Momentum in the Cloud: Crafting Your Winning Strategy with VMware Cloud

Momentum in the Cloud: Crafting Your Winning Strategy with VMware Cloud

The time is right for VMware Cloud! In the rapidly evolving landscape of modern business, embracing the cloud has become essential for organizations seeking to stay competitive and agile. The allure of increased scalability, cost-efficiency, and flexibility has driven enterprises of all sizes to embark on cloud migration journeys. However, the road to a successful cloud adoption is often coming with challenges. Slow and failed migrations have given rise to what experts call the “cloud paradox,” where the very technology meant to accelerate progress ends up hindering it.

As businesses navigate through this paradox, finding the right strategy to harness the full potential of the cloud becomes paramount. One solution that has emerged as a beacon of hope in this complex landscape is VMware Cloud. With its multi-cloud approach, which is also known as supercloud, VMware Cloud provides organizations the ability to craft a winning strategy that capitalizes on momentum while minimizing the risks associated with cloud migrations.

The Experimental Phase is Over

Is it really though? The experimental phase was an exciting journey of discovery for organizations seeking the potential of multi-cloud environments. Companies have explored different cloud providers, tested a variety of cloud services, and experimented with workloads and applications in the cloud. It allowed them to understand the benefits and drawbacks of each cloud platform, assess performance, security and compliance aspects, and determine how well each cloud provider aligns with their unique business needs.

The Paradox of Cloud and Choice

With an abundance of cloud service providers, each offering distinct features and capabilities, decision-makers can find themselves overwhelmed with options. The quest to optimize workloads across multiple clouds can lead to unintended complexities, such as increased operational overhead, inconsistent management practices/tools, and potential vendor lock-in.

Furthermore, managing data and applications distributed across various cloud environments can create challenges related to security, compliance, and data sovereignty. The lack of standardized practices and tools in a multi-cloud setup can also hinder collaboration and agility, negating the very advantages that public cloud environments promise to deliver.

Multi-Cloud Complexity

(Public) Cloud computing is often preached for its cost-efficiency, enabling businesses to pay for resources on-demand and avoid capital expenditures on physical infrastructure. However, the cloud paradox reveals that organizations can inadvertently accumulate hidden costs, such as data egress fees, storage overage charges, and the cost of cloud management tools. Without careful planning and oversight, the cloud’s financial benefits might be offset by unexpected expenses.

Why Cloud Migrations are Slowing Down

Failed expectations. The first reasons my customers mention are cost and complexity.

While the cloud offers potential cost savings in the long run, the initial investment and perceived uncertainty in calculating the total cost of ownership can deter some organizations from moving forward with cloud migrations. Budget constraints and difficulties in accurately estimating and analyzing cloud expenses lead to a cautious approach to cloud adoption.

One significant factor impeding cloud migrations is the complexity of the process itself. Moving entire infrastructures, applications, and data to the cloud requires thorough planning, precise execution, and in-depth knowledge of cloud platforms and technologies. Many organizations lack the in-house expertise to handle such a massive undertaking, leading to delays and apprehensions about potential risks.

Other underestimated reasons are legacy systems and applications that have been in use for many years and are often deeply ingrained within an organization’s operations. Migrating these systems to the cloud may require extensive reconfiguration or complete redevelopment, making the migration process both time-consuming and resource-intensive.

Reverse Cloud Migrations

While I don’t advertise a case for repatriation, I would like to share the idea that companies should think about workload mobility, application portability, and repatriation upfront. You can infinitely optimize your cloud spend, but if cloud costs start to outpace your transformation plans or revenue growth, it is too late already.

Embracing a Smart Approach with VMware Cloud

To address the cloud paradox and maximize the potential of multi-cloud environments, VMware is embracing the cloud-smart approach. This approach is designed to empower organizations with a unified and consistent platform to manage and operate their applications across multiple clouds.

VMware Cloud-Smart

  • Single Cloud Operating Model: A single operating model that spans private and public clouds. This consistency simplifies cloud management, enabling seamless workload migration and minimizing the complexities associated with multiple cloud providers.
  • Flexible Cloud Choice: VMware allows organizations to choose the cloud provider that best suits their specific needs, whether it is a public cloud or a private cloud infrastructure. This freedom of choice ensures that businesses can leverage the unique advantages of each cloud while maintaining operational consistency.
  • Streamlined Application Management: A cloud-smart approach centralizes application management, making it easier to deploy, secure, and monitor applications across multi-cloud environments. This streamlines processes, enhances collaboration, and improves operational efficiency.
  • Enhanced Security and Compliance: By adopting VMware’s security solutions, businesses can implement consistent security policies across all clouds, ensuring data protection and compliance adherence regardless of the cloud provider.

Why VMware Cloud?

