vCloud Automation Center 6.0 –Creating Build Profiles, Custom Properties

Custom properties are one of the core part of self service provisioning, as it allows extending vCloud automation center (vCAC). This is the best feature of this product. This extensibility can be easily achieved as long as you know vCenter Orchestrator. This is the easiest product to learn, to start with the product you can find all the relevant videos for vCenter Orchestrator here by Brian Watrus. Ok back to the post.

Custom properties as the name denotes refers to customization. Therefore are used to override existing default values. You can also allow customer (end users) to make those choices.  End users are the personnel who are going to use self service provisioning day-in, day-out.

Initial Thoughts

There are many ways we can give flexibility to end users. But what are the use case for this end user? This is the first question we all need to ask. Is she an end user with no IT knowledge or she is merely a developer. These requirement drives what service offering you wish to expose to end users. I would ideally want to give to the user

  1. 1. VM type to provisioned (OS Variance, Variance by Size)
  2. 2. Ability to take VM backup on demand. Backup policy selection? Right now vCHS offers backup option but yet to offer restore service to enduser. You have to call support. Reference Blog 
  3. Ability to enable monitoring for a VM (and then choice of monitoring baseline)
  4. Ability to enable Antivirus support for a VM (and then file exclusion)
  5. Does it need DR (If yes, RPO/RTO definition option please)

This clearly is leading towards SDCC. Without SDDC architecture in place this kind of automation is impossible. 

Scope of this post

Below are the custom property I preferred to play with in this blog post

  • Allowing end user to select the portgroup to which to attach this VM
  • Allowing end user to select the folder in vCenter to place the VM
  • Remove unnecessary device from the VM e.g. CD ROM
  • Cleaning up computer accounts in active directory
  • Allowing end user to select the network type
  • Control snapshot numbers per VM
  • Control SCSI controller for a VM

That being said this is clearly a very small and simple list. I had initially plan to make use of most of them but I have cut this list down. Primary reason I did this is because custom properties are clearly dependent upon how are you deploying your VM. For cloning workflow these custom properties are limited. If you see my previous blog post on Blueprints here, I limited the scope to only Basicworkflow, Cloneworkflow and linkedclone workflow

What are reserved property

Custom properties which are defined by vCAC and cannot be used with same name are referred as reserved properties. Reserved properties allows you to add a property to a machine or override its default or existing value. vCloud Automation Center (vCAC) has defined some properties which are referred as reserved property. There are four types of properties explained below.

Properties types

Internal: This value is maintained in database only. You can query by using any programing interfaces. Below are few example of internal property. For full list of custom property please refer Custom Property Reference Guide here

  • VirtualMachine.Admin.Owner – The end user’s name who has requested the machine
  • VirtualMachine.Admin.Approver – The approver’s name who has approved the request
  • VirtualMachine.Admin.Description – The description of the machine as entered by the end users

    Read-only: These are values in read-only mode and cannot be changed. Examples could be UUID and other values which gets associated with VM for its life cycle. e.g. VirtualMachine.Admin.Name -name of the VM generated by vCAC using machine Prefix

External: This value is implemented in the VM and also updated in the Database. But if this value is changed in the VM, this value is not updated back in database. Kinda  of one time process only. e.g.

  • Hostname (to over write the VM name generated by vCAC using machine prefix)
  • VirtualMachine.Admin.AddOwnerToAdmins  – Not supported in cloning operations Crying face)
  • VirtualMachine.Admin.AllowLogin (boolean value) –To add owner to remote desktop user group. This allows requestor to login after machine is successfully provisioned. My experience in getting this work in cloning workflow has failed

Updated: Exactly opposite of external. Value is tracked till its lifetime via inventory updating mechanism when it is changed outside vCAC

  1. VirtualMachine.Admin.Hostname – Name of the host on which VM resides
  2. VirtualMachine.Memory.Size – Memory size of VM
  3. VirtualMachine.CPU.Count – CPU Count of VM
  4. VirtualMachine.Admin.TotalDiskUsage – Disk usage on the disk including swap file size

In my opinion Internal and read-only property can be of limited usage. However there is some scope for updated and external properties. From official documentation

External and updated properties can be used for cloned machines only if marked with (cloning). Others have no effect on cloned machines because they set attributes that are determined by the template and customization specification used and cannot be changed by vCAC.

Any property can be changed in the vCAC database only using the Edit option on the machine menu, except the read-only properties VirtualMachine.Admin.AgentID, VirtualMachine.Admin.UUID and Virtual-Machine.Admin.Name.

Now that we understood little bit of custom property, lets understand how we can better use them

What is build profile?

It is collection of the custom property under single title e.g Custom properties can be seen as members of a group. Collecting custom property under build profile helps to apply them to VMs and makes them more manageable. You have the option to add custom property to reservation or blueprint however in build profile you simply combine them under similar property sets. vCloud Automation center does provide in-built property set. We will look into property set at later part of the post while discussing Active Directory Clean up below

Create a build Profile

Creating  a build profile is way tooo simple. Login as a Fabric Admin Open Infrastructure –> Blueprints –> Build Profiles –> New Build Profile


I have created two Build profiles. One for a cloning workflow and other for Basic workflow. Primary reason for doing so is because with cloning workflow you basically deploy VM from the template. So lot of the VM properties and OS properties are being copied from the template into VM as referred in official documentation (also mentioned above in Italics). So there is a limited way you can play with VMs deployed using this cloning workflow and similar logic applies to Basic workflow

Let’s focus on custom properties that I have created for VMs to be provisioned from Basic workflow.

Select New Property. Enter name for the property. This name must be same as defined by vCloud Automation Center Custom Property Reference Guide. Put the value and select If you wish to encrypt and or prompt user for inputs


In above build profile I have created 6 custom properties to be part of Build profile by name BasicVM. Let’s discuss them one by one.

