringing data in as a general idea of a dashboard you could create

2.2.1 – Creating The Dashboard

Before we can add any widgets, we need to create the dashboard, to do this, open VCF Operations and click Infrastructure Operations/Dashboard And Reports then click Create

Give it a name and click Save

Now we have the dashboard, click Actions/Edit Dashboard and we can begin adding Widgets

2.2.2 – Smart Plug Power Monitoring

This section will walk you through creating a metric chart for power data being received from my smart plug, I have 5 of these, so we will go through the first and you can create this for any other devices like this you may have

Drag a Metric Chart onto the canvas

Click the pencil to edit the widget

Give the widget a name, set Refresh Content and Self Provider to On and click Output Data

Click the +

Change the Adapter Type to Home Assistant, and find the entry for the endpoint you want to monitor, in my case, the Server Stack Current Consumption, and my power data is under Metrics/State, then click ok

Double click the Unit and add w for watts, then click Update

Then click Save

And you should see a widget like this

One thing I did, was take the three servers making up a cluster, and rather than adding just a single output, the state object, I added the ones for those servers, all into one metric chart

What you can then do is click the eye on the widget and click the first icon on the left, as shown, to combine them into a single chart

You can use the little tab at the bottom to extend it

And if you click any of the entries, they are removed from the chart

I created these widgets for my power stats

2.2.3 – Octopus Power Rates

In this section we will have a look through creating some metric charts for power rates in Octopus

How you put this into your setup will depend on what data you are pulling in

Drag a Metric Chart onto the canvas

Click the pencil to edit the widget

Give the widget a name, set Refresh Content and Self Provider to On and click Output Data

Click the +

Change the Adapter Type to Home Assistant, find the entry for the current rate in Octopus, my rate data is in Metrics/State, click ok

Click Save

Now, this value only changes once per day, click the eye in the top right of the widget, then click the calendar icon, third in on the right, then set the range to Last 30 Days, then click Go

We can hide the bar with the Eye icon, and we can see a fixed 30 days of the rate

We can also use the far left icon to disable the Split Charts option to make it look like this

I then created this set of three widgets

2.2.4 – Octopus Electric Properties

This widget will focus on giving us a properties box with data like my electric rate for tomorrow, tariff type

Add a Scoreboard onto the canvas

Click the pencil to edit the widget

Give the widget a name, then set the following and click Output Data

• Visual Theme – Pastel
• Refresh Content – On
• Self Provider – On
• Box Columns – 2

Click the +

Set the Adapter Type to Home Assistant, I added my Octopus Tomorrows Rate/Metrics/State and clicked ok

I added more properties under Octopus Current Rate/ Properties and selected the Attributes Tariff option

Double click the entry and set the Color Method to None, you could optionally set one which I did for my rate tomorrow, then click Update

Then click Save

The widget should look like this

I did get this error for invalid credentials, click Retry

This is usually caused by an expired root password, we can ssh to the logs server and see if thats the case, for me it prompts me it needs changing, edit this in the node SSH session

You can also set the root password expiry time in the SSH console with

passwd -x <days> root

I opted for this to remove the expiry due to the 90 day password expiry by default, is entirely unnecessary and makes management a massive pain 

passwd -x 9999 root

Now that we have set a new password we must tell the Fleet Management server what it is, head to Fleet Management/Passwords/VCF Management, select the VCF Operations For Logs root credential and click Remediate Password

Enter a new password and click Remediate Password

Heading back to Fleet Management/Lifecycle/VCF Management/Tasks we can click on the failed task

Click Retry

Then click Submit
Your pre populated password should be correct, if not you can click the + and manually add it

If you see this error, where the IP relates to your operations collector, its likely using the wrong credentials, click Retry

This is usually caused by an expired root password, we can ssh to the collector and see if thats the case, for me it prompts me it needs changing, edit this in the node SSH session

You can also set the root password expiry time in the SSH console with

passwd -x <days> root

I opted for this to remove the expiry due to the 90 day password expiry by default, is entirely unnecessary and makes management a massive pain 

passwd -x 9999 root

Now that we have set a new password we must tell the Fleet Management server what it is, head to Fleet Management/Passwords/VCF Management, select the VCF Operations Collector root credential and click Remediate Password

