WEBVTT 00:00:00.160 --> 00:00:04.400 Welcome back to vSphere 8 in the real world. Now we're going to discuss advanced host management. 00:00:06.800 --> 00:00:10.960 So we're going to discuss host profiles. Host profiles are actually a pretty cool thing. 00:00:10.960 --> 00:00:18.400 It allows us basically to create a file, a configuration of what our ESXi host should look 00:00:18.400 --> 00:00:23.360 like, what you know configurations they should have, and then I can apply that configuration 00:00:24.480 --> 00:00:29.200 to either an individual host, I can apply it to a cluster of hosts, I can apply you know to 00:00:29.200 --> 00:00:35.840 different places. Now if I am applying a configuration or a host profile to a host, 00:00:35.840 --> 00:00:40.959 I can obviously configure everything in that profile including IP addresses and things like 00:00:40.959 --> 00:00:49.840 that. If I want to apply a host profile to a cluster, I can configure a lot of things. Like 00:00:49.840 --> 00:00:54.959 I can configure for example my networking. I can say I want you know the port groups to be exactly 00:00:54.959 --> 00:00:59.919 like this. I want my physical NICs to be attached to these port groups. I want my first you know 00:00:59.919 --> 00:01:05.279 physical NIC applied to you know this port group and my fourth one applied to this port group and 00:01:05.279 --> 00:01:10.320 I want this failover order and these VLAN tags, all that kind of stuff right. And storage, I want 00:01:10.320 --> 00:01:14.959 to connect to this data store. I want to connect to you know this storage array and then mount this 00:01:14.959 --> 00:01:19.680 data store so I can see the VMs on there. You know things that are going to be the same across 00:01:19.680 --> 00:01:24.800 all the hosts I would configure. Things that I wouldn't want to attach to a host profile 00:01:24.800 --> 00:01:29.760 if I'm going to attach it for example to the cluster is I don't want all my host names exactly 00:01:29.760 --> 00:01:33.760 the same thing. I don't want them all to have the exact same IP address. I want their IP addresses 00:01:33.760 --> 00:01:39.120 to be unique. Some things like that. So unique things that identify an individual host like 00:01:39.120 --> 00:01:47.360 IPs and names I wouldn't want to assign to my host profile. So I can you know attach it to 00:01:47.360 --> 00:01:52.800 the cluster and then when I attach you know say I want to apply to a VM or not to a VM sorry to a 00:01:52.800 --> 00:01:59.519 host, I would then you know identify the unique things for that particular host like IPs and names 00:01:59.519 --> 00:02:04.400 all right. So I can make a host profile really easy. What I'd want to do is go in there and I'd 00:02:04.400 --> 00:02:13.119 want to configure a ESXi host to exactly the way I want it configured. I want to you know configure 00:02:13.119 --> 00:02:19.759 my virtual networking, attach to all my data stores, any advanced settings I want to have 00:02:19.839 --> 00:02:24.240 be across all my hosts. I go to my advanced settings and you know configure all those things. 00:02:24.240 --> 00:02:29.679 I would do everything. Then I go to that host that I've just configured perfectly and I can right 00:02:29.679 --> 00:02:34.479 click on it go to my host profiles and I can say I want to extract from that host a host profile. 00:02:34.479 --> 00:02:40.639 Then it'll be my vCenter server. Then I can go to my cluster or to another cluster in my 00:02:40.639 --> 00:02:45.039 environment and I can attach that host profile or I can attach it to a host specifically 00:02:45.600 --> 00:02:51.759 and apply that host profile and the host in that cluster would all be configured the same. I need 00:02:51.759 --> 00:02:56.399 to remediate and say you know is this configured correctly. It'll tell me here's all the things 00:02:56.399 --> 00:02:59.919 that aren't right. You're missing this port group. You're missing this VM kernel configuration. 00:02:59.919 --> 00:03:03.119 You're missing this data store. Here's the things you're missing. Here's the advanced 00:03:03.119 --> 00:03:08.960 setting you didn't configure and I can say all right yep I see that remediate. Another remediation 00:03:08.960 --> 00:03:13.600 will take place and I might end up having to reboot my host you know a time or two but then 00:03:13.600 --> 00:03:19.119 it'll come up with all that. The advantage of doing that is let's say down the road I end up 00:03:19.119 --> 00:03:22.559 wanting to make a change. I want to add just something simple. I want to add another data 00:03:22.559 --> 00:03:30.240 store to 30 hosts. I don't have to go in and touch 30 hosts and add a data store to 30 hosts. 00:03:30.240 --> 00:03:36.000 I can go into my host profile. I can add it to the host profile and then when I say to you know 00:03:36.000 --> 00:03:41.679 compare and then remediate all the hosts in that cluster will get that new host profile right and 00:03:41.679 --> 00:03:45.039 that means they'll get or not the new host profile update host profile and then they'll get 00:03:45.039 --> 00:03:51.679 the data store right. So it allows me to you know make changes to a configuration in mass and 00:03:52.320 --> 00:03:58.479 probably maybe even more importantly though is that it allows me to keep a consistent configuration 00:03:58.479 --> 00:04:04.399 across the board. So if I have a for a company and they have compliance needs and part of my 00:04:04.399 --> 00:04:09.119 compliance needs are I need to make sure that certain advanced configurations are turned off 00:04:09.119 --> 00:04:16.480 or certain ones are on or I have certain values for certain things and I just need to ensure a 00:04:16.480 --> 00:04:22.559 consistent configuration through my environment then when I get audited I can say okay how do 00:04:22.559 --> 00:04:29.359 you ensure that you know these settings are applied to all your ESXi hosts. I can say I 00:04:29.359 --> 00:04:33.359 have a host profile configured. That setting is in the host profile. I can show them the host profile. 