  1. VirtualMachine.CDROM.Attach –This property by default has True value, in above I have changed this to False as I don’t want to attach CD ROM to my machine
  2. VirtualMachine.Network0.Name –This property allows you to choose which port group you want your VM to be attached. I have left Value field as blank which means by default it won’t have any value. I have select this value not to be encrypted. In Prompt User I have selected that user should be prompted for input. In above property Network0 refers to first network card attached to the VM. If you wish to learn to more on how to do this, please refer to an excellent blog by Magnus Andersson –> I’m regular reader of this excellent blog.
  3. VMware.Network.Type –This property allows you to select the network adapter type you can select for VM to be provisioned. It based on Magnus’s blog. It is kind of I learnt from his post and I choose to find another use case to implement using same principle
  4. VMware.SCSI.Type – This property allows you to select SCSI controller for your VM. In this case I’ve not given user option but I made that choice on behalf of end user. By default SCSI controller of pvscsi will be created. For Windows 2008R2 default SCSI controller is LSI Logic SAS. It is worth observing you do not get a choice to user different types of controllers for different disk. All controllers of PVSCSI are created based on this property value
  5. VMware.VirtualCenter.Folder – This property allows you select the folder where you wish to place the VM.
  6. VMware.VirtualCenter.OperatingSystem – This property creates VM with Windows 2008 R2 operating system

Now all 6 properties forms part of build profile under name BasicVM. This build profile will automatically appear in Blueprint’s Properties tab as seen below. Just select it. Press Ok


Now when user request a virtual machine he gets three drop downs menu which are 1)select Destination Network (derived from VirtualMachine.Network0.Name property), Network Card Type (derived from VMware.Network.Type property) and VM Folder Location (derived from VMware.VirtualCenter.Folder).


NB: All the above properties except VMware.VirtualCenter.Folder are not possible to change when we use cloning workflow.

Below are the screens of how dropdown menu appears to end users for selection of choice.




Disclaimer: Properties which I have discussed for cloning workflow are based on my experience, trials and error. VMware doesn’t explicitly & correctly mentions about which properties are applicable/not applicable in particular workflow.


That being said So let’s discuss what properties we can use when we are using cloning workflow. Here I have created a build profile by name Customize VM.


  1. First 5 custom properties are inbuilt custom properties created for you under Active Directory Clean up plugin by vCAC. It is referred as property set. These we cannot change in the property set, we can just use them. The process to load them is as below
    1. In the Add from Property Set either scroll down or Type Active directory. After Active directory menu is visible, press Load button. After you press Load button properties related to the property set are loaded. In this case first 5 property are loaded for active directory clean up
    2. Plugin.AdMachineCleanup.Delete is set for false. If it is set for True, computer account is deleted and So property Plugin.AdMachineCleanup.MoveToOU which controls where delete computer account should go serves no purpose. So in order to use Plugin.AdMachineCleanup.MoveToOU, we must put Plugin.AdMachineCleanup.Delete value as false.
    3. Plugin.AdMachineCleanup.Execute is set for true. Unless this is true none of the plugin properties will be of use
    4. Plugin.AdMachineCleanup.Username & Plugin.AdMachineCleanup.Password these are credentials an account which has rights to delete computer accounts in AD. Please note for Plugin.AdMachineCleanup.Password I have selected encrypt checkbox which is the reason password is not visible in clear text.

Below screens shows the results of active directory plug-in values


  1. Snapshot.Policy.AgeLimit allows you to limit number of snapshot per VM. It is 3 in my case. If you go beyond it, you would get an error as shown below.


  1. VMware.Memory.Reservation it is the property where you can reserve memory for VM. We have reserved 512 MB and below this value is reflected in VM property. That being said I have not seen custom property for CPU.


VMware.VirtualCenter.Folder is as explained above

Hope you like this post.

Previous Posts




vCloud Automation Center 6.0 (vCAC 6.0) Creating and Configuring Approval Policies

Approval policies has changed significantly compared to previous releases of vCloud Automation Center. Approval policies provides a key control over your Infrastructure. It forms core component of Cloud governance. Below is schematic view of approval policy. Approval policy is ruled by policy type and directly influences approval phases.


There are two Approval phases -Post-Approval and Pre-Approval phases. For every phase there are levels to define. These levels are approval levels can be seen as Business steps. At each level you have to select how approval proceeds. Approval steps/levels is influenced by two options 1).Is Approval Required, 2). Who are the approvers . In first option we decide if approval is needed (always required/based on condition) and second option we define approvers (single/group, All must approve/anyone approve).

Creating Approval Policies

As tenant administrator go to Administration tab => Approval Policies and select fat green button to create a new approval policy




Select the approval Policy Type from the drop down menu. Most relevant for me is Service Catalog –Catalog Item Request (Virtual Machines)


Approval level can be designated as always required for strict governance or you can keep it flexible by defining condition. e.g. end user is requesting a machine of 16 GB RAM. For uses cases of this kind a condition must be defined -whenever user request a machine memory more than 4 GB, approval policy must be invoked.



You can designate single person an approver or you can add group of users as approvers. You also have option to decide if approval is needed from any one person from the group or all the group members must approve it.

Sometime it does happen, user requests VM with 16 GB RAM, IT manager explains it is not possible now however once we have adequate capacity we can meet you requirement. End user agrees. So instead of asking him to re-sent another provisioning request IT manager can edit the memory to level which is possible with current utilization and approval process proceeds further.




If you wish to update approval policy you must make a copy of the policy. It is not possible to edit the existing policy. Reason is not explained why one cannot edit but I could think it could be that once entitlement gets associated with approval policy it might be difficult to break the relationship.

To understand how the approval level works, I went ahead and added another level (Business approval stage), press Big fat green tab


Fill in the details, repeat all inputs we did to add L1 approver except the approver must be fabric admin


Below you can see each approval policy has at least one phase and each phase can have multiple level. I have seen only two phases in the screen below i.e Pre Approval and Post Approval.  Phases includes level of approvals. e.g. In Pre Approval phase I have created two levels of approval. Phases are clearly controlled by the approval policy type. In Pre Approval phase all approval are needed before service provisioning can start, while in Post Approval phase approval is needed when service is provisioned but before it is released to the owner.