Enter the new password we set and click Remediate Password

We can then head back to Lifecycle/VCF Management/Tasks and click the failed task from the inventory sync

Then click Retry

Then click the Plus

Enter an alias, I recommend a date as I havent figured out how to remove these yet, add the password and click Add

Click x

Then click Select Root Password

And select the new password

Then click Submit

This will often crop up as an error on an upgrade, to address this, in VCF Operations, head to Fleet Management/Lifecycle/VCF Management/Components and select the operations-networks component

We can see the NTP server, which for me, is incorrect as I have changed mine, which explains the error, to change this, click the three dots then click Update NTP Configuration

Click proceed

Click next

Select an NTP server, as I had to redeploy my Fleet Management server, I dont have any, so I will click Add Server

Enter the same NTP server that was used in all other appliances and click Submit

Select the server and click Next

We can optionally edit the priority if we have multiple, when you are happy, click Next

Now click Run Precheck

This should pass with no issues, then click Finish

We need to first log into the server using the support account, this password should be the same as the root password during deployment

Switch to the Ubuntu account with

ub

Then we can check the disk with

df -h

We can see that / is pretty full at ~71%

This is usually caused by an old version from the previous upgrade, we can check this by running

ls -l /usr/share/nginx/upgradebundle

And here we see the old bundle

We then need to remove this with

sudo rm -rf /usr/share/nginx/upgradebundle/<directory-name>

In my case I ran

sudo rm -rf /usr/share/nginx/upgradebundle/9.0.1.24950933

If we re run this command, it should return nothing

ls -l /usr/share/nginx/upgradebundle

I did find this to fail a bit due to this error
This was in another environment and likely isnt your issue, but I have included it for some important troubleshooting steps for determining the root cause, and on the off chance this exact issue is what someone else is having

Opening an SSH session to automation as the vmware-system-user, using the same password as the deployment, we can head to the root user with

sudo -i

And then run

kubectl get bundle -A

We can see this is failing due to my cluster name cant be found, now I renamed this a while back, so I had to change this back to the labelled name

In VCF Ops, leave all values at the default and click Submit

When thats done, head to Binary Management/Patch Binaries and click the trash can by the automation component to remove the download

This must be corrected else the upgrade will fail due to the NSX Edge cluster being in an error state in the SDDC Manager database

We can change the admin password, by opening an SSH session to the Edge with the admin users old credentials, which will prompt us to change it

We can change the root/audit password when logged in as the admin user with

set user <username> password <new-password>

set user root password <new-password>

set user audit password <new-password>

As the default 90 day password expiry is rather unnecessary and makes management much more difficult, we can remove it for all accounts by running

set user root password-expiration 9999

set user audit password-expiration 9999

set user admin password-expiration 9999

We do then need to update everything in VCF Operations with the new passwords that we have set
Head to Fleet Management/Passwords/VCF Instances, expand the VCF Instance, and select the workload domain, in my case Laniakea

Select the credential and click Remediate Password, then enter the password we set the Edge nodes too, in my case I have 2 Edge nodes, each with a root/admin/audit credential which I need to do this for

his will take a few mins for the changes to be completed, but it shouldnt error out
Mine however, did error out, checking the SDDC Manager tasks, the Edge node is not in an active state
At this point, an Inventory Sync with Edge Node import may work, but mine kept erroring out

It turns out, this was also erroring, when checking the database on the SDDC Manager, due to the Edge cluster being in an error state, this was caused by the passwords, but I also cant remediate or correct them on the SDDC Manager, now that I have already changed the NSX Edge node passwords, resetting them again, back to their old value, the one that expired, pulled the cluster into an active state, and for good measure allowed my to remediate the passwords just to be sure the SDDC Manager has the correct details

Needless to say, this is yet another reason to remove the password expiry, the systems ability to deal with them expiring is awful

You will know the Edge cluster is in an active state in the SDDC Manager database, or at least it absolutely should be, when in the passwords section of VCF Operations, all Edge node credentials are in the active state

First, take a backup of ESXi, if the host is an ESXi host on the off chance something goes wrong, we’ll need SSH enabling for this

Select the host and head to Configure/System/Services, click SSH and then click Start, we can leave it enabled as when the host is rebooted, it will stay disabled on reboot