This year I realized that a lot of VMware customers came back to me because their cloud-first strategy did not work as expected. Costs exploded, migrations were failing, and their project timeline changed many times. Also, partners like Microsoft and AWS want to collaborate more with VMware, because the public cloud giants cannot deliver as expected.

Customers and public cloud providers did not see any value in lifting and shifting workloads from on-premises data centers to the public. Now the exact same people, companies and partners (AWS, Microsoft, Google, Oracle etc.) are back to ask for VMware their support, and solutions that can speed up cloud migrations while reducing risks.

This is why I am always suggesting a “lift and learn” approach, which removes pressure and reduces costs.

Organizations view the public cloud as a highly strategic platform for digital transformation. Gartner forecasted in April 2023 that Infrastructure-as-a-Service (IaaS) is going to experience the highest spending growth in 2023, followed by PaaS.

It is said that companies spend most of their money for compute, storage, and data services when using Google Cloud, AWS, and Microsoft Azure. Guess what, VMware Cloud is a perfect fit for IaaS-based workloads (instead of using AWS EC2, Google’s Compute Engine, and Azure Virtual machine instances)!

Who doesn’t like the idea of cost savings and faster cloud migrations?

Disaster Recovery and FinOps

When you migrate workloads to the cloud, you have to rethink your disaster recovery and ransomware recovery strategy. Have a look at VMware’s DRaaS (Disaster-Recovery-as-a-Service) offering which includes ransomware recovery capabilities as well. 

If you want to analyze and optimize your cloud spend, try out VMware Aria Cost powered by CloudHealth.

Final Words

VMware’s approach is not right for everyone, but it is a future-proof cloud strategy that enables organizations to adapt their cloud strategies as business needs to evolve. The cloud-smart approach offers a compelling solution, providing businesses with a unified, consistent, and flexible platform to succeed in multi-cloud environments. By embracing this approach, organizations can overcome the complexities of multi-cloud, unlock new possibilities, and set themselves on a path to cloud success.

And you still get the same access to the native public cloud services.

 

 

VMware Cloud Foundation 5.0 – Technical Overview

VMware Cloud Foundation 5.0 – Technical Overview

Update: Please have a look at the VMware Cloud Foundation 5.1 Technical Overview.

This technical overview supersedes this version, which was based on VMware Cloud Foundation 4.5, and now covers all capabilities and enhancements that were delivered with VCF 5.0.

What is VMware Cloud Foundation (VCF)?

VMware Cloud Foundation is a multi-cloud platform that provides a full-stack hyperconverged infrastructure (HCI) that is made for modernizing data centers and deploying modern container-based applications. VCF is based on different components like vSphere (compute), vSAN (storage), NSX (networking), and some parts of the Aria Suite (formerly vRealize Suite). The idea of VCF follows a standardized, automated, and validated approach that simplifies the management of all the needed software-defined infrastructure resources.

This stack provides customers with consistent infrastructure and operations in a cloud operating model that can be deployed on-premises, at the edge, or in the public cloud.

What software is being delivered in VMware Cloud Foundation?

The BoM (bill of materials) is changing with each VCF release. With VCF 5.0 the following components and software versions are included:

Note: Only one vCenter Server license is required for all vCenter Servers deployed in a VMware Cloud Foundation system.

VMware Cloud Foundation 5 Overview

What happened to the Tanzu entitlements?

With the release of VCF 5.0, VMware plans to retire the perpetual licensing for VMware Cloud Foundation in Q3 2023.

Around the same time, we can expect that VCF is only being sold as part of the “Cloud Packs” (connected and disconnected):

VCF Cloud Pack 

As already mentioned here, customers have also no more option to buy “Tanzu Standard” and existing Tanzu Standard customers can “upgrade” to “Tanzu Kubernetes Grid” (TKG) and Tanzu Mission Control (add-on).

There are several options available. Please contact your VMware representative.

VMware Cloud Foundation Architecture

VCF is made for greenfield deployments (brownfield not supported) and supports two different architecture models:

  • Standard Architecture
  • Consolidated Architecture

VMware Cloud Foundation Deployment Options

The standard architecture separates management workloads and lets them run on a dedicated management workload domain. Customer workloads are deployed on a separate virtual infrastructure workload domain (VI workload domain). Each workload domain is managed by a separate vCenter Server instance, which allows autonomous licensing and lifecycle management.

VMware Cloud Foundation Single Site Deployment

Note: The standard architecture is the recommended model because it separates management workloads from customer workloads.

Customers with a small environment (or a PoC) can start with a consolidated architecture. This allows you to run customer and management workloads together on the same workload domain (WLD).

Note: The management workload domain’s default cluster datastore must use vSAN. Other WLDs can use vSAN, NFS, FC, and vVols for the principal storage.

VMware Cloud Foundation Storage Options

What is a vSAN Stretched Cluster?

vSAN stretched clusters extend a vSAN cluster from a single site to two sites for a higher level of availability and inter-site load balancing.