As per above screen Level 1 (L1) needs approval from manager and Level 2 (L2) needs approval from Finance controller. L2 is dependent on L1, unless L1 approves L2 cannot approve. You can also change sequence of approval shown in the screen above.

Assigning Approval Policy to Entitlements

Now that approval policy is created we must assign it with entitlements. Go the Administration => Catalog Management =>Entitlements page.  Select the entitlement you wish to applying approval policy


Please note some Approval policy can be applied only to new catalog item requests, while other policies can be applied only to post provisioning actions on provisioned items. In our case we created a simple pre-provisioning policy which will invoke approval when you initiate request for new VM (Service catalog –Catalog item Request (Virtual Machine). You can apply this policy only to catalog item as could be seen above. Though this relation is automatically established you probably do not have to memorize this relation. Reason I say this is because If you try to associate such policy with incorrect entitlement it won’t show. Since this policy is not applicable to Entitled services and Actions, In below screen I observed they are not visible at all




All previous post of vCloud Automation Center 6.0 (vCAC 6.0)

Next post I will be focusing on build profiles

vCloud Automation Center 6.0 (vCAC 6.0)–Creating & Configuring Blueprints–Basics

Blueprints (BP) are fundamental building blocks for provisioning virtual machine, cloud machine and physical machine from vCloud Automation Center (vCAC). Blueprint represent processes and policies Tenant follows today.

Introduction to Blueprints

Before we start creating Blueprint (BP) we need to understand what kind of services you are planning for end users. When they request services (in this case IaaS only) are end users expecting a full fledge VM with OS installed, Full fledged VM with OS installed, configured and customized. Blueprints provides several of these options. I ‘m focusing only on VMware based VMs as highlighted below



Basic Workflow

In basic workflow VMs are provisioned without any Guest OS. Well at first thought I felt there is no point in discussing this BP type. But lets start with simple. Lets understand the process and see how Basic BP differs from others.

1. First logging using tenant administrator/business group manager. I’m logging as tenant, as in the end he need to take full control of how to consume resources

2. Go to Infrastructure –> Blueprints –> Blueprints

3. For our purpose we will select Virtual > Blueprint > vSphere (vCenter)



Blueprint information Tab

1. Type the name for the Blueprint. Name should reflect OS, Application or Service. Since in IaaS name of the OS and Version should be okay to start with.


In below screen please note how screen changes if you deselect Shared blueprint, Business group appears automatically. Since I’m using tenant admin credentials to create & configure blueprint I have to select Shared blueprint (can be Shared across groups) option


Build Information Tab

Build information tab is where you make choice about workflow type. In Blueprint type you have an option between Server and Desktop. I choose Server for this blog post. Next piece is Action. For basic workflow select create from the drop down menu. Next label Provisioning workflow automatically gets populated with list from which you select basicvmworkflow (shown in 2nd screen capture).




Lets move to Machine Resource section. Key in CPUs, Memory (MB), Storage (GB) &

Lease (days): How many days you want VM. Leave it blank to make it permanent.

Do make a note of maximum section. Using maximum value you give user flexibility to choose between minimum and maximum values while provisioning VMs. e.g. for Memory (MB) we have minimum 512 MB and maximum 1024 MB. So end user can request a VM with memory from anywhere between 512 to 1024 MB

Properties Tab

In property tab we have option to use Build profiles. Build profiles I have cover in this blog post. You can create custom properties. Custom properties are used to pass value to OS during its provisioning process. And every workflow has pre-define list of custom properties


I have used a very simple custom property here. VirtualMachine.Admin.ThinProvisionion which gives you control if you wish thin provision VM. This property is must if you are provisioning against local SCSI disk.


Select the actions you want to make available to the end users.



At this point all four tabs we have been configured. There is more to discuss about Blueprint. I plan to cover it future posts especially the advance configuration options. Now I will move to other workflows i.e. Cloned and linked clone workflow. In both these workflow Blueprint Information, Action and properties tabs are similar and what we discussed in Properties and Actions tab above applies for these workflows as well.

Use blueprint actions and entitlements together to maintain detailed control over provisioned machines.

Creating a Blueprint for Cloning

Word cloning clicks immediately. It means we need a reference VM inside vCenter. This workflow is nothing but wrapper over the process we had done for last so many years. That being said you need a reference, pre-customized VM, you need a sysprep for Windows 2003 or earlier on vCenter. Simplest workflow and I guess widely used as long as we are focusing on IaaS.

Blueprint Information

Nothing here to configure but ensure your naming convention matches the workflow.


Build Information

Select Blueprint type

Select action as Clone. This changes the workflow option to clone.


After you select clone, immediately an option to browse to select image to clone from becomes visible.


Browse to select the VM. This is actually a template must be available in vCenter


I didn’t liked the name of the workflow. Cloning workflow is incorrectly named. It should be inline with deploying from template. At first look it gave me a feeling that I’m cloning VM. Coming from Microsoft background I don’t like cloning. That being said in reality we are deploying from template and not cloning from VM. So it is doing thing which I was expecting.

Go to the Machine Resources section and you might be surprised (as I was) to see Minimum resource column is already populated with some values. These values are picked from the template values and cannot be modified. Now just fill (optionally) maximum value you want to proceed with.


NB:Custom properties available for CloneWorkflow are more in numbers compared basic workflow.

Linked Clone Blueprint

Linked clones are extremely popular with desktops and were introduced with VMware View. They work on simple concept of parent VM and base snapshot. Base snapshot is base virtual disk for virtual machines (often referred as delta disk) and points back to parent VM. All changes happens at base virtual disk only


Primary requirement is to have a VM with clean OS installed and with a snapshot.


After you click Clone from, you see a pop seen below. Select the VM to use as a reference/Parent VM.


