What’s New in VMware Cloud Foundation 9.0 – Automation (HOL-2610-02-VCF-L)

Ready to unleash true self-service private cloud automation? VMware Cloud Foundation (VCF) 9.0 is packed with robust automation features, and the HOL-2610-02-VCF-L lab is your guided hands-on tour to master them.

Whether you’re a cloud admin, service provider, or an automation enthusiast, this lab takes you from zero to hero, showing you exactly how VCF 9.0 streamlines infrastructure operations, enforces governance, and accelerates modern application deployment. Here’s an inside look at what you’ll experience.

🎓 Module 1: Getting Started with VCF Automation

⏱️ Length: 15 min | Level: Beginner

You’ll kick things off with the new Quick Start Wizard, a major usability boost in VCF 9.0. It offers both manual and automated workflows to configure your environment in minutes.

💡 Lab highlight: Experience an interactive simulation that mimics a real deployment—perfect if you want to see the process without spinning up actual infrastructure.

🗂️ Module 2: Dive Into the Provider Portal

⏱️ Length: 15 min | Level: Beginner

The Provider Portal is your mission control. In this module, you’ll:

✅ Explore the Infrastructure Overview—see organizations, regions, supervisors, and content libraries at a glance.

✅ Configure Access Control—add users, assign or create custom roles, and manage permissions.

✅ Connect Identity Providers—integrate OIDC, LDAP, or SAML for centralized authentication. Bring your enterprise-grade security posture directly into VCF Automation.

🏢 Module 3: Master Organization Management & Governance

⏱️ Length: 30 min | Level: Advanced

Here’s where things get powerful:

✨ Content Libraries: Learn to create tenant-specific libraries to manage VM images and deployment blueprints. Unlike provider libraries, these are isolated per organization, supporting granular control.

🔑 IaaS Policies: Enforce compliance automatically. Create policies to govern how resources are provisioned and what users can do post-deployment. For example, the lab guides you through setting an IaaS Resource Policy to block unauthorized VM deployments—then tests it live to see policy enforcement in action.

🧭 Governance Tools: Leverage centralized billing, resource sharing, and collaboration while keeping strict security boundaries between tenants.

☁️ Module 4: Deploying Modern Applications

⏱️ Length: 30 min | Level: Advanced

This final module shows how VCF 9.0 transforms modern app delivery:

🐳 Supervisor Clusters: Understand how vSphere Supervisor and Namespaces abstract infrastructure complexity, letting users consume IaaS resources through Kubernetes APIs.

⚙️ Blueprint Design: Hands-on time! You’ll deploy:

A Virtual Machine using a pre-defined blueprint and YAML.
A Kubernetes Cluster with just a few clicks.

🔍 Day 2 Operations: Explore post-deployment operations—view resources, manage them through intuitive interfaces, and understand the cloud-native approach to scaling and managing workloads.

✅ Why This Lab is a Must-Try

By the end of HOL-2610-02-VCF-L, you’ll have practical experience with:

Building tenant organizations
Managing user access and identities
Enforcing organizational policies
Deploying VMs and Kubernetes clusters on-demand

Deep Dive: What’s New in VMware Cloud Foundation 9.0 – Platform (HOL-2610-01-VCF-L)

If you’re ready to level up your understanding of modern cloud infrastructure, the HOL-2610-01-VCF-L Hands-on Lab is your best launchpad into VMware Cloud Foundation (VCF) 9.0. In this detailed guide, I’ll walk you through the lab’s structure, key learning points, and the new features it reveals — straight from VMware’s latest release.

📌 Lab Overview

This lab is perfect for beginners and experienced admins alike. In about 75 minutes, it covers:

✅ Module 1: VCF Constructs, Components, Operations, and Identity
✅ Module 2: How to Deploy VCF — from scratch or by converging existing infrastructure
✅ Module 3: How to boost productivity with Virtual Private Clouds (VPCs)

By the end, you’ll know how to build, manage, and scale a robust private cloud platform with the very latest VMware tools.

🔑 Module 1 — VMware Cloud Foundation Overview

👉 Key Constructs

At the core of VCF 9.0 are a few new concepts:

VCF Private Cloud: The top-level logical unit, representing your entire managed cloud.
VCF Fleet: A set of resources managed together — including VCF Operations & Automation.
VCF Instance: The building block of a Fleet — includes a Management Domain (for control) and optional Workload Domains (where user apps run).
Availability Zones & Regions: Logical segments for fault tolerance and geo-distribution.