00:04:33.359 --> 00:04:37.679 I can show them the setting. I can show them that this profile is attached to this cluster. 00:04:37.679 --> 00:04:44.239 All the hosts are in this cluster and I can show them that when I do a validation that they 00:04:44.239 --> 00:04:50.480 all show up compliant right. So you can show documented what your configurations are and you 00:04:50.480 --> 00:04:55.920 have a way of enforcing that configuration and verifying the configuration has been enforced. 00:04:55.920 --> 00:05:00.399 So for compliance purposes that's really really important. So host profiles can solve a lot of 00:05:00.399 --> 00:05:04.320 things. They can make your administrative tasks easier. They can help you ensure compliance. They 00:05:04.320 --> 00:05:13.440 can help you prove compliance okay. So host profiles new installations of you know of similar 00:05:13.440 --> 00:05:20.239 hosts again this is important like you may have for example a bunch of hosts that are let's say 00:05:20.239 --> 00:05:24.880 they're a bunch of Dell servers and they're the exact same Dell server. You have another cluster 00:05:24.880 --> 00:05:30.959 and the other cluster is a bunch of HP servers and the Dell servers have six network adapters and 00:05:30.959 --> 00:05:37.839 you know four of them are 10 gig and two of them are one gig. But your HP servers actually have 00:05:38.480 --> 00:05:44.079 eight NICs and there's four one gigs and there's four 10 gigs in there. So you'd have a different 00:05:44.079 --> 00:05:49.600 configuration for your network adapters to your virtual switches for your HP services because of 00:05:49.600 --> 00:05:54.559 the number of NICs they have versus your Dell servers. There may be other things about those 00:05:54.559 --> 00:05:59.200 HP servers that are different than your Dell servers and so you would need a different host 00:05:59.200 --> 00:06:04.880 profile because the configurations are different. So I can create one configuration or one you know 00:06:04.880 --> 00:06:10.160 host profile for that group of Dell servers and I can create another one for my HP servers. 00:06:10.160 --> 00:06:14.959 Now it doesn't have to be based upon HP and Dell. I could have just one model of Dell with a 00:06:14.959 --> 00:06:20.239 certain network card configuration and I have a different set of Dells again but with that 00:06:20.799 --> 00:06:25.519 you know with a network configuration that's different than the older generation for example 00:06:25.519 --> 00:06:31.040 maybe. Maybe the older ones are a bunch of one gig NICs and my newer ones have fewer NICs but 00:06:31.040 --> 00:06:35.600 there's a bunch of 10 gigs. Something like that maybe right. So you can based upon things like that 00:06:36.720 --> 00:06:40.880 you might have a different host profile based upon the configuration of the hardware. Things 00:06:40.880 --> 00:06:45.519 like that can be can be the case. So this will allow you to create different profiles for different 00:06:45.519 --> 00:06:51.519 sets of hosts with different configurations and allows you to again ensure consistent 00:06:51.519 --> 00:06:58.000 configurations across the board for all the hosts in that cluster okay or you know individual hosts 00:06:58.000 --> 00:07:02.079 too. It can't be done on individual hosts. All right it allows you to again maintain compliance and 00:07:02.079 --> 00:07:09.279 making control of your environment. So a recommended procedures is track the host configurations 00:07:09.839 --> 00:07:15.440 and the profile value. So you're going to keep track of what's in there obviously. You might 00:07:15.440 --> 00:07:19.839 have you know permission set so that only a couple of different admins are allowed to even look and 00:07:19.839 --> 00:07:24.480 make changes to those profiles. Maybe you have six admins that can look at them and help you 00:07:24.480 --> 00:07:28.959 ensure nothing's changed or check the values but only two can make changes or something like that 00:07:28.959 --> 00:07:35.119 okay. Make incremental changes to your host profiles. So as small things come along oh we 00:07:35.119 --> 00:07:38.959 need to add a data store. I can make a small change and add that. Even if you have a reason 00:07:38.959 --> 00:07:44.559 to make a bunch of changes at once like oh this big infrastructure change has just happened 00:07:44.559 --> 00:07:49.279 and now we've got several data stores and we need some more port groups and we need and we need 00:07:49.279 --> 00:07:56.000 right. I wouldn't recommend going in and making all those changes the host profile in one big swoop 00:07:56.000 --> 00:08:02.559 and pushing them out to all your hosts. I would suggest making one of the changes first. Maybe you 00:08:02.559 --> 00:08:06.640 update your networking first and then you push that out and you test it and yep everything's 00:08:06.640 --> 00:08:10.959 good. Everything still works. We have a good functionality. Then you add the data stores 00:08:10.959 --> 00:08:14.959 and then you push that out and okay yep everyone sees the data stores. The network's still working. 