Select a snapshot to clone from. You also get an option to take snapshot from this interface but since I have press refresh button during screen capture it is not visible below.


Nothing much in below screen, just read it and say Ok


You get a smart option to delete snapshot when you delete blueprint. I think it make complete sense and should be always checked.


With this we are done with basic blue print creation. In properties there are many custom properties available and more or less similar to cloned workflow. But one custom property is worth noting here is MaximumProvisionedMachines. By default vCloud Automation Center 6.0 (vCAC 6.0) allows you to create 20 linked clones of one machine snapshot. This property will allow us to override this default limit.

Next post I will be looking at exploring advance blueprint option.

vCloud Automation Center 6.0 (vCAC 6.0)–Reservation Policies, Storage Reservation Policies, Network Profiles

Before we proceed further let me revise where we are. In first post here we Installed and Configure vCloud Automation Center 6.0 Identity Appliance (vCAC 6.0 Identity Appliance) and vCloud Automation Center Appliance (vCAC 6.0) and in second post here we Installed and configured vCloud Automation Center IaaS (vCAC 6.0 IaaS). In third post we went further to configure Tenant. As per below diagram we completed almost every configuration. This post will be focusing on optional configuration part


We created sales business group, assigned Business group admin to it. We created reservation and assigned reservation to sales BU. 

While creating reservation we stopped at explaining Alert tab. Lets resume with its discussion. It is optional configuration but worth understanding and enabling it. In cloud environment where things change dynamically we must configure alert.

Click on the ALERTS tab, Set the capacity alerts to on various parameters seen below.


Unless you have configuration notification alerts emails won’t be sent

Few consideration about Reservation

Reservation is a portion/share of resources which we assign to multiple business group (e.g. Sales, HR, Marketing) and multiple business group can have different reservation types (e.g. Gold, Silver and Bronze). In my environment Gold cluster was assigned to Sales and Marketing Business group in above figure. I have linked PDF copy to the figure. However reservation cannot be shared across the Business group.
If you have created reservation for, end user cannot request a Hyper-V resource using that reservation. Reservation type must match the platform defined in blueprint. If you name your blueprint accordingly this shouldn’t be problem at all.

Reservation Policy

It is collection of resources into group to make specific type of service available. Below I have created a policy by name Production Reservation Policy and included silver and gold reservation.




In below figure I tried to explain that you can have different reservations assigned to single reservation policy but Blue prints can have only one reservation policy assigned. However when resources are provisioned, only reservation which match the blueprint type are considered & allocated.




Reservation policy needs to be populated with reservations. However this is not quite easy to correlate in practice. When you create reservation you have an option to assign that reservation to the reservation policy. This is where association between reservation and reservation policies is created. Reservations are created for Business group and Business group have multiple reservation from fabric. With reservation policy you have an option to bring all types of reservation assigned to a business group under single reservation policy. let me explain it via simple diagram below



In above example we have tenant, under which we have created a Sales Business group. Inside Sales Business group I have created three reservation of different types. I defined have multiple reservations e.g. Cloud, Virtual and Physical. As Fabric administrator I have created reservation policy by name “Virtual Reservation Policy” to collect resources of both Virtual and Cloud reservations. This policy will help me to provision all virtual resource as long as I select in Blueprint/Reservation “Virtual Reservation Policy”. This is just one way of doing it.

You can create reservation or reservation policy first. There is as such no dependence. In fact reservation policies are optional part of over all piece. Better way to do is create reservation policy first.

Reservation policy is actually a tag. All you need to put a name to the tag, little description for it. To create reservation policy, Go to Infrastructure –> Reservation –>Reservation Policies and Click New Reservation Policies. As described above I have created two reservation policy and can be seen below.

  1. Production Reservation Policy for Gold and Silver reservation
  2. Gold Storage for production virtual machines


Creating reservation policy is not sufficient. You must Assign reservation policy to reservations which you intended to group together. So below I’m creating new reservations and assigning newly creating reservation policies each one of them as described above.


Storage Reservation Policy

Storage reservation policy is similar to reservation policy. Primary purpose is to collect datastore of similar characteristic into a group. Below I have created a storage reservation policy by name GOLD and got three different datastores (Datastore01, Datastore02 & Datastore03) of same characteristic into single storage reservation policy.


This tag helps to assign storage as per the requirement of application. In case Datastore 01 one is full, VM will be automatically provision to datastore 02. It means we just need to have storage reservation policy in place. Behind scene Gold storage from either of datastore01,02 or 03 is assigned for sure.

It is similar to storage profiles released in vSphere 5.0. However these tags were inherited by Dynamic ops. I wonder if there is still a use case of this tag when vSphere DRS cluster is becoming so much popular. Datastore cannot have multiple storage reservation policy e.g. Datastore 01 cannot have another storage reservation policy assigned but storage reservation policy can have different datastores. After storage reservation policy is created to be effective you must assigned it to volume.

Do not create storage reservation policy if you have well designed Storage DRS cluster

Similar to reservation policy, storage reservation policy is also a tag. You can create storage reservation policy from same interface as from reservation policy. Both are almost similar, at least I have not discovered any difference but logically they cannot be combined.

Assigning storage reservation policy differs from the assigning reservation policy. Storage reservation policy must be applied directly on datastores. Go to Infrastructure – Compute Resources – Compute Resources


Network Profiles

By default vCAC will assigns DHCP IP Address to all machine it can provision. DHCP is ok for non-production Server VMs but production Server VMs needs IP address. Probably we never need to worry about Desktop VMs as far as networking policies are considered. To allocate static IP is the primary intention of network profiles. It is way to create a pool of IPs using a pre-defined. You can apply network profiles while creating reservation or while creating Blueprint. 

Network profiles do not apply to AWS

Fabric Administrators defines the IP ranges, subnet mask, DNS, DHCP, WINS (does it exist yet???), DNS suffix and combine all these values into single profile referred as network profile. Network profile like reservation policies can be applied to the reservation, blueprints.

