VCF ESX Boot Server Generator

Server inputs live

1 Boot server host

Server FQDN

Server IP on the provisioning subnet

Provisioning NIC dnsmasq binds here

Boot subnet

Netmask

Web root installer modules + kickstarts over HTTP

TFTP root mboot.efi + boot.cfg for PXE / iPXE

2 ESX image

Version / directory label installer subdirectory and boot.cfg prefix=; use your ISO build

ESX installer ISO path on the boot server; install.sh loop-mounts and copies it

ESX generation

Boot disk for install --firstdisk= value, e.g. local or "DELLBOSS VD,local"

3 Platform

OS family

Web server

4 Boot method

UEFI PXE via TFTPmboot.efi, boot.cfg and the installer modules over TFTP (UDP/69), kickstarts over HTTP. Broadest firmware support; the documented default. UEFI HTTP bootDHCP hands out an http:// URL to mboot.efi; everything streams over HTTP. Needs firmware with UEFI HTTP boot. Secure-Boot friendly (mboot.efi is signed). iPXE chainload (UEFI)Firmware PXE loads snponly.efi, iPXE loads mboot.efi from TFTP and the modules over HTTP. For NICs without HTTP-boot firmware. Not Secure-Boot compatible. HTTP kickstart host onlyNo netboot. Serves installer modules and kickstarts; you boot from USB/ISO and type ks= by hand.

Also support legacy BIOSAdds SYSLINUX 3.86 pxelinux.0 + mboot.c32 from the ISO (IPv4 only, TFTP method only). ESXi 8.x hosts only. UEFI HTTPS bootHand the boot URL out as https://. The server certificate's CA must be enrolled in every host's firmware.

5 DHCP for PXE

dnsmasq proxyDHCPCoexists with your existing DHCP: hands out only the boot file, no leases. Recommended on a shared subnet. dnsmasq full DHCPAuthoritative for the provisioning subnet, relay capable: point the switch ip helper-address at this server. ISC dhcpd snippetClass blocks to paste into an existing dhcpd.conf (per the Broadcom samples). dnsmasq only serves TFTP. I will configure DHCP myselfEmit the option values (66/67/60, Windows DHCP PowerShell). dnsmasq only serves TFTP.

Pool start

Pool end

Gateway

Leases are install-window length (1h). For relayed subnets add one dhcp-range per subnet; the netmask is what lets dnsmasq match relayed (giaddr) requests.

6 TLS (web service only)

Certificate

Cert path

Key path

Kickstarts and modules keep working over plain HTTP; TLS only matters for HTTPS boot or if you browse the dashboard over the internet.

7 Hosts

Per-host configs by MACEach host gets 01-<mac>/boot.cfg → its own ks-<host>.cfg with a static management IP. Required for VCF bring-up.

Hostname	PXE NIC MAC	Management IP

Host FQDN = hostname + the kickstart domain. DNS forward and reverse records must exist before VCF bring-up. The MAC is the NIC the host PXE-boots from (lower-case, colon separated).

8 Kickstart settings

Management domain DNS suffix for the hosts

Management NIC

Mgmt gateway

Prefix length

Mgmt VLAN blank = untagged

DNS 1

DNS 2 (optional)

NTP 1

NTP 2 (optional)

Keyboard

No VMFS datastore on the boot disk--novmfsondisk: keeps local disks clean for vSAN ESA / OSA claiming Enable SSHRequired by VCF Installer / SDDC Manager for commissioning Enable ESXi ShellHandy during bring-up; disable later Suppress shell warningUserVars/SuppressShellWarning=1

Secure Boot: with UEFI Secure Boot enabled, ESX refuses to run the unsigned %firstboot section (NTP, SSH, DNS search). Install with Secure Boot off, finish the VCF bring-up, then enable it.

9 Installer options

Configure firewall67/68/69/4011 udp, 80/443 tcp (ufw or firewalld) Status dashboardStatic page at the web root, refreshed every minute: planned → booted → kickstart fetched → mgmt IP answers

Deploy mode

↓ Download install.sh

1 scp install.sh root@boot:/root/2 copy the ESX ISO to the ISO path3 sudo ./install.sh4 PXE-boot the hosts

Output

Boot file handed out by DHCP

Installer modules

Kickstarts

Hosts

↓ Download