SSH into the host and run
vim-cmd hostsvc/firmware/sync_config
vim-cmd hostsvc/firmware/backup_config

This will give an out put of a URL like this

Take the link and edit the ‘*’ for the hostname/IP 
So my URL would be
http://lab-vvf8-esxi01/downloads/52d067b1-1d69-2bd2-318b-b90ca6f0a521/configBundle-Lab-VVF8-ESXi01.leaha.co.uk.tgz

If you have an DRS rules that prevent hosts from being put into maintenance, then you may need to disable them

Then place the host thats having the firmware update in maintenance mode to do this right click the host and click Maintenance Mode/Enter Maintenance Mode

For vSAN click Go To Pre Check, this wont be available on a cluster with out vSAN

Then click Pre Check

Ensure the check says the host can enter maintenance mode, there may be errors, but thats fine, then click Enter Maintenance Mode

Ensure the box to migrate powered off and suspended VMs is checked and click ok

For Non vSAN it will just look like this, also ensure the box is checked and click ok

If you have Veeam replication jobs running to DR, this shouldnt cause any issues we powered off VMs are also moved, but you can always wait for running jobs to finish and disable them while patching

Its important Dell patches are applied in the right order

• iDRAC
• CPLD – (If Available)
• BIOS
• Everything Else

In OpenManage go to Configuration/Firmware/Driver Compliance

Click Catalog Management

Select your catalog and Check For Update

Ensure any host being updated is in maintenance mode with no active VMs running as reboots are needed for most firmware updates from section 7.1

Go to Devices

Find your host in the list and click it, the IPs are for the iDRAC not the host

Going into Firmware/Drivers we can select the base line for this host using the drop down, ESXi01 and see whats available

Fist, we want to do the iDRAC, so make sure only that is selected and click update like this

Then click Update

You can check running jobs from this icon in the right of OpenManage

This can take 15-20 mins to update, when its done

Then we want to check the CPLD version, OpenManage will not pick up any updates for this, but it will list the version at the bottom

Here we can see my R660 has CPLD 1.2.6

To check the active version Google ‘Dell <Server-Name> Drivers’ and you should see the support page as the first link

Change the OS to Not Applicable, and search for ‘CPLD’, here we can se the latest is 1.2.6, so we dont have one to do

However, if you did have a newer version, you need to log into the iDRAC

This is under Maintenance/System Update, you can upload the CPLD file here by clicking Choose File

Then click Upload

Select the package and click Install And Reboot

In OME, we repeat for the BIOS and click Update
This will reboot the host

Then select the rest and click Update

Ensure any host being updated is in maintenance mode with no active VMs running as reboots are needed for most firmware updates from section 7.1

We then need the HPE SPP, we can find this here
We can also search for the server generation and click the link to it
Eg

Click Obtain Software

And sign in with your HPE account

Open the web console in iLO, click the CD icon then CD/DVD/Local *.iso File

And double click the ISO file

Reboot the host OS, momentary press will do this from the left mot icon in the web console, or you can reboot the server from the guest OS

Press F11 here to enter the one time boot menu

Select the iLO virtual Media

Then automatic updates

This can often take ~90 mins to complete and do not interrupt the server, when its done, your host OS will be booted

You will want to give this about a good 20-30 mins after the vCenter has been upgraded for the ESX agent to be upgraded

In vSphere, click the three lines in the top right, then click Supervisor Management

Click Updates and here we can see all updates, we can select a newer versions of the current K8S stream, in my case v1.31.x, but I am going to upgrade to the latest release, which I normally recommend anyway, which is 1.32.9
Select the supervisor with the radio button, ensure the right version is selected with the drop down and click Apply Updates

Then click Proceed

The supervisor features always warns here, and I have never seen it cause an issue, but in production environments asking Broadcom support if in doubt is a good idea
When you are happy, click Next

Click proceed

Then click Finish

This will iteratively replace all the supervisor control plane nodes with new ones as it upgrades the cluster, then place the hosts into maintenance mode and install the new VIBs, this can take a couple of hours, especially depending on the number of hosts in the cluster

We need to get the latest version from the Broadcom portal, on My Downloads, click the HERE link on free downloads

Scroll down and click the vSphere Supervisor Services

Expand the Local Consumption Interface and click the latest release, in my case 9.0.2