00:08:14.959 --> 00:08:19.359 We tested that already and now we see the data stores in all the hosts. Everything's good there 00:08:19.359 --> 00:08:23.760 and then your next change and the reason why I don't recommend doing one big push doing small 00:08:23.760 --> 00:08:28.160 incremental changes along the way maybe like one day and a few days later doing the next one kind 00:08:28.160 --> 00:08:33.359 of thing is what if you make changes to your networking and data stores and something else 00:08:33.359 --> 00:08:37.679 and then you push it out and the network is not working or I'm sorry the storage isn't working. 00:08:37.679 --> 00:08:42.400 You can't see your storage or you lost the data store along the way. Did your storage 00:08:42.400 --> 00:08:46.400 configuration changes cause that problem? Did the networking changes cause that problem? Was there 00:08:46.400 --> 00:08:51.919 something else in your configuration that caused that problem? So make small incremental changes. 00:08:53.359 --> 00:08:58.000 That's normally how it's going to happen anyway. Most of the time you make a small change 00:08:58.000 --> 00:09:01.520 somewhere and you need to make that change on your host but if there is a reason to have a 00:09:02.159 --> 00:09:06.640 larger number of changes still push them out incrementally to give you the ability to more 00:09:06.640 --> 00:09:10.799 easily troubleshoot what the problem is. If you make five changes at once and then things break 00:09:10.799 --> 00:09:16.000 what's one of those five changes cost your problem right incremental changes. Stem size your 00:09:16.000 --> 00:09:21.039 environment make you know make a host profile and make sure all your hosts configure the same. 00:09:21.039 --> 00:09:25.599 If you have you know four hosts and four of them are working you know three more working great 00:09:25.599 --> 00:09:30.320 one's not and you can figure them all manually. Did you type something in wrong? Is there a hardware 00:09:30.320 --> 00:09:35.919 failure? What's causing that problem? If you're using host profiles then most likely the configurations 00:09:35.919 --> 00:09:41.359 are all identical so we can maybe now look at is there a hardware failure or something like that in 00:09:41.359 --> 00:09:48.159 the environment right. Group hosts into a single profile based on similar hardware. So like I 00:09:48.159 --> 00:09:53.679 mentioned earlier if we have you know one generation of DELs that have a certain network 00:09:53.679 --> 00:09:58.159 configuration and certain memory configurations and things like that put that into one group and 00:09:58.159 --> 00:10:04.559 then another group would be for you know a new batch of DELs. These new batch of DELs have 00:10:04.799 --> 00:10:11.119 you know 10 gig NICs or 25 gig NICs and it has fewer adapters but there's faster faster ones 00:10:11.119 --> 00:10:16.320 you know any kind of change that would be unique in that host profile that would be into a 00:10:16.320 --> 00:10:21.200 different group and your groupings would be clusters there right. So and then ensure your 00:10:21.200 --> 00:10:25.280 ESX host capacity is sufficient so they can handle whatever kind of maintenance you're putting in 00:10:25.280 --> 00:10:30.640 there. What that means is when I'm applying host profiles the hosts might need to reboot. We're not 00:10:30.640 --> 00:10:34.719 going to apply it to 30 hosts all at the same time and have all 30 reboot. I'm going to say apply 00:10:34.719 --> 00:10:39.440 to these 30 hosts and it's going to go through and apply it to one or two or three at a time 00:10:40.239 --> 00:10:46.799 and reboot them. So I need to be able to evacuate the VMs off of at least one of my hosts to apply 00:10:46.799 --> 00:10:52.000 that profile if a reboot's necessary. Then you know the next the next if I can do two or three 00:10:52.000 --> 00:10:57.840 at a time I can afford to evacuate two or three at a time the other 27 of my 30 can handle that 00:10:57.840 --> 00:11:03.760 great. If all your hosts are completely maxed out and I can't move VMs off of any of my hosts 00:11:03.760 --> 00:11:07.520 I might not be able to efficiently apply my host profiles and obviously right. 00:11:10.479 --> 00:11:14.799 So here we're seeing an overview so I create a host profile I went to I create you know my 00:11:14.799 --> 00:11:21.039 my golden host I did my configuration I extracted my host profile and I'm going to attach that host 00:11:21.039 --> 00:11:25.760 profile either to the cluster which would then make it apply to all the hosts in the cluster 00:11:25.760 --> 00:11:32.080 or I can attach it to an individual host okay. In order to create the profile I'm just going to 00:11:32.080 --> 00:11:36.479 choose my host that I've configured that's perfect I'm going to right click on it I'm going to go to 00:11:36.479 --> 00:11:41.039 host profiles I'm going to say I want if I'm going to create what I want to extract the host profile 00:11:41.039 --> 00:11:46.479 from that golden image I can also import a host profile meaning I've already done the extraction 00:11:46.479 --> 00:11:50.400 from somewhere else and now I'm going to go to a different vCenter maybe for example and I'm going 00:11:50.400 --> 00:11:56.400 to import that image into it. So these I have a vCenter that is my prod and I have a separate 00:11:56.400 --> 00:12:03.840 vCenter for my my test dev and the