Create a Network Profile for Static IP Address Assignment

Login as fabric admin, navigate to infrastructure –> reservations –> New Network Profiles –>External


1) Name of network profile –Append the name with type of profile e.g. Production External

2) Subnet mask for the network range

3) Gateway ( for NAT type network profile this field is compulsory)

4) Primary DNS server

5) DNS Suffix


6) Click on IP Range tab. Below screen enter  IP Address you need to reserved for this profile. Provide name and description. Press OK once done


After you press OK, below screen displays IP range and allocation status in status column.


Now we have network profile, we need to assign it to reservation. Below here I’m  assigning it to existing reservation. Go to Infrastructure –> Reservations –> Edit Existing Reservation configured. For network path “VM Network” select network profile from drop down menu. Press OK


So in this post we learn the importance of reservation policy. How to configure reservation policy. We learnt about storage reservation policy and how to configure storage reservation policy. Storage reservation policy needs to applied to compute resource, while reservation policy needs to be configured at reservation screen. Then we went and checked the Network profile, it’s use cases. Finally we learnt How to configure network profile so that static IP’s can be assigned to Servers.

Next post I will be discussing how to create and configure vCloud Automation Center 6.0 (vCAC 6.0) Blueprints

Creating & Configuring Tenant/s in vCloud Automation Center 6.0 (vCAC 6.0)

Mutli-tenancy is built into vCAC6.0. What it means? It simply means for every tenant you do not need to install vCAC. You can have multi-tenant on single vCAC. Each tenant can have its own branding, Active Directory Authentication source, group, Business policies, Catalog offering and dedicated infrastructure. Tenants in vCAC are an organizational unit. Tenant represent business unit within an organization or can be organization itself.

In vCAC each tenants gets

  • Dedicated URL
  • Identity Stores
  • Branding
  • Notification Providers (email alerts)
  • Business Policies
  • Service Catalog offering (small VM, Big VM, Web service, Apache Service)
  • Infrastructure Resources (virtual. Physical, Cloud)

    vCAC gets a default tenant vSphere.local (cannot be changed/avoided) and can be accessed via http://vCACApplianceFQDN/shell-ui-app



    1) To create a new tenant click on green Icon encircled above. New window opens up. When all details are entered, press Submit and Next


    2) Lets add the identity source. In my case I’m using my own AD.


    Here you as Administrator create two very important roles.

  • Tenant Administrators

  • Infrastructure Administrators (I have referred it as IaaS Admin in this post)




    Name Name by which you wish to identify the Identity source
    Type You’ve option to choose from Active Directory or LDAP. Native AD option is available only for vsphere.local
    URL Provide the LDAP format even if you are using AD. It is referred as accessing AD over LDAP connection
    Domain Name of your domain
    Alias You can put any name here which is easier to remember and it helps to use to login this alias. In my case I can use or just spreetam@vZare . Both works.
    Login user DN User who has read only permissions on Active directory
    Password Password for Login user
    User search base DN Place in AD/LDAP where you wish to search the Users. I have put my Favorite company OU as a location to search users. Effectively I will be adding users only in my Favorite OU
    Group search base DN Same as above except that it will be used to search groups

    Branding and other parameters in tenant creation I left it default as there isn’t much to learn


    Configuring Tenant


    Below is the workflow we should follow to configure Tenants




    IaaS Administrator is created by administrator and is responsible to perform

    • Management of endpoints, endpoints credentials and virtualization proxy agent
    • Management of cloud service accounts as well as physical machines and storage devices
    • Monitoring of IaaS system logs


  • Here in below screen I have logged in using IaaS Admin (userid:iAdmin). Go to the myfavoritecompany tenant in the infrastructure tab (9 out of 10 times you will be in infrastructure tab).



    Let’s first create the credentials. This credential is like a template of credential which can be used several times without typing every time same credential or if credential of vCenter/endpoint cannot be shared with vCAC admins.Enter the Name for credential. I recommend to put FQDN name of the vCenter so that you’re aware of connection details. Put some short meaningful Description, Username and Password. Press the green check box.

    NB: I always keep searching for image Button. That green button should be on right hand side not left hand side.


    Go to the endpoints tab. Now here Name is the most important field. This name must match to the name you have selected while installing the vSphere Endpoint.

  • Just for reference purpose I’m pasting that screen here.
  • SNAGHTML562d69b

    imageSo now we need to put the same name as we have configured in above screen. It is case sensitive.

    imageAddress of vCenter. This is the address of end point. For vCenter it has to be https://vCenterFQDN/sdk format

    imageNow select the credentials you had created earlier. You can use integrated authentication If you have selected integrated credentials while installing vSphere agent.

    imageSelect the checkbox for Specify manager for network and security platform If  you have vShield manager (vCNS Manager) or NSX Instance in your environment. After you select checkbox you get need to put the URL and credentials for it (not shown & explored by me here. It is topic which I will deal with vCloud Director endpoint).

    imagePress OK and we are done configuring vSphere Endpoint

    At this point if vSphere endpoint is configured correctly you should see compute resources e.g. clusters are discovered. Quickest way to check this is to go to Agents tab and in the description tab from the drop down menu you should see vSphere agent. It confirms agent and endpoint are communicating



    Below depicts how data collection works out using end points and what kind of data is collected


    Organize Compute Resource

    In order to organize resources we must create fabric group. Fabric group manages resources within their group. e.g. if you create a fabric group just for virtual resource then it cannot manage anything outside this assignment. Below I have create a fabric group and assigned a vCluster (later on I renamed this cluster to Gold cluster to make sense). So VirtualFabgroup will be able to manage only resources inside vCluster. However these resources are restricted to Memory and Storage as we will see it during creation of reservation.

    This where vCloud Director must more superior product. You can configure things at much more granular level

  • image

  • Type name for Fabric Admins as VirtualFabgroup. This name should reflect type of fabric this group is going to manage. It helps a lot. Assign administrator to manage this Fabric as shown below. Select the resource it will manage.