👉 Updated Components

VCF 9.0 refines its component structure:

VCF 5.x	VCF 9.0
VMware Cloud Builder	VCF Installer
SDDC Manager	SDDC Manager (via VCF Operations)
VMware Aria Ops	VCF Operations
VMware vIDM	VCF Identity Broker

The new VCF Operations console unifies:

Monitoring & Health: Diagnostics, resource health.
Lifecycle Management: Patching and upgrades.
Fleet Management: SSO, certificates, tags, config drift.

Bonus: The new VCF Identity Broker (IdB) replaces vIDM for Single Sign-On — making authentication cleaner and more integrated.

🛠️ Module 2 — Deploying VMware Cloud Foundation

You have two main options:

✅ Deploy New

Plan: Use the Planning Workbook to gather FQDNs, IPs, VLANs, and credentials.
Prepare: Ready your ESX hosts.
Deploy: Use the VCF Installer Appliance, which now supports Python, Java, PowerCLI, and OpenAPI 3.0 — so automation is a breeze.

🔁 Converge Existing Infrastructure

Already have vCenter and ESX running? Good news:

You can upgrade and converge your environment to VCF 9.0 using the Installer.
Supported topologies include everything from simple clusters to more advanced setups with Aria Ops and Automation.

Tip: The lab’s Interactive Simulations show exactly how this works, step-by-step.

🌐 Module 3 — Increase Productivity with Virtual Private Clouds (VPCs)

A major highlight of VCF 9.0 is its native VPC and Transit Gateway support:

VPCs provide a consistent, multi-tenant network model, visible directly in vCenter.
Admins and end-users can deploy, manage, and monitor VPCs alongside compute and storage.
It simplifies cloud-like networking inside your private cloud — no need to hop between tools.

🔒 Day 2 Capabilities

Beyond setup, the lab also covers:

Lifecycle Depots: Online/Offline binaries for flexible upgrades.
Password & Certificate Management: Update, remediate, or auto-renew easily from the console.
Config Drift & Tags: Monitor deviations from desired configs and keep objects organized.
Security & Compliance: Visualize your fleet’s security posture, audit events, and remediate risks — all in one dashboard.

📚 Key Takeaway

The HOL-2610-01-VCF-L lab is more than an overview — it’s a practical sandbox to test VMware’s latest unified operations, automation, and networking innovations for private cloud. Whether you’re modernizing existing clusters or starting fresh, VCF 9.0’s new tools streamline every step.

🎓 Try It Yourself

✅ Duration: ~75 mins
✅ Free & self-paced
✅ Includes guided interactive simulations

👉 Start now: VMware Hands-on Labs — or search for HOL-2610-01-VCF-L

What’s New in VMware Cloud Foundation 9.0: Your Guided Tour with VMware Hands-on Labs

Ready to dive into the exciting world of VMware Cloud Foundation (VCF) 9.0? The latest release brings powerful new capabilities for modern, unified private cloud environments — and the best way to get hands-on is with the updated VMware HOLs.

Below, I’ve rounded up the top new labs covering Platform, Automation, Operations, vSphere updates, and Kubernetes integration — so you can quickly see what’s new and where to start.

☁️ 1️⃣ What’s New in VMware Cloud Foundation 9.0 – Platform

Lab: HOL-2610-01-VCF-L
Level: Beginner
Modules:

VMware Cloud Foundation Overview (30 min) – Get familiar with core concepts like Private Clouds, Fleets, and Instances.
Deploying VMware Cloud Foundation (30 min) – Walk through planning, deployment, and convergence of existing infrastructure with the VCF Installer.
Increase Productivity with Virtual Private Clouds (15 min) – Explore how VPCs and Transit Gateways enable flexible, multi-tenant networking, tightly integrated with vCenter.

✅ Why take this lab? It’s your foundational guide to the new VCF Operations interface and the deployment workflow — great for newcomers or those upgrading from older VCF versions.