And download the YAML

In vSphere click the three lines and click Supervisor Management

Click Services, and on the Local Consumption Interface click Actions/Add New Versions

Click Upload

Then double click the YAML

Then click Finish

Now on the Local Consumption Widget, click Actions/Manage Service

Select your supervisor and make sure the new version is selected from the drop down, in my case 9.0.2, and click Next for the pre checks to complete

When they are finished, like this, click Next

Then click Finish

We need to get the latest version from the Broadcom portal, on My Downloads, click the HERE link on free downloads

Scroll down and click the vSphere Supervisor Services

Expand the vSphere Kubernetes Service and select the latest release

And download the YAML

In vSphere click the three lines and click Supervisor Management

Click Services, and on the Kubernetes Service click Actions/Add New Version

Click Upload

And double click the YAML

Then click Finish

Then on the Kubernetes Service widget, click Actions/Manage Service

Select the supervisor using the radio button, and ensure the drop down has the latest version, then click Next for the pre checks

When thats run fine, click Next

Then click Finish

When the VM or physical server has booted, you’ll need to be able to get to the console 
From there, press Tab till you land on Accept and hit Enter to accept the EULA

Enter a hostname and press Enter on Next

On the adapters screen you likely have just the one, VBR should be a VM, press Enter on Static
If you are deploying this on a physical server and want network redundancy look at the configuration of the backup repository in section 2.9.3, its the same here

Enter the IPv4 address, subnet mask, then add DNS, comma separated and press Enter on Apply

Here when selecting the adapter, you should see the assigned IP address below

You can also run a ping test to verify the IP address is reachable
When you are happy thats reachable, press Enter on Next

If you want to change the NTP server press Enter on Edit

Enter the NTP server and press Enter

You can optionally add more with the Add button, or press Enter on Next when you are done

We then need to set password requirements, this needs to be 15 characters, there is also a link to the requirements here

Once you have your password set, press Enter on Next

We then need to setup MFA, press Enter on this pop up screen for the QR code to add to your authenticator app
You can press Enter to dismiss the QR code

Enter the OTP code and press Enter on ok

Then press Enter on Next

Optionally, setup a security officer account, I dont really need this, so I am skipping it and pressing Enter on Next

Check you are happy with the summary and click Finish

When, all the services have restarted, you should see this and we can access the WebUI

We have the WebUI on port 443 and the management on 10443
And we can use the veeamadmin credentials to login

Id recommend adding this to the VBR Management server, but its also required for Veeam ONE
Log into the management interface on 
https://fqdn:10443
And log in with the veeamadmin account

If you setup HA later on in this guide, you’ll need to do this on the secondary HA VBR server

Click Network and under Additional DNS Suffixes click Configure

Click Add

Enter the DNS search domain and click Add

Then click Apply

As of 13.0.1, not all VBR functionality is available within the WebUI, and the console is required for some configuration, this can be installed on any Windows Server/PC you want to be able to access VBR on

We can find the download link by going to the WebUI for VBR and click the link under the login to download the console

Double click the exe
You may need to run this as an administrator

Accept the EULA by clicking I Accept

A system configuration check will run, wait for this to finish

When thats done, click Install

When thats done, click Finish

Before we start, VBR needs to be able to connect to any Windows servers via the ADMIN$ share, and the default is for the Windows firewall to block it
This is needed for Windows Proxies, as of 13.0.1 in November 2025, the Linux proxies cannot do application aware processing on Windows servers, so a Windows proxy is required

Search for and open the Windows defender Firewall With Advanced Security

Right click Inbound Rules and click New Rule

Select Port and click Next

Select TCP and enter the ports
135,137-139,445
And click Next

Make sure you have Allow The Connection selected and click Next

Apply this to all and click Next

Name it, including TCP and click Finish

Right click the rule and click Properties

Click Scope, and under Remote IP addresses check These IP Addresses and click Add

Add the IP address of VBR and all proxies, if you have VBR HA, add both VBR server and the VIP, when we set them up later we can come back and edit the GPO, then click ok

And click ok again

Repeat for a new rule but selecting UDP instead of TCP

It should then look like this

We will need to add our license before we can setup HA, dont worry if you are planning to use Enterprise Manager for licensing
If you arent setting up HA and want to use Enterprise Manager, skip this section

We first need our license, and this can be downloaded from your myveeam page here