hardware is the same in both which is ideal for you know 00:12:03.840 --> 00:12:11.039 a test of environment to have the same environment as your production is. I can create my my golden 00:12:11.039 --> 00:12:17.440 image in my test dev and I can create those profile I can do all my testing on there yep 00:12:17.440 --> 00:12:22.080 storage works networking works VMs are functioning properly communication on the network is good 00:12:22.080 --> 00:12:27.440 all these things are good then I can extract it out of that particular vCenter import it into the 00:12:27.440 --> 00:12:33.760 other vCenter that's my production with this tested host profile and just deploy it out to 00:12:33.760 --> 00:12:37.919 those hosts in production right. I might want to deploy it out to one or two to start with and just 00:12:37.919 --> 00:12:42.400 do another test in production and then say okay yep I'm going to deploy it everywhere 00:12:42.960 --> 00:12:47.760 right so import it in or extract it out some of how you're doing that select the reference host 00:12:47.760 --> 00:12:51.520 that you want to extract if you're doing an extraction and then give your profile a name 00:12:51.520 --> 00:12:54.640 just give it a few minutes it'll extract it out and then you'll find it in vCenter. 00:12:56.640 --> 00:13:02.799 So then once we create it we can go in and we can say we want to attach a host profile so for that 00:13:02.799 --> 00:13:08.159 we would go for example to our cluster we'd go to configuration we go to host profiles and then we 00:13:08.159 --> 00:13:12.320 could say we want to attach a host profile to this cluster and then we have the option of doing 00:13:12.320 --> 00:13:18.799 things like want to verify if it's compliant it will host a compliant find out what's not compliant 00:13:18.799 --> 00:13:23.599 and then do we want to remediate that we want to apply the host profile to those hosts in that 00:13:23.599 --> 00:13:30.159 cluster okay. So editing the settings if you want to edit the settings of a host profile 00:13:31.119 --> 00:13:35.679 we're going to go to our little our little you know Big Mac icon in the corner and then we have 00:13:35.679 --> 00:13:39.840 policies and profiles click on that then you'll go down to host profiles and you'll see all the 00:13:39.840 --> 00:13:47.359 host profiles you have created in there maybe we have host profiles already created that we've but 00:13:47.359 --> 00:13:51.359 we want to make some tweaks or some changes to that we can actually just copy them from right 00:13:51.359 --> 00:13:55.440 there too and then go to that copy and make whatever changes that will be applicable to where 00:13:55.440 --> 00:14:00.479 we want to apply it to maybe you know we have these two to the host they're basically identical 00:14:00.479 --> 00:14:04.960 they're you know this cluster a and cluster b have almost the exact same hardware the difference is 00:14:04.960 --> 00:14:10.000 the network cards in a cluster b are slightly different but I configured a exactly how I want a 00:14:10.640 --> 00:14:15.679 I export it I can make a copy for that maybe I change the name for you know the cluster b or 00:14:15.679 --> 00:14:21.840 something and then I make the changes to the networking and then I can attach it to cluster b 00:14:21.840 --> 00:14:26.799 and cluster b have a different host probably profile than a but I use a as the the template 00:14:26.799 --> 00:14:31.679 to get started with because again they're almost identical right so that's some of the things we 00:14:31.679 --> 00:14:38.479 can do there too so um so an example we can go in there to that host profile like I said after 00:14:38.479 --> 00:14:42.880 you've gone to our big mac and gone to our policies and settings gone to those profiles 00:14:42.880 --> 00:14:47.440 and we can just choose the host profiles that we want to edit it right we can just even just look 00:14:47.440 --> 00:14:51.679 at the settings that are in there then and say okay yeah the networking is what I want 00:14:51.679 --> 00:14:57.599 my vm network is the way I want and my custom port groups for my vm kernels these are what I want 00:14:57.599 --> 00:15:01.599 these are the network cards attached to them that's what I'm looking for you know my advanced 00:15:01.599 --> 00:15:06.159 configurations that's what I'm looking for we verified it's all good and we can make changes 00:15:06.159 --> 00:15:10.799 as we need to along the way too right and then we can apply save and apply those changes if I 00:15:10.799 --> 00:15:16.320 made any that I like them okay so then we're going to go through and check compliance right 00:15:16.320 --> 00:15:22.080 um we can say all right I've attached this host profile to a cluster I want to check compliance 00:15:22.880 --> 00:15:28.159 and if it says no verification possible uh does it mean that things aren't consistent it means 00:15:28.159 --> 00:15:31.280 it couldn't check for some reason there's something about it that's not that's not right 00:15:31.280 --> 00:15:38.080 that whatever didn't check um so non-compliant means that there's inconsistencies right and you 00:15:38.080 --> 00:15:43.359 can ask for what are the inconsistencies and then we can say oh yeah okay I see that and maybe 00:15:43.359 --> 00:15:47.919 maybe when you brought that profile over from your test dev environment you put it in production 00:15:48.320 --> 00:15:54.000 and you want to go check for compliance and you see what the compliance like oh I forgot about 00:15:54.000 --> 00:15:59.119 