vD vDan VMware · VCF · NSX · K8S

VCF ESX Boot Server Generator

Short answer: an ESX PXE boot server that netboots the ESX 9 installer needs three things on one Linux box: a DHCP answer that names the boot file (proxyDHCP next to your existing server, or dnsmasq as the authoritative server), mboot.efi plus crypto64.efi and a boot.cfg served over TFTP or HTTP, and the installer modules plus kickstarts over HTTP. This generator builds the whole box: a one-shot install.sh that copies your ESX ISO, derives boot.cfg with the documented edits, writes per-host kickstarts selected by MAC (01-<mac>/boot.cfg), configures nginx or Apache and dnsmasq, and installs a vcf-boot host manager with a status dashboard. Everything is generated in your browser; the ESX root password never leaves your boot server, which stores only a SHA-512 hash.

Prefer a full window? Open the generator full screen →

The ESX PXE boot server chain it builds

  1. The host firmware sends a DHCP request with its client architecture (option 93): 7 or 9 for x86-64 UEFI PXE, 16 for UEFI HTTP boot.
  2. dnsmasq (proxyDHCP or full DHCP), your ISC dhcpd or Windows DHCP answers with the boot file: mboot.efi over TFTP, an http:// URL for UEFI HTTP boot, or snponly.efi for the iPXE chainload.
  3. mboot.efi looks for 01-<mac-with-dashes>/boot.cfg next to itself and falls back to the default boot.cfg.
  4. boot.cfg carries prefix= (the installer directory, relative to the TFTP root or an HTTP URL) and kernelopt=runweasel ks=http://.../ks-<host>.cfg.
  5. The kickstart installs ESX on the chosen disk without a local VMFS, sets the static management IP, hostname, DNS and VLAN, then %firstboot adds the DNS search domain, NTP, SSH and the ESXi Shell for VCF commissioning.

What the generated files do

FilePurpose
install.shIdempotent installer: packages, loop-mounts and copies the ISO, extracts mboot.efi and crypto64.efi, derives boot.cfg from the ISO (prefix, no leading slashes, no cdromBoot, ks=), writes the kickstart template and host list, installs vcf-boot, the web vhost, dnsmasq, firewall rules and the dashboard timer.
dnsmasq.conf / dhcp-options.txtproxyDHCP or authoritative DHCP with architecture tags, or ISC dhcpd class blocks and Windows DHCP PowerShell for an existing server.
ks-template.cfg, ks.cfg, ks-<host>.cfgPer-host static kickstarts and a DHCP default; the root password is filled in on the server from a hash.
vcf-boot.shHost manager: vcf-boot add esx05 00:50:56:aa:bb:05 10.10.60.15 writes the kickstart, the 01-MAC boot.cfg and (full DHCP) a fixed lease; status shows planned, booted, kickstart fetched, management IP answers; the dashboard refreshes every minute.
verify.shServices, ports, the files mboot.efi needs, boot.cfg edits, TFTP and HTTP fetches as a host would do them, DNS records per host.
prep.shOffline mode: builds deps.tar.gz on an internet-connected box with the same OS.

Three things that bite

  • Secure Boot off during install. With UEFI Secure Boot enabled, ESX does not run the unsigned %firstboot section, so NTP, SSH and the DNS search domain would be missing. Install with Secure Boot disabled, finish the VCF bring-up, then enable it.
  • crypto64.efi next to mboot.efi. Since ESXi 7.0 U3 the loader needs efi/boot/crypto64.efi from the ISO in the same directory; install.sh copies it and verify.sh checks it.
  • Legacy BIOS is for ESXi 8.x only. ESXi 8.0 dropped BIOS support for new platforms and ESX 9 hosts boot UEFI (Broadcom KB 313152). The BIOS option exists for mixed labs and needs SYSLINUX 3.86, because the mboot.c32 on the ISO does not work with newer SYSLINUX.

Sources