Then log into the web portal on the first VBR server, what will be the primary, you cna access this on
https://fqdn

Then log in with the veeamadmin credentials you should see this prompt, click Install

Double click your license file

You may see this, click Yes, these are usually just OS security updates, services will be restarted as needed, but as we have no jobs configured, this is fine

As we dont want to join servers to AD, the recommended way to add Windows servers is by the Veeam Deployment Kit, this uses certificate based authentication and is the recommended way of adding Windows Servers in VDP 13

We first need to create a deployment kit, log into the VBR WebUI and click Manager Servers and then Create Veeam Deployment Kit on the right

Save the zip folder and copy it to the Windows server you want to use add to Veeam
On the Windows server, right click the Zip folder, and click Extract All

Then click Extract

Right click on the bat file and click Run As Administrator

Click Run, then wait for the cmd prompt to close

By default, the configuration goes to the local default backup repository, now we have an external hardened repository, we need to move it there

We need to connect to this VBR server with the remote console we setup earlier
Enter the server FQDN and click Connect

Click Yes to trust the server

Enter the veeamadmin credentials and click Sign In

In the top left click the three lines and click Configuration Backup

Use the drop down to set this to the immutable repository

At the bottom enable configuration backup password and click Add

Set something secure, and ensure you dont forget it, then click ok

Then click ok

To start with, we will need a second VBR server, setup like the first, but dont add any of the other components, like the repository or managed servers, on a different FQDN and IP

On our first VBR server, log in with the veeamadmin account on the management interface on
https://fqdn:10443
Click Backup Infrastructure then under High Availability, click Submit Request

We will need to repeat this for the other, secondary, blank VBR server

This must be approved by the security officer, if you didnt configure one, like me, its auto approved, it should show up like this

We then need to connect to this VBR server with the remote console we setup earlier
Enter the server FQDN and click Connect

Click Yes to trust the server, if you get the popup

Enter the veeamadmin credentials and click Sign In

We first need to remove the local backup repository, on the bottom left, click Backup Infrastructure, then Backup Repositories, select the Default Backup Repository and click Remove Repository

Click Yes

Wait while it is removed

Now Click Managed Servers/Linux, click the VBR server and click Create HA Cluster

Add the cluster DNS name, in FQDN format, and a VIP address, this should be registered in DNS, then click Next

Use the drop down to select the primary node, it should be the only one there, and enter the IP address for the second VBR node, then for credentials, click Add

Then enter the credentials for the veeamadmin user on the second blank VBR server and click ok

Then click Next

Click Continue on the certificate alert

Then click Finish

Then we wait for the configuration database for the HA cluster to be created
When thats done, click Close

To connect to the HA cluster, we can close the console and reconnect to the cluster FQDN instead, same with the UI on port 443

To get this click this direct download link here

For the hypervisor, this example will be done in VMware
We need to right click the cluster and click New Virtual Machine

Click Next

Enter a VM name and optionally select a VM folder, then click Next

For the computer resource, select the cluster and click Next

Select a shared datastore then click Next

Select the VM compatibility and click Next

The guest OS type must be the Linux family and for the OS version, Rocky Linux, then click Next

For the spec, this should have 8vCPU, 16GB RAM and 2x240GB disks, ensure you change the Disk Provisioning to Thin in VMware
Veeam’s documentation on the spec can be found here

Now, for the ISO you’ll need that uploaded to a datastore or content library, expand the CD/DVD drive and use the drop down to select the option matching your environment, in my case its a Datastore ISO File

Browse to the ISO and click ok, then check the Connect At Power On button and click ok

Then click ok

Make sure you are happy with the config and click Finish

Then, select the VM and click Power On

On the VM console, press Enter on Veeam Backup Enterprise Manager

Press Enter on Install

Click Yes here and the install will automatically start

Wait for the install to complete and the server to boot and load the initial configuration wizard, here press Tab to select Accept and press Enter

Enter a hostname and press Enter on Next

For the network adapter, press Enter on Static

Enter the IPv4 address, subnet mask, gateway and DNS servers, comma separated and press Enter on Apply

Then press Enter on Next

To change the NTP server, press Enter on Edit

Enter an NTP server and press Enter, I am using Cloudflare, but you likely have one on prem