⚙️ 2️⃣ What’s New in VMware Cloud Foundation 9.0 – Automation

Lab: HOL-2610-02-VCF-L
Level: Beginner–Advanced
Modules:

Getting Started with Automation (15 min) – Learn to set up tenant orgs using the quick start wizard.
Provider Portal (15 min) – Get to know infrastructure overview, access control, and identity providers.
Organization Management and Governance (30 min) – Dive deep into content libraries, IaaS policies, and governance.
Deploying Modern Applications (30 min) – Practice deploying VMs and Kubernetes clusters for modern apps.

✅ Why take this lab? Automate self-service private clouds, enforce governance, and speed up application delivery — key skills for cloud admins and SREs.

🛡️ 3️⃣ What’s New in VMware Cloud Foundation 9.0 – Operations

Lab: HOL-2610-03-VCF-L
Level: Beginner
Modules:

Monitoring Private Cloud Infrastructure (30 min)
Monitoring Network Operations (15 min)
Monitoring Storage Operations (30 min)
Monitoring Security Operations (15 min)
Chargeback (15 min)

✅ Why take this lab? Master health monitoring, flow analysis, vSAN management, security operations, and cost transparency with chargeback — all with the new unified Operations interface.

⚡ 4️⃣ What’s New with vSphere in VMware Cloud Foundation 9.0

Lab: HOL-2630-01-VCF-L
Level: Beginner–Advanced
Modules:

vSphere 9 Overview (30 min)
Lifecycle Manager (15 min)
Resource Management (30 min)
Guest OS and Workloads (15 min)
Mixed Vendor Clusters (15 min)
Live Patch (15 min)
Memory Tiering (15 min)
Licensing and Operations (15 min)

✅ Why take this lab? Learn how vSphere 9.0 simplifies license management with Unified Licensing, enhances performance with Memory Tiering, enables Live Patching with zero downtime, and makes cluster lifecycle operations smoother — even across mixed hardware vendors.

☸️ 5️⃣ Unifying VM and Kubernetes Management with vSphere Supervisor

Lab: HOL-2633-01-VCF-L
Level: Beginner
Modules:

What is the vSphere Supervisor? (15 min)
How does the vSphere Supervisor work? (30 min)

✅ Why take this lab? See how vSphere Supervisor bridges VMs and Kubernetes, get hands-on with configuration, and deploy Kubernetes clusters alongside traditional VMs — all from vCenter.

🎓 Ready to Learn?

All these labs are free, self-paced, and available right now in the VMware Hands-on Labs catalog. Whether you’re planning a fresh deployment, modernizing operations, or integrating Kubernetes, these labs ensure you’re ready to make the most of VMware Cloud Foundation 9.0.

👉 Check out the labs and start exploring: VMware Hands-on Labs

The MOB is disabled – How to Enable the Managed Object Browser in vSphere 9

When you try to access the Managed Object Browser (MOB) on your vCenter Server, you might be greeted with a screen like this:

“The MOB is disabled — The Managed Object Browser on this server is currently disabled. Please, contact your Virtual Infrastructure Administrator to enable it.”

Starting with vSphere 9, the MOB is disabled by default for security reasons. If you need to enable it (for example, for debugging or advanced troubleshooting), you can do so by editing the vpxd.cfg configuration file.

Below are the steps to enable the MOB safely:

✅ How to Enable MOB in vSphere 9

1️⃣ Take a backup of the configuration file

cp /etc/vmware-vpx/vpxd.cfg /var/core/vpxd.cfg

2️⃣ Open the config file in a text editor

vi /etc/vmware-vpx/vpxd.cfg

3️⃣ Add or update the entry
Inside the <vpxd> block, add:

<enableDebugBrowse>true</enableDebugBrowse>

For example:

<vpxd>
  ...
  ...
  <enableDebugBrowse>true</enableDebugBrowse>
  ...
  ...
</vpxd>

4️⃣ Restart the vpxd service

service-control --restart vmware-vpxd

📚 Reference

For more information, see the official KB: How to disable access to the Managed Object Browser

✅ Tip: Remember to disable the MOB again after use to follow security best practices.

Installing and Using the vCert Tool

vCert is a powerful certificate management utility developed for VMware Cloud Foundation environments. It allows administrators to inspect, manage, and replace certificates across the vCenter Server infrastructure with minimal effort. This article walks you through the installation and usage of the vCert v6.0.0 tool.