    Now that we have organize resource and appointed fabric admin. Let’s use fabric admin credential to login. It is worth noting all configuration till has been done by IaaS admin

    Fabric Administrator Role

    Machine Prefix

    You cannot create business group before creating Machine Prefix. It is must parameter for business group. You need at least one machine prefix. As mentioned above machine prefix are created by Fabric admin. Using Fabric admin lets create some meaningful prefix


    I have created another two prefix offline just in case we need it and named them starting with CC-UAT and CC-DEV as seen below


    Business Group

    Now that machine prefix is sorted out, let’s do business group. Business group represents BU within a organization. It could represent sales BU, Marketing BU or HR BU. In below example I considered  Sales BU. So if tenant is organization then BU becomes part of Tenant.


  • You get an option within business group to create Business group administrator, support user and end user.

    Business group manager Role 

    1. Approves machines and lease requests.
    2. Manages machines created by all users in the business group.

    Business Support Role: Support user helps you to request resources on behalf of the user. User role can request/self-provision machines/services from the catalog

    Name for the Business group. Ensure it reflects Business group name.

  • Business group admins group/user name.
  • Email id of business group admin.
  • Support Role.
  • User Role.

    Active directory container is optional, I left it unfilled.


    Only Tenant Administrators can create business group


    Create Reservation and Reservation Policy

    Using fabric admin credentials lets create a simple reservation

    Click Infrastructure tab, –>> Click Reservations, –>> select Reservations, –>> click New Reservation, –>> vSphere (vCenter)



    I have not configured reservation policy. I left machine quota and Priority to default values.

    Lets move to Resources tab. Actual reservation is done here. You choose to reserve memory & storage. In Memory section you get to know how much of is available i.e. Physical, How much is reserved and how much is allocated out of this reservation.


    Similar way I have reserved 27 GB out of 40 GB on Gold cluster. None is allocated.

    Finally select network label by moving into Network tab. I have just one network label. But you can have as many as. But remember you must plan about it in advance.


    I think I’ll pause my post here as I see it is already very big. But I’ll continue in next post. That being said lot of configuration of tenant is still pending.

Appendix-A Modifying existing VPG & End of Zerto Series

I purposely mentioned this as appendix post. As it some information which cannot be part of series. It could be a part of day to day operations.

One of the primary reason to modify existing VPG is adding VMs to it. You can add VMs to existing VPG using Web/C# client and Zerto UI. If you use Web/C# client you get three options

1. Add to Virtual Protection Group (VPG): Add VM to existing VPG

2. Protect As Standalone VM: Create a new VPG. VPG is created with name of the VM.

3. Create a New VPG: Create VPG with default name and add VM to it.


Note: Adding or removing VM from the VPG results in deletion of all check points and check point mechanism restarts after synch operation is complete.

After modifying VPG two tasks are initiated one after another. First task VPG definitions are updated.. Unless & until this task is completed next task cannot begin. In Second task changes are synchronized with the recovery site.

If the default values like host, Folder location, Failover Network or Test Network is changed, these values are applied to the existing VM automatically. You must go and change these values for that VM. But good thing is –you are made aware of it via pop warning.

If for whatever reason you wish to unprotect your VMs, you get option to delete the recovery volumes “Keep target disks at the peer site”. This can be helpful if you wish to re-protect the VM in future. Volume of the VM at the Recovery site can be used for pre-seeding.

If you re-size VM or remove volumes at the protected site, they are automatically reflected at the recovery site except if it is RDM


The End of Zerto Series

Here is my conclusion about Zerto and my experiencing while blogging it.

Zerto series is my understanding of product. For some reason I felt I should know this product. I requested a Demo and they happily agreed to give me evaluation license. I got it for a year. I’m quite pleased.

Thanks to Zerto’s Shannon for being so kind. I started with basic architecture, then went straight into installation and configuration. At someone point I simply followed Installation & configuration instruction and provided my thoughts against features which I found helpful. It is wonderful product for many reason. I specially likes its integration with vCloud director and DR support for vCloud Director.It was the first company to introduced Hypervizor based replication and was in complete in-line with the concept in Software defined datacenter. There are various blog series officially from Zerto which compares various solution available in the market.Quite recently Zerto has choose to introduced 101 Zerto as Mastering DR. Another wonderful series.Please follow it. I must admit I have scratched the surface of this product. There are many more thing I couldn’t cover due to other priorities. My next focus would be vCAC6.0 and its integration with vCloud Director and vCenter.

If you are first time visiting this page, please go to Landing Page to follow entire series of Zerto

Happy blogging !!!

Part:11 Live Failover & Move Operation Procedures in Zerto

The Live Failover operation procedure highlights specific steps for a DR test. Complete explanation of DR and Move operation is mentioned over here. Here I’m explaining same steps in pictorial format.

Steps for Live Failover (Live DR) are same as Failover Test. Only difference you see is commit policy screen



In above screen you see Live button is toggled, Failover arrown becomes Red. Press Failover button to proceed. Select VPG you wish to failover shown in figure:01.

By default “Shutdown Protected VMs” is no. In Failover operation it is assumed VMs are already shutdown or not available. If you are doing simulate DR, you can manually shutdown the virtual machines. If you’ve good number of VMs you may evaluate a scripting option. Or you can use either “Yes” or “Force” option as shown below. I have used Force option.



If you use “Yes” option and VM doesn’t shutdown gracefully, entire process is aborted. Always use force option if unsure. If this is Simulate DR it is recommended to manually shutdown VMs.

For simulate DR it is recommended to Insert a new checkpoint. For more details on check point and how to take one, please refer here.This avoids potential data-loss since the VMs are shut down and the new checkpoint is added after all I/Os have been written to disk. In figure:02 You can see that I smartly named the checkpoint as “BeforeLiveFailover”

Let me digress here. I need to discuss Rollback and commit options. Both options can be executed automatically or manually. For automatic execution, All you have to do is provide how long you want either of the option to be executed. Maximum time by which you can delay rollback/commit option is by 24 hours.