that change I forgot that thing that's different in production versus my test dev that should be 00:15:59.119 --> 00:16:05.840 different let me go ahead and let me um change this host profile to fix that problem so it 00:16:05.840 --> 00:16:10.000 doesn't make that change in my production environment or it makes a different change 00:16:10.000 --> 00:16:15.760 in my production environment and then let me apply it right so you do have a way of verifying 00:16:15.760 --> 00:16:19.599 what the settings are without pushing the settings and potentially breaking something 00:16:19.599 --> 00:16:25.919 you can you can check it first you can schedule compliance checks right so you can say every so 00:16:25.919 --> 00:16:30.400 often maybe once a week or something you want to go through and do a compliance check um and if 00:16:30.400 --> 00:16:33.760 things are out of compliance you can you know see it in your alert so you can go in there and check 00:16:33.760 --> 00:16:38.159 and see what happened why why is this host no longer in compliance if someone make a manual 00:16:38.159 --> 00:16:44.320 change to the host that took it out of compliance and you can see what that change is and say oh 00:16:44.320 --> 00:16:49.200 yeah we need to keep that change I need to change my host profile to match that change the person 00:16:49.200 --> 00:16:56.239 made on that host or nope that shouldn't be that is not our company standards our company policy 00:16:56.239 --> 00:17:00.640 that's out of compliance that brings us out of compliance with our you know crediting body or 00:17:00.640 --> 00:17:08.160 whatever the case may be we're going to go in and change that all right so you can schedule to 00:17:08.160 --> 00:17:12.239 happen every so often you can see the result the results of that and you know make sure that you're 00:17:12.239 --> 00:17:16.239 you stay in compliance your host profiles are still set up correctly for you to 00:17:18.079 --> 00:17:23.119 and the host remediation a non-compliance uh we've built in a compliance check on the host so 00:17:23.119 --> 00:17:28.800 you can make sure the hosts are set up correctly um if you want to bring the host in line you can 00:17:28.800 --> 00:17:32.640 you can do that you can say you want to remediate right then it resets the host parameters to match 00:17:32.640 --> 00:17:36.719 that profile and again sometimes a reboot is going to be necessary required a part of that process 00:17:36.880 --> 00:17:42.479 so here's the process goes you know uh select the host right click uh and you can say to you want to 00:17:42.479 --> 00:17:46.640 remediate right the host may reboot it's going to check the compliances you know that comes back up 00:17:46.640 --> 00:17:50.959 again and if it needs to reboot again it might be rebooting more than once as it goes through that 00:17:50.959 --> 00:17:56.719 part of that process um that's not super common unless it's like just like a lot of changes are 00:17:56.719 --> 00:18:04.079 auto-deploy also uses host profile so auto-deploy is a way that um you can do one of two things you 00:18:04.079 --> 00:18:11.359 can tell it that you want it to always auto-deploy meaning when the host comes up uh it pixie boots 00:18:11.359 --> 00:18:16.079 every single time and it connects to an auto-deploy so you know dhcp gives it this information it can 00:18:16.079 --> 00:18:20.880 find the auto-deploy server auto-deploy server um is going to tell it to connect to this tv 00:18:20.880 --> 00:18:27.280 tftp server and bring over the image it's going to boot up that from this auto-deploy server now 00:18:27.280 --> 00:18:31.760 if you're you know automatically kind of dynamically booting up every single time 00:18:32.479 --> 00:18:38.800 how are you going to you know have a configured host it's going to use a host profile on your 00:18:38.800 --> 00:18:44.160 auto-deploy host to get them up and going every single time you can also use auto-deploy 00:18:45.040 --> 00:18:49.119 to actually install to a disk as well um and then your host profile can just configure that 00:18:49.119 --> 00:18:55.359 host it comes up installs it to disk host profile applies and now we've got a nice consistent 00:18:55.359 --> 00:19:05.119 configuration on all my hosts every time okay so uh duplications um so you can uh you can use your 00:19:05.439 --> 00:19:09.280 host profiles to create machines that are exactly the same you can copy your host profiles between 00:19:09.280 --> 00:19:13.920 v centers you can copy them and make changes so even the same v center clusters are very very 00:19:13.920 --> 00:19:18.880 similarly configured but you can account for uniquenesses and hardware configurations and 00:19:18.880 --> 00:19:24.479 things like that right but it allows you to ensure that a baseline to set for like your 00:19:24.479 --> 00:19:29.199 more advanced security settings and things like that so that's a little bit more about 00:19:29.359 --> 00:19:33.839 that a baseline to set for like your more advanced security settings and things like that 00:19:36.800 --> 00:19:41.839 so why would you want to import a host profile because you spent a lot of effort creating that 00:19:41.839 --> 00:19:46.880 host profile and another environment to get it exactly right maybe it took you a lot of time to 00:19:46.880 --> 00:19:53.359 configure that and you can save that time over on a different v center server by importing that 00:19:53.359 --> 00:19:58.959 you can also not only save time you can ensure consistency so i configured