🔧 Installation

To begin, download the vCert tool archive provided in the related article and upload it to your vCenter Server appliance. Once uploaded, execute the following commands to extract and run the tool:

# unzip -q vCert-6.0.0-20250218.zip
# cd vCert-6.0.0-20250218
# chmod +x vCert
# ./vCert.py

Running the Script

To display help options:

# ./vCert.py --help

Arguments available:

--env ENVIRONMENT: Load environment config file
--run OPERATION: Execute operation without menu
--user USER: Provide SSO administrator username
--password PASSWORD: Provide corresponding password

Once launched interactively, you’ll see a menu:

VCF Certificate Management Utility (version 6.0.0)
-----------------------------------------------------------------
 1. Check current certificate status
 2. View certificate info
 3. Manage certificates
 4. Manage SSL trust anchors
 5. Check configurations
 6. Reset all certificates with VMCA-signed certificates
 7. ESXi certificate operations
 8. Restart services
 9. Generate certificate report
 E. Exit

🗂 Logs and Files

Logs: /var/log/vmware/vCert/vCert.log
Temp/Backup files: /root/vCert-master/YYYYMMDD

Temporary files (except backups) are deleted on exit.

🧪 Menu Options Overview

1️⃣ Check Current Certificate Status

Performs a comprehensive health check:

Expiry validation
SAN (Subject Alternative Name) presence
Key usage compliance
CA validity and signature algorithm checks
Solution User to Service Principal consistency

2️⃣ View Certificate Info

Displays readable info for:

Machine SSL and Solution User certs
CA certs (VECS & VMware Directory)
STS, SMS, Smart Card, and LDAPS certs

3️⃣ Manage Certificates

Replace or modify certificates for:

Machine SSL
Solution Users
STS Signing
Smart Card CA
LDAPS Identity Source
VECS and VMware Directory CA stores
vCenter Extensions & SMS

Supports PEM/DER, PKCS#7, and PKCS#12 formats.

💡 Certificate chains must be complete when importing custom CA-signed certificates.

4️⃣ Manage SSL Trust Anchors

Validate trust anchors used by Lookup Services
Update anchors across SSO domain nodes

5️⃣ Check Configurations

Includes:

SSL interception detection
STS store alignment (e.g., legacy vs. MACHINE_SSL_CERT)
VECS store health and permission checks

6️⃣ Reset All Certificates

Resets:

Machine SSL
Solution User
STS signing
…all signed by the VMCA.

7️⃣ ESXi Certificate Operations

Manage ESXi host certificates:

Validate trust alignment between vCenter and ESXi
Check DB consistency
Replace host certificates (rui.crt, rui.key, castore.pem)

🔁 Requires host service restart & vCenter re-connection.

8️⃣ Restart Services

Options:

Restart all VMware services
Restart specific service by name

9️⃣ Generate Certificate Report

Outputs a detailed report covering:

VECS entries
Service Principals
STS entries
Smart Card and LDAP certs
Lookup Service SSL anchors

Saved under: /var/log/vmware/vCert

📌 Summary

The vCert 6.0.0 tool is an essential utility for environments where certificate lifecycle management is critical. Whether you’re replacing a Machine SSL cert, troubleshooting expired STS tokens, or ensuring trust between vCenter and ESXi hosts, vCert provides a safe and guided workflow.

Remember: always use with caution and ensure full system backups are in place before making change

Link for use Manage Certificates menu to check and replace the certificates.

VMware Cloud Foundation (VCF) Brownfield Deployments

VMware Cloud Foundation (VCF) provides a unified platform for managing hybrid clouds, but the deployment process differs between Greenfield (new) and Brownfield (existing) environments. Brownfield deployment involves integrating pre-existing infrastructure into the VCF framework.

Preparing to Use the VCF Import Tool

The VCF Import Tool is essential for transitioning existing infrastructure into the VCF framework. Here’s a step-by-step guide to preparing the tool:

Download the Necessary Files:
- SDDC Manager OVA: The foundation for managing VCF.
- VCF Import Tool: Enables import and integration of existing infrastructure.
- NSX Install Bundle: Configures the networking components for VCF.
Deploy SDDC Manager:
- This step is necessary for “convert” use cases to establish centralized management within VCF.
Extract the Import Tool:
- Transfer and configure the import scripts within the SDDC Manager.
Copy NSX Bundle:
- Ensure the NSX configuration is uploaded for seamless network integration.