You can optionally use Add for additional server, when you are done press Enter on Next

We then need to set password requirements, this needs to be 15 characters, there is also a link to the requirements here

Once you have your password set, press Enter on Next

We then need to setup MFA, press Enter on this pop up screen for the QR code to add to your authenticator app
You can press Enter to dismiss the QR code

Enter the OTP code and press Enter on ok

Then press Enter on Next

Optionally, setup a security officer account, I dont really need this, so I am skipping it and pressing Enter on Next

Check you are happy with the summary and click Finish

When, all the services have restarted, you should see this and we can access the WebUI

We have the WebUI on port 443 and the management on 10443
And we can use the veeamadmin credentials to login

We will need to apply the DNS suffix like we did for VBR in section 2.3

We first need our license, and this can be downloaded from your myveeam page here

Log into the VEM server with the veeamadmin account and click Configuration in the top right

Under Licensing, click Install License

And double click your license file

Click Yes here

Log in to VEM with the veeamadmin account and click Configuration in the top right

Then click Backup Servers/Add

Enter the VBR FQDN and enter the veeamadmin username/password, optionally add a description and click ok
Its important for a VBR HA cluster you add the cluster DNS entry

Click Yes to trust the certificate

Now we need to wait ~10 mins for everything to sync

We will also be domain joining this as it is significantly less secure

To get the installer head here and click Download on Veeam ONE 13, you will need a valid Veeam login for this

On the Veeam ONE server, double click the ISO

Double click the Setup.exe file

Click Install

Click Install Veeam ONE

Click I accept to accept the EULA

We need to add our license, you can sign in with Veeam or Browse to the file

For a file, find it and double click it

Then click Next

Use the default administrator account for the service account, enter that users password and click Next

A system configuration check will then run

You may see an error like this, its often caused by pending windows updates, as my template is outdated, applying all Windows updates and rebooting, then retrying the installer has always fixed this for me

When the precheck is done click Install

When its done, click Finish

Then click Yes, you will need to log back in

By default, the version of SQL Express thats installed is the RTM version of 2017, so this needs updating to the latest version

As of December 2025 the latest is CU31 build 14.0.3515.1, which we can get here

For a list of all updates, Microsofts own KB is out of date listing the March 2025 release as the latest, however this site has a much more up to date list of all patches which is here

If we scroll down, we can see it in Method 3 for obtaining the release, and click Download The Package Now

Then click Download

Double click the exe

Accept the EULA and click Next

Click Next

Wait for the check and click Next

Click Update

When its done, click Close

Before we can add anything we need to allow data collection in the host management page
For a VBR HA cluster, repeat this on both individual nodes, starting with the primary

Log into the host management portal on
https://fqdn:10443

And click Backup Infrastructure, then under Data Collection, click Submit Request

And the same on VEM

There is a known limitation that prevents the automated install by Veeam ONE to Linux server managed by VEM, which we have, Veeams documentation can be found here

But the limitation is
[For Linux servers] Veeam Analytics service cannot be automatically installed on Veeam Backup & Replication servers managed by Enterprise Manager
You must install Veeam Analytics service on such servers in Veeam ONE Web Client or manually

So, we will be installing this manually on both VBR HA nodes and VEM first

Open the Veeam ONE WebUI on
https://fqdn:1239

Login with the local Administrator account
The format for the username should be servername\username
Eg

Click ok here

Optionally skip the Welcome walk through, if you are new you should have a look though this

The default screen will be blank, click the Settings Cog in the top right

Click Data Collection/Overview/Veeam Analytics Service/Download Package/Linux

Save the .bndl file

We will need to repeat this all the nodes, both VBR and the VEM server
Log into the admin portal on 
https://fqdn:10443

My server is throwing an error connecting to updates but it seems intermittent so I am not 100% what is causing this, if yours is contact Veeam support

Click Updates and at the bottom click Upload A HotFix

Click Browse

Double click the bundle file

Then click Upload

Then click Install Now

For VBR, click Next here, this warning is to say this needs doing on both nodes in the HA cluster

When its done it will look like this, click Finish

In Veeam ONE, if you have been logged out, you can get back to where we downloaded the package by clicking the Settings Cog in the top right