Rollback allow us to go back to the same state before live failover. When all VMs are available in DR site, user can test application and save data. But rollback option was used, data won’t be saved. All changes made to the applications after live failover will be lost.

Commit is exactly opposite of rollback. All changes made when DR is activated will be saved. Therefore application state will change when you failback VMs.

There is very important thing to note. When you use commit option during move operation only you get to select whether you want to provide reverse protection (refer figure 14). If you don’t select reverse protection then all VMs at the protected site are lost. VMDK’s are deleted. So when you configure reverse protection later it is full sync and will delay VMs protection.

Ok, lets get back. Now you have to press final button i.e. Failover. Background is colored Red which indicates a Big Warning. If you read a text you will understand this operation permanently changes VMs at both protected and recovery site.



After pressing failover button VMs in the VPG are either shutdown gracefully or forcefully assuming you choose the appropriate option



In below screen DR is in progress.



Now lets see what happens at DR site. All VMs are in the process of being powered ON, reconfigured and booted according to the boot order. Failover Before Commit (recovery site) is completed.



During execution of this test I’ve de-selected Commit Policy option which is the reason you see that task name as Failover Before Commit.

Now that basic OS services are started, Application are accessible  let end user test their applications. After successful confirmation from application users you can end the DR Live Test. Now it is time to failback DR back to protected site.

Rollback Option

I have done two tests here. One using rollback and other using commit option. Below I have shown screens of both the operations.



I first choose Rollback option. Rollback option simply powers off VMs (hard reset) and power ON VM at the recovery site. Nothing is saved. VMs are as good as they were before the DR simulation. Rollback option is kind of test feature, if VM doesn’t boot properly you can always rollback

Here is the view of recovery site



Commit Operation

Now lets see screens when you do a commit operation. Here you select commit option. Then you get option to select reverse protection.Failback procedure will use original disks are pre-seeded disk (automatically without specifying it). This will expedite the replication/ delta sync.

However as explain above in move operation this behavior is completely different and dependent on selection of reverse protection option



Reverse protection you can configure similar options in VPG as we did in during initial configuration of VPG here. All of them are same not much to explain.



Move Operation

User interface to initiate Move is almost same. You just need to select Move , Select VPG, press Next



Select Commit Policy which is same as Failover operation.  In move operation you have only one option i.e. to force shutdown. If you don’t select it and one of VMs do not power off, operation is aborted. But you will see in failover operation you have option to select Shutdown VMs (No (default), Yes, Force). Refer Figure:02 at the top








In this process I have not select reverse protection and I have used commit policy. Therefore after you enable reverse protection full sync will happen.



Since we not selected reverse protection option all VMs at protected site got deleted which is an expected behavior.







Since all VMs must be synched. Below image shows the amount of data that is left to be synched.



If you wish to follow entire series of Zerto go to the Landing Page

Part:10 Failover Test Operation Procedures in Zerto

In previous post I discussed basic DR procedures. In this post allow me to discuss Failover Test Operation (sand box testing). Primary reason to do this test is to ensure VMs are properly replicated, they can start in particularly defined order without any resource constraints at DR site especially compute. No end user testing is allowed. It can be done but best be avoid. Choose the reason for sandbox testing and proceed accordingly.

Failover Test is completely non-disruptive as this test doesn’t touch any production work load. It creates VMDK based on scratch volumes (using Journal History) in thin format. Using scratch volumes eases the clean up process. In this test VPGs continue to replicate, create new checkpoints (automatically or manually).

Failover Test Operation has following basic steps


It is recommended to test all VPGs of a cluster, this will ensure all VMs belonging to the cluster are successfully recovered. It also assure that there is no resource constraint and there is sufficient capacity to restart VMs.

During my experience I have seen VMs provisioning request continue to grow. VMs which need DR service also continue to grow, IT manager remains ignored to see if the DR site has sufficient capacity to power on the VMs. DR tests of all VPG in a cluster will give you clear picture and heads up as to when you will need more capacity addition at DR site.

Actual Procedure to start DR Test


Failover button you see at the bottom right hand corner is common for both Test DR or Live DR. You need to toggle button as shown below



The moment you toggle it Live, it turns Failover to red color (not shown in this figure).

In SRM you get pop-up warning. I would expect similar mechanism to be adopted by Zerto. It helps a lot.

ok. Now press toggle switch for Test and Press Failover Button. In next screen you should select all the VPG you wish to test. Press Next >


In above screen you have major decision point. You must select checkpoint. I have separate blog post on Checkpoint here. Please go through the posts for detailed explanation. Let me explain checkpoint in short for you- you get to select as to which point you wish to restore VM at DR site to test. You get to choose both automatically created checkpoint and manually created checkpoint.


After checkpoint is selected press Next, select Failover button and DR Test starts.


Highlighted in yellow is DR Test progress status


Above figure provides task list which gets executed at vCenter of DR site.


In above figure you can’t see VMDK at all. It explains VM is created out of scratch volume which is not visible in the original place.

Please do note that VMs names are appended with “testing recovery”


Since we are in DR test, the only option left is to do Live Failover. You can do a move operation as well. It is worth noting you can do Failover even if DR test is going on. Unsure if any such scenario is really going to happen. But it is DR product it address all unanticipated challenges and protect Business reputation.

Roll back Procedure

Roll back procedure will simply delete these test VM. Procedure is simple in the same screen i.e. VPG tab we can use stop button “Stop Failover Test” to stop DR test. Select the VPG and press “Stop Selected”


At DR site you can see list of task executed in below figure after rolling back DR test


When DR Test roll back is completed Checkpoint by the name “StartDateAndTimeOfTest (Using checkpoint) Below similar checkpoint is created. We tested on 1st Jan, 2014 using last checkpoint which was taken on Checkpoint of 31st Dec, 10:42 PM



Recovery Reports

Most important part of DR product is about reporting. Be it actual DR or DR test. In order to get reports, go to reports tab > from drop down select Recovery reports


Select the date, VPG and other options and click generate PDF Report or PDF Reports  (Zipped). I’m pleased with report and its description. Well format definitely helps to prove both IT manager and Business manager. I have uploaded sample recovery report here as it was bit difficult to share it via blog post.