Convert Workflow: Transitioning Infrastructure to VCF

The Convert Workflow addresses the challenge of adapting existing environments to align with VCF’s architecture. Follow these steps:

Verify Prerequisites:
- Confirm that SDDC Manager is running version 5.2 or later.
- Ensure all required files (Import Tool, NSX bundles) are uploaded.
Run Pre-Check Scripts:
- Validate the current environment using the Import Tool’s pre-check capabilities. This step identifies configuration issues or incompatibilities.
Create NSX JSON:
- Generate a JSON file to map the existing network configurations into VCF’s NSX environment.
Convert Management Domain:
- This final step transitions the management domain to align with VCF’s integrated control and automation.

Import Workflow: Integrating Existing Components

For specific components or domains, the Import Workflow provides a framework to incorporate them into VCF:

Check Prerequisites:
- Confirm readiness by ensuring the infrastructure meets the required configurations.
Generate NSX JSON:
- Map existing NSX configurations into a JSON format suitable for VCF integration.
Import Workload Domains:
- Import and integrate vSphere and NSX components into the VCF ecosystem.

Sync Workflow: Maintaining Infrastructure Alignment

The Sync Workflow ensures continued alignment between the existing infrastructure and VCF:

Verify Prerequisites:
- Confirm that SDDC Manager is operational and all required scripts are present.
Sync Workload Domain:
- Synchronize the workload domains with VCF’s management systems, ensuring consistency and reliability.

VCF Import Tool Options and Parameters

Below is an overview of the key actions and parameters available in the VCF Import Tool:

1. Help and Version Commands

-h, --help
Displays the help menu for the VCF Import Tool, outlining available commands and their usage.
-v, --version
Shows the current version of the VCF Import Tool.

2. Core Actions for Brownfield Deployments

convert
Converts an existing vSphere infrastructure into a management domain within SDDC Manager.
check
Validates if a vCenter is suitable for import as a workload domain in SDDC Manager.
import
Imports an existing vCenter as a VI workload domain into SDDC Manager.

3. Sync and Deployment Operations

sync
Synchronizes configuration between an imported VI workload domain or a workload domain deployed from SDDC Manager. This helps manage configuration drift between vCenter Server and SDDC Manager.
deploy-nsx
Deploys NSX Manager as a standalone operation. This is useful for preparing networking configurations for workload domains.
precheck
Runs validation checks on a vCenter to identify any potential issues before starting the import or conversion process.

Critical Security Alert: Update to Fixed Version 8.0 U3d Immediately

Urgent Notice from VMware by Broadcom

VMware has announced that the security patches released on September 17, 2024, intended to address CVE-2024-38812, did not fully mitigate the vulnerability. As a result, all customers are strongly advised to update to the latest version, 8.0 U3d, immediately. Patches for the 8.0 U2 line are also available to address this issue.

This urgent advisory applies to all vCenter Server users, as the newly identified vulnerabilities pose a significant security risk. Notably, two critical vulnerabilities were reported in vCenter Server, including a heap-overflow vulnerability and a privilege escalation vulnerability. These have been responsibly reported to VMware, which has now provided updates to address them.

Key Vulnerability: Heap-Overflow in vCenter Server (CVE-2024-38812)

Vulnerability Description:

A critical heap-overflow vulnerability was discovered in vCenter Server, specifically in its implementation of the DCERPC protocol. The issue has been assigned CVE-2024-38812 and carries a CVSSv3 base score of 9.8, placing it in the Critical severity range.

Known Attack Vectors:

This vulnerability can be exploited by a malicious actor who has network access to the vCenter Server. By sending a specially crafted network packet, the attacker could trigger the heap-overflow, potentially leading to remote code execution (RCE) on the affected system.

Why You Should Patch Now

This vulnerability could allow attackers to gain control over your vCenter Server environment, putting your infrastructure at risk for unauthorized access, data breaches, or service disruptions. Given the widespread use of vCenter Server for managing virtual environments, this threat is extremely serious, especially for businesses relying on VMware for critical operations.

Patch Availability

The new patches, which can be found in the Response Matrix, have been made available for both the 8.0 U3, 8.0 U2 and 7.0 U3 versions of vCenter Server. Customers should apply the new patches immediately to ensure their systems are protected.

