Short answer: this VCF pre-deployment checklist lists the 97 checks to finish before you run the VCF Installer for a new VMware Cloud Foundation 9.1 or 9.1.1 fleet: licensing, installer and depot, hardware, ESX host preparation, network, DNS, NTP, the 9.1 fleet components, firewall, certificates and passwords. Every line links to the Broadcom TechDocs page, KB article or installer API reference it comes from. Tick items as you go: your progress stays in your browser. Switch the model to Simple to hide the HA-only lines, and copy the result as Markdown for the change record.
VCF Installer OVA (VCF-SDDC-Manager-Appliance) for 9.1.x downloaded from the Broadcom Support Portal; 9.1.1 or later if you deploy from a JSON spec Deploy the VCF Installer Deploy using a JSON spec Installer location decided: outside the management infrastructure (it can deploy several platforms) or on a future management host, where it converts into SDDC Manager and keeps its FQDN A standalone ESX host is only one of the options. Deploy the VCF Installer Installer VM sized: 4 vCPU, 16 GB RAM, 914 GB thin-provisioned disk Deploy the VCF Installer Installer static IP and lowercase FQDN with A and PTR records; no more than two DNS servers; NTP servers reachable Deploy the VCF Installer Installer root and admin@local passwords meet the OVA rules: 15 or more characters with upper case, lower case, a digit and a special character Deploy the VCF Installer Depot ready: an online depot (Software Depot ID registered in the Business Services console, activation code entered in the installer) or an offline depot filled with the VCF Download Tool (VCF Offline Depot Generator ) In 9.1 the activation code replaces the 9.0 download token. Connect to an online depot Downloading binaries KB 443647 All required binaries show as downloaded in the installer before you start the wizard Downloading binaries Deployment model chosen: Simple or High Availability (HA for production; in 9.1, Simple supports only the Small size) There is no “PoC” model in 9.1. Deploy a new VCF fleet Input method chosen: the deployment wizard, or Deploy Using JSON Spec (the JSON holds no passwords); you can build the spec with the VCF JSON Builder Deploy using a JSON spec Greenfield confirmed: no existing vCenter, NSX or VCF Operations to reuse (brownfield uses the converge procedure) Deploy a new VCF fleet Converging existing vSphere Planning and Preparation Workbook 9.1.x filled in: VLANs, CIDRs, gateways, MTU, IP ranges, FQDNs, the License Server and the Management Services pool Planning and Preparation Workbook
Servers, NICs, storage controllers and vSAN devices listed on the Broadcom Compatibility Guide for ESX 9.1 (see the VCF 9 hardware compatibility check ) The VMware Compatibility Guide (VCG) is now the Broadcom Compatibility Guide. Planning and Preparation Workbook Management domain host count: 2 (Simple, NFS or FC), 3 (Simple, vSAN), 4 (High Availability, any storage); plan 4 for production “4 hosts minimum” applies only to the HA model. Supported configurations Planning and Preparation Workbook All initial management hosts from one vendor with an identical hardware profile Preparing ESX hosts KB 443862 BIOS, NIC and HBA firmware and drivers match the compatibility guide entry for ESX 9.1 Planning and Preparation Workbook CPU, RAM and storage sized with the workbook’s management domain sizing, plus 20% free capacity (VCF Host Sizing Calculator ) Supported configurations Planning and Preparation Workbook Boot device of at least 128 GB on a high-endurance disk; no SD or USB cards Planning and Preparation Workbook vSAN disks empty (no partitions, no VMFS); vSAN ESA uses certified NVMe devices Planning and Preparation Workbook vSAN ESA disks pass the installer HCL check (the override for non-certified disks is for proof of concept only) Preparing ESX hosts KB 408300 At least two 10 GbE data NICs per host (25 GbE recommended for vSAN ESA), cabled to two top-of-rack switches Planning and Preparation Workbook Supported configurations Same vmnic numbering, speed and slot layout on every host Installer API: SddcSpec BMC (iDRAC, iLO, IPMI) cabled, addressed and reachable Planning and Preparation Workbook
Every host installed with the ESX build named in the VCF 9.1.x release notes (vendor ISO if needed); the installer does not upgrade hosts Install ESX using the ISO Preparing ESX hosts KB 443862 ESX reachable from the installer on the management network Deploy a new VCF fleet vmk0 configured in the DCUI: static IP, management VLAN and gateway, on one NIC of the standard switch Configure the network on ESX hosts Hostname set to the FQDN (lowercase, same as in DNS), DNS servers set, Custom DNS Suffixes left empty Do not add a DNS search domain: the 9.1 docs say no suffixes should be listed. Configure the network on ESX hosts “VM Network” port group set to the VM management VLAN Configure NTP on ESX hosts NTP configured, enabled and running on each host (Host Client, Time Configuration) No host profile exists yet, so configure it per host. Configure NTP on ESX hosts Certificate regenerated after the FQDN is set (enable SSH, run /sbin/generate-certificates, reboot, disable SSH), or CA-signed host certificates installed Regenerate the ESX certificate ESX root credentials documented for every host (the wizard has one root password field; the JSON spec takes credentials per host) Installer API: SddcSpec Planning and Preparation Workbook Jump host that can reach the ESX management, VM management and VCF management networks Planning and Preparation Workbook