Click Data Collection/Overview/Data Source/Add Server

Click Veeam Backup And Replication

If you have VEM, enter the FQDN and select the server type as Enterprise Manager, if you dont have this, enter the VBR FQDN, for standalone VBR, if you have a HA cluster, use the cluster FQDN
In my case, I am using the VEM FQDN, which has my VBR HA cluster added
When you are happy click Next

Click Add Credentials

Click ok here

Select Standard Account and click Next

Enter the veeamadmin credentials and a description, then click Finish

Click Next

For the certificate, click Trust And Continue
there may be a few of these

When thats done, click Finish

Give VeeamONE plenty of time, as we manually installed the agents, we may see duplicated entries in the Data Collection menu, it will sort them out

When its done it should look like this, the secondary node will be unhealthy as only the active node will be sending metrics

If you fail over it will look like this, I had a ghost entry for the secondary server that wouldnt disappear, but it isnt an issue, the primary is unhealthy as its now not sending metrics, which is expected

We first need a VM with the following specs, running Windows Server 2022/2025

• 6vCPU
• 24GB RAM
• 180GB Disk

We then need to get the VRO ISO, we can find Veeams latest releases here

We then need to scroll down and find the Veeam Recovery Orchestrator section and click Download

Double click the Veeam Data Platform Premium ISO

Double click the Setup.exe application

Click Install

Then click Veeam Data Platform 13 – Premium Edition

Accept the EULA by clicking I Accept

Click Next

We can either sign in with Veeam or manually upload our license file, for the latter, click Browse To Local File

Double click the license

Then click Next

Enter the details for the service account, the default administrator is fine for this, then click Next

Wait for the system configuration to pass

Then click Install

When its done click Finish

Then click Yes to reboot

By default, the version of SQL Express thats installed is the RTM version of 2017, so this needs updating to the latest version

As of December 2025 the latest is CU31 build 14.0.3515.1, which we can get here

For a list of all updates, Microsofts own KB is out of date listing the March 2025 release as the latest, however this site has a much more up to date list of all patches which is here

If we scroll down, we can see it in Method 3 for obtaining the release, and click Download The Package Now

Then click Download

Double click the exe

Accept the EULA and click Next

Click Next

Wait for the check and click Next

Click Update

When its done, click Close

Much like Veeam ONE, we need to allow data collection in the host management page
For a VBR HA cluster, repeat this on both individual nodes, starting with the primary

Log into the host management portal on
https://fqdn:10443

And click Backup Infrastructure, then under Data Collection, click Submit Request

And the same on VEM

We can now access the VRO WebUI from
https://fqdn:9898
And login with the Windows administrator account

Fill in the server details on the initial configuration wizard, you can add what you like here, then click Next

We then need to add administrators for VRO, click Add

We can add users or groups from the local server, I am going to add the local administrators group, and click Add

Then click Apply

We then need to add our VBR instance, on the Connect Veeam Backup And Replication Servers, click Deploy

Click Deploy Agent/Linux

If you have VEM, select that, if not use VBR, if you have HA without VEM, ensure you add the cluster FQDN in
Then by Credentials, click Add

Enter the username/password for the account you are trying to add, in my case, its the VEM server, and click Add

Select the credential below and click Apply

Click Apply again

For any certificate pop ups, click Remember And Continue

Then click Apply

Click Next here

And click Finish

You may see VBR with the install failed error when adding VEM
To fix this, click the VBR instance and click Repair Agent

You may need to specify additional credentials if they are different to VEM

And accept the certificate, this is what caused the failed install error

When its done it should look like this, and for HA clusters, you’ll see both nodes

First shut down the VEM VM and take a snapshot, then power it back up

We then need to download the VBR ISO which we can find here, and its this link we need

Double click to mount the ISO

And double click the Setup.exe

Click Upgrade

Click ok here for VBR to install the required .NET files

Click Upgrade Veeam Backup Enterprise Manager

Accept the EULA

Your license should be automatically populated, then click Next

Wait for the configuration check to pass

Once thats run, click Upgrade

When its done click Finsh

And then Yes to reboot

To upgrade the vCenter plugin, log into the vEM web UI and click Configuration on the right

Click vCenter Servers, then select your install vCenter, like mine, Borealis, and click Remove

Click Yes

You should see this banner in vCenter

Then in VEM, click Install on the vCenter

And in vCenter you should see this banner