the host profile 00:19:58.959 --> 00:20:04.880 over here and when i got it exactly the way i want it i export it import it into another v center 00:20:04.880 --> 00:20:10.800 server and now i can ensure consistent configurations between the two or between the three or 00:20:10.800 --> 00:20:16.319 how many times i import it in so it allows me to save time and allows me to ensure consistency 00:20:16.319 --> 00:20:25.040 across my environment um so again to import or export we're going to select the host that we 00:20:25.040 --> 00:20:29.599 want to import the profile to or we want to export it from if we're going to do an export 00:20:30.160 --> 00:20:33.439 select the appropriate file for doing the import select the host profile 00:20:34.719 --> 00:20:37.520 we can name the new profile because we're importing it and we can call it something 00:20:37.520 --> 00:20:41.760 different if we wanted to and then we can say okay and that'd be importing in that new host profile 00:20:43.520 --> 00:20:46.959 to export the host profile so why would you want to export a host profile 00:20:47.680 --> 00:20:52.160 because you want to import it someplace else you could do as a backup you could do as a backup to 00:20:52.160 --> 00:20:58.560 get it offline um just to make sure that that host profile is protected and consistent so if 00:20:58.560 --> 00:21:02.160 something happens down the road and you're like the host profile stumbles to be that way you can 00:21:02.160 --> 00:21:08.479 import it in a new one but most of the time you're exporting it because you want to import it someplace 00:21:08.479 --> 00:21:12.800 else so that just makes sense right it makes sense that before you can import a host profile 00:21:12.800 --> 00:21:18.959 someplace else you have to have exported it first so it allows you to keep a consistent configuration 00:21:18.959 --> 00:21:22.400 across your environment okay and you can reapply those profiles as needed 00:21:24.479 --> 00:21:31.680 so configuring an hba to boot so if we're going to um if we're going to do a boot from sam then 00:21:31.680 --> 00:21:36.880 we'll need to configure our hba as a boot device and then we can apply the host profile to you know 00:21:36.880 --> 00:21:44.160 configure that so um cisco ucs does something very similar very very much like this i am able to 00:21:45.040 --> 00:21:52.719 replace a blade for example in a cisco ucs system and i can then in the cisco ucs software apply a 00:21:52.719 --> 00:21:57.520 cisco ucs profile to the hardware which is going to configure the hardware for that blade to kind 00:21:57.520 --> 00:22:02.319 of match what i'm replacing and then it can do a boot from sam it's going to get that new 00:22:02.319 --> 00:22:07.199 configuration or that new operating system and then the host profile from the old blade can be 00:22:07.199 --> 00:22:13.199 applied to the new blade and now that blade is exactly the same in this scenario i would apply 00:22:13.199 --> 00:22:19.599 the same ip address the same host name the same everything on that blade so now when this blade 00:22:19.599 --> 00:22:24.400 fails and i replace it with a new one i have the exact configuration right in order to do that if 00:22:24.400 --> 00:22:29.119 i'm doing a boot from sam i have to configure the hba for this for this server to do a boot from 00:22:29.119 --> 00:22:34.800 sam so all you do is go into the bios of the hba and you're going to give it the um the the sans 00:22:34.800 --> 00:22:39.599 you know information and one information and point to the right one where the uh that's going to be 00:22:39.599 --> 00:22:44.880 booting from and of course you can figure the one or the you know the sans so that one is 00:22:44.880 --> 00:22:50.160 accessible if you have any kind of zoning configured or something like that so it's accessible um by 00:22:50.160 --> 00:23:00.640 that particular hba so integrations uh host may need to reboot right during these remediations 00:23:00.640 --> 00:23:04.880 so when you do this remediation or this integration uh host is going to go in the maintenance mode 00:23:04.880 --> 00:23:09.359 which is going to you know take all the hosts out of it then it's going to be remediated and then 00:23:09.359 --> 00:23:14.079 it you know it may come back up again so you might use like drs to help uh get all the vms off of it 00:23:14.079 --> 00:23:18.800 so you can put it in the maintenance middle so you can remediate so parallel remediation means i 00:23:18.800 --> 00:23:23.119 actually in that scenario where i had these 30 hosts i'm going to remediate all 30 of them 00:23:23.119 --> 00:23:28.800 it actually doesn't do all 30 at once it might do two or three depending upon your your cluster 00:23:28.800 --> 00:23:35.359 availability at once v sphere seven wasn't able to do parallel remediations that was removed at 00:23:35.359 --> 00:23:41.599 these for seven um probably some kind of you know issue with the stability of it they fixed that and 00:23:41.599 --> 00:23:48.560 we can again do uh parallel remediations with v sphere eight so eight we can do multiple host 00:23:48.560 --> 00:23:53.839 remediations at once again not an entire cluster but multiple members of a cluster and again that 00:23:53.839 --> 00:24:00.880 will be based upon the availability of resources for the vms that i'm trying to um to remediate on 00:24:02.400 --> 00:24:11.119 okay so auditing has improved quite a bit also with this so host profiles it used to be kind of 00:24:11.119 --> 00:24:17.199 more generic um