If you wish to follow entire series of Zerto go to the Landing Page

Part: 09 Basics about Recovery Procedures in Zerto

Zerto provides various options to transfer VMs from Protected site to Recovery site. Let’s discuss all of them in this post

Move operations

  1. VMs are moved to recovery site
  2. VMs can be re-protected by reversing the direction of replication
  3. Move operation is generally done when protected site needs some maintenance done. More technically it is called Planned migration. In planned migration it is assumed protected and recovery sites are operational.
  4. Move differs from failover. In move operations VMs are automatically shutdown. VMs cannot be restored to any checkpoint. They are restored only to last known checkpoint. Final checkpoint is taken to ensure data integrity
  5. You can initiate move either from protected site or recovery site UI
  6. After checking VMs on the recovery site, you can commit which moves VMs to Protected site or you can rollback which deletes VMs at recovery site and power ON the machines at the protected site.
  7. If reverse replication is not configured, there is no protection for the recovered machines.

Uncommitted Move Operations

  1. Changes made while VMs in recovery site are not saved
  2. Difference between Failover Test Operation (described below) and Uncommitted move operations is that Failover test operation boots VM on test network, while uncommitted move operations boots VM on production network. This allows end user to do end to end testing of their application
  3. All changes are saved in scratch volumes to enable roll back. This operation can continue till scratch volume is full. Scratch volume size is determined by journal size hard limit (by default unlimited) and journal history (by default 4 hours)

Failover Operations

  1. It is always invoked after DR has occurred or one has to simulate DR (i.e. breaking link between the sites).
  2. Failover operation assumes connectivity between the sites is broken BUT VMs and Disks are not removed.
  3. VMs must be manually shutdown to avoid two instance running at the same time
  4. In Failover operation you can always select from the list of checkpoints available
  5. If both the ZVMs are reachable. Three options are available
    1. Do nothing i.e. VMs on protected sites are not touched
    2. VMs can be shutdown gracefully, if VMs do not shutdown operation is aborted
    3. VMs are forcefully shutdown and operation continues
  6. VMs are created at recovery site, VMDKs are attached, DR network is attached. VMs are powered ON as per the Boot order is followed.
  7. The default is to automatically commit the failover operation without testing. Optionally you can change the commit or rollback option. In commit operation failover is finalized and in rollback back, aborting the operation
  8. After failover operation is completed i.e. After application and business owners confirm services are running and original protected site is up you can use move option to move recovered VMs back again.

Failover Test Operations

  1. Failover test operation creates test virtual machines in a sandbox
  2. It uses test network specified in VPG definition
  3. It restores VM to a specified point of time using scratch volumes (managed by VRAs). Scratch volumes are thin provisioned vdisks, one per VM in the VPG
  4. Production VMs are not impacted during failover test operations. Since checkpoints continue to be generated, they continue to replicate.
  5. Failover test operations is time limited. Time is based on size of journal history available at the recovery site and journal size hard limit (by default unlimited) configured
  6. Following things can be tested using failover Test operation without impacting any production servers
    • VMs are replicating
    • VMs can be powered ON
    • Guest OS inside VM can boot
    • VMs get IPs as per policy defined in Test network configuration
    • VMs can be restored any checkpoints

Clone Operations

  1. Clone operations copies VM across the WAN
  2. Use cases: You wish to save VM to specific point in time (especially when you want to restore to specific point without having any dependence on checkpoints)
  3. Clones machines are not powered on
  4. Cloned machines names are appended with time stamp of checkpoint’s used.
  5. Cloned VMs are standalone VMs i.e. they are not paired with original VM for any kind of replication. Any changes made to the protected VM after clone operations are not updated with its cloned counter part

Below table explains various procedure and it’s impact

DR Procedures


Move Operations

Move operation has huge impact to the environment. Must have CEO level approval.

Failover Operations

Business critical situations. Entire operations is down. Need CIO/CEO level approval to start recovery

Clone Operations

Medium impact especially to network traffic between the site. Need at least to be informed to CIO/CEO and approval from Business head

NB:I have not included Failover Test operation as it has Zero impact

I will explain each procedure in detailed in following posts

If you wish to follow entire series of Zerto go to the Landing Page

Landing Page for Zerto

I see Zerto is getting huge hits in my blog. I had always an intention to create a Index page for all Zerto articles and blog post once series is over. Apparently the blog post has already cross double digit number, one of my linkedin colleague requested me to do so. Thanks Sudhish. Here it goes. Now there are internally links to the article as well

  1. Introduction of Zerto
  2. Installing Zerto using Express option
  3. Installing Zerto using custom option & Using Zerto Interface using vSphere Client
  4. Getting familiar with Zerto User Interface (UI) -vSphere WebClient
  5. Installing VSS Agent from Zerto
  6. Installing & Configuring Zerto Virtual Replication Appliance (VRA)s
  7. Create and Configure Virtual Protection Group (VPG) in Zerto
  8. Advance Configuration of Zerto Virtual Replication
  9. Discussion on monitoing Virtual Protection Group (VPG) in Zerto
  10. Checkpoints in Zerto (Automatic & Manual)
  11. Basics about Recovery Procedures in Zerto
  12. Failover Test Operation Procedures in Zerto
  13. Live Failover & Move Operation Procedures in Zerto

Update: Zerto is not currently certified by VMware Certification Program. If you are using it for production purpose refer KB: 2069900 & do not hesitate to contact Zerto

Thanks to Michael. I’m regular reader of his blog