Host-facing switch ports are 802.1Q trunks carrying every VCF VLAN Configure the network on ESX hosts Planning and Preparation Workbook Separate VLAN, subnet and gateway for ESX management, VM management, vMotion, vSAN (or NFS) and host TEP Deploy a new VCF fleet Planning and Preparation Workbook Management cluster uses one VLAN, subnet and gateway per network (vMotion and vSAN are not routed between racks) Installer API: SddcSpec Planning and Preparation Workbook MTU 9000 end to end (switch ports, inter-switch links, SVIs, VDS) for vSAN, vMotion, host TEP, Edge TEP and NFS; management can stay at 1500 Management networks don’t need jumbo frames. Planning and Preparation Workbook KB 440775 TEP MTU never below 1600 (1700 or more if you can’t use jumbo frames) KB 440775 TEP addressing decided: static IP pool, or DHCP with at least one address per TEP NIC per host Planning and Preparation Workbook Deploy a new VCF fleet TEP network optional when you use only VLAN-backed VPCs 9.1.1 Deploy a new VCF fleet Planning and Preparation Workbook VLAN and gateway for the Distributed Transit Gateway (the 9.1 default network option) Planning and Preparation Workbook If you choose “VDS LAG” in the installer: matching LACP on the switches, never static EtherChannel (independent VDS uplinks are the default) if used Deploy a new VCF fleet Planning and Preparation Workbook Switch port speed matches the NIC (10 GbE minimum, 25 GbE recommended) and links come up at full speed Supported configurations IP ranges hold at least one free address per host for every network Deploy a new VCF fleet
CA decided for VCF Operations certificate management: VMCA, Microsoft CA, OpenSSL CA, or an external CA (CSR and import) VMCA certificates are CA-signed, not self-signed. Certificate management Microsoft CA: HTTPS /certsrv enrollment URL, service account, certificate template, basic authentication, time in sync if used Configure a certificate authority External CA: chain in Base64/PEM, in the order the import page documents if used Import certificates SAN for every component: the FQDN (required) and its IP (recommended); no short names; RSA 2048, 3072 or 4096 keys Certificate management Validity follows your PKI policy; auto-renewal starts 60 days before expiry and expired certificates can’t be replaced, so track renewals Broadcom sets no “2 years minimum”. Certificate management ESX certificate mode decided before the installer runs (rootCaCerts in the JSON spec for CA-signed hosts) Installer API: SddcSpec
Target versions checked against the VCF 9.1.1 Bill of Materials page The BOM is a release-notes page; the spreadsheet is the Planning and Preparation Workbook. VCF 9.1.1 Bill of Materials Installer validation passed: no errors, every warning fixed or acknowledged Deploy a new VCF fleet Deploy using a JSON spec Deployment window booked, with the network, DNS and storage teams on call Project practice (no Broadcom document) Failure plan: fix and retry the failed task, and collect a support bundle Troubleshooting deployments Runbook reviewed by the team, based on the completed workbook and the saved JSON spec Planning and Preparation Workbook Post-deployment plan: licensing within 90 days, SFTP backups, fleet depot, remaining components (logs, metrics), VCF Automation if deferred Completing your VCF platform Register VCF Operations
Most VCF checklists in circulation were written for 4.x, 5.x or 9.0. However, when you check them against the 9.1 documentation, several common lines turn out to be wrong or outdated. As a result, this VCF pre-deployment checklist replaces them:
“Minimum 4 hosts.” Only for High Availability. A Simple deployment needs 3 hosts on vSAN or 2 on NFS or Fibre Channel.“HA or PoC.” The 9.1 installer offers Simple and High Availability.“DNS search domain on every ESX host.” The 9.1 host preparation steps say to leave Custom DNS Suffixes empty.“SDDC Manager call-home for licensing” and “host entitlements.” VCF Operations talks to the Business Services console, and VCF is licensed per core (at least 16 per CPU). In addition, the installer has no license step at all, so you have 90 days of evaluation.“Download token.” In 9.1 the online depot uses an activation code tied to a Software Depot ID (KB 443647).“Collector node FQDN.” 9.1 deploys a cloud proxy; it also adds the License Server and four VCF Management Services FQDNs that older lists miss.“Same 15-character password everywhere.” The installer API sets different rules per account, from 8 to 20 characters for vCenter SSO to 15 to 64 for VCF Automation.“Port 443 from the installer to the hosts.” The workflow also uses SSH and ICMP to the hosts (KB 442379).
Start with the workbook. First, download the Planning and Preparation Workbook for your exact 9.1.x release and fill it in. Most checks confirm a value from it.Pick the model. The selector hides the HA-only lines for a Simple deployment. Lines tagged “if used” apply only when you deploy that option on day 0.Work outside in. Licensing and depot access take the longest to arrange. Next come hardware and the network, then DNS and NTP. Finally, run the installer.Keep the evidence. “Copy as Markdown” exports the checked state for the change ticket; the companion VCF JSON Builder turns the same values into the installer JSON spec.
Broadcom TechDocs, VCF 9.1: Planning and preparation (workbook), VCF components FQDNs and IP addresses , Deploy a new VCF fleet , Preparing ESX hosts , Public URLs required for VCF , Licensing overview
Broadcom developer reference: VCF Installer API 9.1.1, SddcSpec and its manager, vCenter and NSX specs (password rules)
Broadcom KB articles linked per line, among them KB 443647 (activation code), KB 313548 (counting cores), KB 439240 (NTP for VCF Operations) and KB 443862 (mixed-vendor hosts)
My VCF 9.1 course and Hands-on Lab notes, cross-checked against the documents above
Related on vDan: VCF JSON Builder , VCF Host Sizing Calculator , VCF Offline Depot Generator , ESX PXE boot server generator , VCF 9 hardware compatibility check