and we didn't have a lot of you know visibility into what kind of changes were 00:24:17.199 --> 00:24:22.000 made but it has been enhanced it's been enhanced for a few versions now so now we can see on host 00:24:22.000 --> 00:24:27.520 profiles um who did what you know what did they change when did they change it where were they 00:24:27.520 --> 00:24:33.439 you know changing it on and uh how did they access and do this right so basically most importantly is 00:24:33.439 --> 00:24:36.800 who made the change and what did they change and when did they change it those are really 00:24:36.800 --> 00:24:42.239 important things there right and uh the more advanced logging options now allow us to do that 00:24:42.239 --> 00:24:46.959 and here's an example this kind of shows you that you know somebody went in and you go into the audit 00:24:46.959 --> 00:24:56.640 log you can see that uh a um host profile has changed and you know a certain device a certain 00:24:56.640 --> 00:25:01.439 nick was changed from this configuration to that configuration it was set to auto detect you know 00:25:01.439 --> 00:25:07.760 the speed and now it's set to you know uh full you know duplex one gig but it's static set there it 00:25:07.760 --> 00:25:17.520 can't do 100 meg or something like that so we discussed with host profiles we discussed you 00:25:17.520 --> 00:25:24.000 know duplications of them importing and exporting them hbas and integration let's go ahead and jump 00:25:24.000 --> 00:25:29.680 over into our lab environment and do a quick demo of host profiles so over here in our demo 00:25:29.680 --> 00:25:36.319 environment i have my host if i go over to configuration and under system i have host profiles 00:25:37.119 --> 00:25:42.959 if i go to attach i have no host profiles here none at all so what i need to do is i need to 00:25:42.959 --> 00:25:48.959 either import or create a host profile so let's create a host profile now let's assume in this 00:25:48.959 --> 00:25:56.000 scenario this host is my golden image this is exactly how i want all my other hosts configured 00:25:57.280 --> 00:26:02.239 with the exception of things like i don't want to use the same host name i don't want it to 00:26:02.640 --> 00:26:06.400 use the same ip addresses on the vm kernel ports or i don't want it to 00:26:07.439 --> 00:26:12.239 have the same mac address or things like that but all the things that i do want to be standardized 00:26:12.239 --> 00:26:18.400 across all my hosts this guy already has configured so i want to do i want to export 00:26:18.400 --> 00:26:24.880 this from this host my host profile so now right click on this guy go down to host profiles 00:26:25.839 --> 00:26:32.719 and extract those profile now let's assume for a moment that this is the cluster that has my 00:26:33.760 --> 00:26:40.079 dell r610s in my production cluster 00:26:43.119 --> 00:26:47.280 so this is my production profile for my dell r610s and let's say okay 00:26:47.280 --> 00:26:53.040 this is going to come up it's going to take a moment usually takes about a minute or so it could 00:26:53.040 --> 00:26:57.680 take longer to be quicker depending on how quick your systems are and how big that you know the 00:26:57.680 --> 00:27:03.680 configurations are going to look 00:27:03.680 --> 00:27:09.839 all right so i completed pretty quick and if i want to look at that host profile before i try 00:27:10.239 --> 00:27:15.839 all right so i completed pretty quick and if i want to look at that host profile before i try 00:27:15.839 --> 00:27:21.040 attaching it to anything i go to my big mac over here i go to policies and profiles 00:27:22.079 --> 00:27:28.239 host profiles and here is my my dell r610 production profile now let's say that this 00:27:28.239 --> 00:27:34.160 profile is basically exactly what i want but i need to customize another version of this 00:27:34.160 --> 00:27:40.319 for my my dell you know r810s what i can do is i can choose this profile 00:27:42.079 --> 00:27:47.199 and i can say i want to duplicate the host profile but this one i'm going to say is for my dell 00:27:48.560 --> 00:27:57.920 r810s but again my production profile i'll say okay to that 00:27:58.640 --> 00:28:05.680 and this will take you know 30 or so seconds 40 seconds usually to copy 00:28:08.479 --> 00:28:12.880 all right so that's done and then what i can do from here is i could go into 00:28:13.839 --> 00:28:20.640 this profile and i could say i want to edit this guy 00:28:22.319 --> 00:28:25.599 and anything i need to make changes to i can make changes from here 00:28:25.760 --> 00:28:30.719 now maybe i don't want the networking to be applied at all the networking is you know i don't 00:28:30.719 --> 00:28:35.199 want to be duplicated here i guess uncheck that and nothing network configuration related 00:28:35.199 --> 00:28:40.319 is going to be duplicated or maybe their storage is very different so i can uncheck storage 00:28:41.199 --> 00:28:47.199 i can also go in for example to networking and i could make changes here so 00:28:47.920 --> 00:28:53.599 here i have my host port groups these are the ones that i created on this host i have my 00:28:53.599 --> 00:28:58.880 i-steady port group and here's my ip address information so what do i want to do to make 00:28:58.880 --> 00:29:03.599 sure my ip address are your unique i could say i want a user must explicitly choose 00:29:04.160 --> 00:29:08.160 what to do with it prompt the user for an address if no defaults available 00:29:08.160 --> 00:29:11.920 use