What to Do:

Check your version: Identify if your vCenter Server version is affected.
Apply the patches: Use the Response Matrix provided by VMware to download and install the necessary updates.
Follow VMware’s best practices: Regularly update your systems, review security advisories, and apply patches as soon as they are released to minimize security risks.

Mount VMware-vCenter-Server-Appliance-8.0.3.00400-24322831-patch-FP.iso to VCSA VM. Log in to the appliance shell as a user with super administrative privileges (for example, root) and run the following commands:

# To stage the ISO:
software-packages stage --iso

# To see the staged content:
software-packages list --staged

# To install the staged rpms:
software-packages install --staged

VMware vCenter Server 8.0 Update 3c: Fixing vSphere Client Idle Session Issue

VMware has released vCenter Server 8.0 Update 3c, bringing several key improvements and bug fixes. Among these, one notable issue addressed in this release relates to the vSphere Client’s behavior when left idle for extended periods.

PR 3439359: vSphere Client Session Becomes Unresponsive After 50 Minutes of Inactivity

In previous versions, particularly starting from vSphere 8.0 Update 3b, users encountered a frustrating issue with the vSphere Client. If a session remained idle for more than 50 minutes, the client would become unresponsive, making it impossible to log in or log out. Attempting to resume work in the same browser would yield no results unless all browser cookies were cleared. This was not only an inconvenience but also a disruption for administrators managing their vSphere environments.

Cause of the Issue: Apache Tomcat 9.0.91 Upgrade

The root of the problem was traced back to an upgrade to Apache Tomcat 9.0.91, introduced in vSphere 8.0 Update 3b. This upgrade brought with it a change in the default value of the property org.apache.catalina.connector.RECYCLE_FACADES. Previously set to FALSE, this value was altered to TRUE, causing sessions to become invalid after extended inactivity. This meant that any session left idle for over 50 minutes would not properly refresh, effectively locking the user out until they manually cleared cookies from their browser.

Links:

Intel Skylake CPUs Reaching End of Support in Future vSphere Releases after 8.x

As the IT industry continues to evolve, so do the platforms and hardware that support our digital infrastructure. One significant upcoming change is related to Intel’s Skylake generation of processors, which has entered the End of Servicing Update (ESU) and End of Servicing Lifetime (EOSL) phase. By December 31, 2023, Intel will officially stop providing updates for Skylake server-class processors, including the Xeon Scalable Processors (SP) series. This change is set to impact future VMware vSphere releases, as VMware plans to discontinue support for Intel Skylake CPUs in its next major release following vSphere 8.x.

Why Skylake CPUs are Being Phased Out

Intel’s Skylake architecture, introduced in 2015, has been widely adopted in server environments for its balance of performance and power efficiency. The Xeon Scalable Processor series, which is part of the Skylake generation, has been foundational in many data centers around the world. However, as technology progresses, older generations of processors become less relevant in the context of modern workloads and new advancements in CPU architectures.

Impact on VMware vSphere Users

With VMware announcing plans to drop support for Skylake CPUs in a future major release after vSphere 8.x, organizations relying on these processors need to start planning for hardware refreshes. As VMware’s virtualization platform evolves, it is optimized for more modern CPU architectures that offer enhanced performance, security, and energy efficiency.

More info CPU Support Deprecation and Discontinuation In vSphere Releases

vSphere Client Instability and Session Timeouts After vCenter Server 8.0.3.00200 Upgrade: How to Resolve

After upgrading to vCenter Server 8.0.3.00200, some users have reported issues with the vSphere Client becoming unstable, particularly after long periods of session idleness (typically 1-2 hours). This instability may manifest in a variety of ways, including session timeouts, continuous loading indicators, and errors when browsing the inventory.

Root Cause

The root cause of this instability appears to be related to a misconfiguration in how the vSphere Client handles facade recycling within the Apache Catalina Connector.

Solution: Updating the Catalina Configuration

root@vcsa-home [ ~ ]# cp /usr/lib/vmware-vsphere-ui/server/conf/catalina.properties /root/catalina.properties.bak

root@vcsa-home [ ~ ]# echo "org.apache.catalina.connector.RECYCLE_FACADES=false" >> /usr/lib/vmware-vsphere-ui/server/conf/catalina.properties

root@vcsa-home [ ~ ]# service-control --restart vsphere-ui