dhcp maybe i'm just gonna go say you know what i don't want to go make a bunch of changes 00:29:12.319 --> 00:29:15.280 maybe i'm just gonna go say you know what i don't want to go make a bunch of changes to all these 00:29:16.560 --> 00:29:21.680 in reality probably wouldn't use dhcp on your iscsi adapter you know for your storage but 00:29:21.680 --> 00:29:27.520 maybe i want to do that for my vmotion network i'm gonna go into my ip address changes right 00:29:27.520 --> 00:29:35.520 and i can say on this guy use dhcp or i can say user specified right on there and dhcp will be 00:29:35.520 --> 00:29:40.400 fine for all of them and then i could go in there and customize that uh if i needed to now i wouldn't 00:29:40.400 --> 00:29:43.920 want to customize it and have this set like you know something different because then it'd be out 00:29:43.920 --> 00:29:51.280 of compliance when i did my compliance check right let's see for iscsi here i can say if i want to 00:29:51.280 --> 00:29:56.319 always create this object i created production product family matches so if they were from the 00:29:56.319 --> 00:30:02.640 same uh like vendor and so forth i can you know match things like that i can also go in and you 00:30:02.640 --> 00:30:08.160 know do things like if i want to change the vlan id maybe for this iscsi in this environment it 00:30:08.160 --> 00:30:15.359 actually uses vlan 10 and for the vmotion network i know in this environment it's vlan 20 right so 00:30:15.359 --> 00:30:19.520 there could be things that would be different in the environment most of the things are the same i 00:30:19.520 --> 00:30:27.199 do want an iscsi host group right i do want a vmotion host group i want management okay uh 00:30:27.199 --> 00:30:32.000 different things like that my network policies do i want to allow promiscuous mode or not that can 00:30:32.000 --> 00:30:36.959 be the same can be different based on what i'm looking at right uh the nix that i'm you know 00:30:36.959 --> 00:30:42.160 gonna have is active on there so once i've gone and made all those customizations now this is 00:30:42.160 --> 00:30:54.560 going to be set for my uh my dell r 810 environment right so my 610 one was good to go i copied it i 00:30:54.560 --> 00:31:00.319 made some changes to it for you know now it matches my 810 environment so now what i can do is go back 00:31:00.319 --> 00:31:06.800 to my inventory and go to this projection where my 610s are 00:31:09.359 --> 00:31:16.800 configuration host profiles and now if i go to attach i have those host profiles and i know this 00:31:16.800 --> 00:31:23.680 is the one that's for that cluster i'm going to attach it it's going to show me the profile i 00:31:23.680 --> 00:31:30.239 selected it's going to show me the hosts that i want to compare it to and now because i don't 00:31:30.239 --> 00:31:35.280 have all different customizations you know set up on there i don't have um you know i haven't told 00:31:35.280 --> 00:31:40.400 this guy what ip i wanted to use and things like that when i go to check the compliance on this 00:31:40.400 --> 00:31:43.680 it's going to be a little bit out of out of compliance so i'm going to say i want to check 00:31:43.680 --> 00:31:50.880 compliance let that run that usually will take about a minute or so it could take a little longer 00:31:50.880 --> 00:31:57.280 depending on your environment and now i see that one host is out of compliance and obviously the 00:31:57.280 --> 00:32:02.079 one that's not in compliance is the one that the profile did not come from the one that is in 00:32:02.079 --> 00:32:06.800 compliance is the one that the profile came from because it's exactly the way that host is 00:32:06.800 --> 00:32:11.359 configured so we're compliant there if i were to go into this host and make you know some changes 00:32:11.359 --> 00:32:14.719 to that port group i would have renamed one of the port groups or something like that it would 00:32:14.719 --> 00:32:20.640 then be out of compliance as well right what i could would normally maybe would do next if i 00:32:20.640 --> 00:32:27.439 could take the time to go through and change this host profile so it's not perfect for this guy but 00:32:27.439 --> 00:32:31.439 make it so it's a little more generic so it can match both of them i could then say okay now that 00:32:31.439 --> 00:32:37.119 i've done all this let's remediate let's remediate and push out all that so that this one gets all 00:32:37.119 --> 00:32:41.280 those changes that need it has all the right port groups all the right customization for my advanced 00:32:41.280 --> 00:32:46.319 settings and all that are there i could push up that remediation once i put now of course when i 00:32:46.319 --> 00:32:50.800 go to push up the remediation it's going to want to let me know that you know rebooting the host 00:32:50.800 --> 00:32:56.479 might be necessary and things like that i could agree to that if drs is configured drs could 00:32:56.479 --> 00:33:02.560 evacuate the host put it in maintenance mode for me all that kind of stuff remediate it then you 00:33:02.560 --> 00:33:07.040 know bring it back out again so that's how you would configure host profile we can you know 00:33:07.119 --> 00:33:14.000 extract one we can copy them we can attach them to clusters and then we could check for compliance 00:33:14.000 --> 00:33:17.359 on them and then if you know if needed which most of the time it will be when you first 00:33:17.359 --> 00:33:20.479 deploy these new you can do some remediation for me