VMware Cloud Foundation Stretched Cluster

Does VCF provide flexible workload domain sizing?

Yes, that’s possible. You can license the WLDs based on your needs and use the editions that make the most sense depending on your use cases.

VMware Cloud Foundation Flexible Licensing

How many physical nodes are required to deploy VMware Cloud Foundation?

A minimum of four physical nodes is required to start in a consolidated architecture or to build your management workload domain. Four nodes are required to ensure that the environment can tolerate a failure while another node is being updated.

VI workload domains require a minimum of three nodes.

This means, to start with a standard architecture, you need to have the requirements (and money) to start with at least seven physical nodes.

What are the minimum hardware requirements?

These minimum specs have been listed for the management WLD since VCF 4.0 (September 2020):

VMware Cloud Foundation Hardware Requirements

Can I mix vSAN ReadyNodes and Dell EMC VxRail deployments?

No. This is not possible.

What about edge/remote use cases?

When you would like to deploy VMware Cloud Foundation workload domains at a remote site, you can deploy so-called “VCF Remote Clusters”. Those remote workload domains are managed by the VCF instance at the central site and you can perform the same full-stack lifecycle management for the remote sites from the central SDDC Manager.

VMware Cloud Foundation Remote Cluster

Prerequisites to deploy remote clusters can be found here.

Note: If vSAN is used, VCF only supports a minimum of 3 nodes and a maximum of 4 nodes per VCF Remote Cluster. If NFS, vVOLs or Fiber Channel is used as principal storage, then VCF supports a minimum of 2 and a maximum of 4 nodes.

Important: Remote clusters and remote workload domains are not supported when VCF+ is enabled.

Does VCF support HCI Mesh?

Yes. VMware Cloud Foundation 4.2 and later supports sharing remote datastores with HCI Mesh for VI workload domains.

HCI Mesh is a software-based approach for disaggregation of compute and storage resources in vSAN. HCI Mesh brings together multiple independent vSAN clusters by enabling cross-cluster utilization of remote datastore capacity within vCenter Server. HCI Mesh enables you to efficiently utilize and consume data center resources, which provides simple storage management at scale.

Note: At this time, HCI Mesh is not supported with VCF ROBO.

What is SDDC Manager?

SDDC Manager is a preconfigured virtual appliance that is deployed in the management workload domain for creating workload domains, provisioning additional virtual infrastructure and lifecycle management of all the software-defined data center (SDDC) management components.

VMware Cloud Foundation SDDC Manager

You use SDDC Manager in VMware Cloud Foundation to perform the following operations:

  • Commissioning or decommissioning ESXi hosts
  • Deployment of workload domains
  • Extension of clusters in the management and workload domains with ESXi hosts
  • Adding clusters to the management domain and workload domains
  • Support for network pools for host configuration in a workload domain
  • Product licenses storage
  • Deployment of vRealize Suite components.
  • Lifecycle management of the virtual infrastructure components in all workload domains, and of vRealize Suite Lifecycle Manager components.
  • Certificate management
  • Password management and rotation
  • NSX-T Edge cluster deployment in the management domain and workload domains
  • Backup configuration

VMware Cloud Foundation SDDC Manager Dashboard

How many resources does the VCF management WLD need during the bring-up process?

We know that VCF includes vSphere (ESXi and vCenter), vSAN, SDDC Manager, NSX-T and eventually some components of the vRealize Suite. The following table should give you an idea what the resource requirements look like to get VCF up and running:

VMware Cloud Foundation Resource Requirements

If you are interested to know how many resources the Aria Suite (formerly vRealize Suite) will consume of the management workload domain, have a look at this table:

VMware Cloud Foundation Resource Requirements vRealize

How can I migrate my workloads from a non-VCF environment to a new VCF deployment?

VMware HCX provides a path to modernize from a legacy data center architecture by migrating to VMware Cloud Foundation.

VMware Cloud Foundation HCX

    Can I install VCF in my home lab?

    Yes, you can. With the VLC Lab Constructor, you can deploy an automated VCF instance in a nested configuration. There is also a Slack VLC community for support.

    VCF Lab Constructor

    Note: Please have a look at “VCF Holodeck” if you would like to create a smaller “sandbox” for testing or training purposes.

    Where can I find more information about VCF?

    Please consult the VMware Foundation 5.0 FAQ for more information about VMware Cloud Foundation.

     

     

     

    VMware Tanzu Licensing – What’s New?

    VMware Tanzu Licensing – What’s New?

    Last year, VMware gave the Tanzu portfolio a fairly good facelift with all the announcements from VMware Explore 2022. It is clear to me that VMware focuses on multi-cluster and multi-cloud Kubernetes management capabilities (Tanzu for Kubernetes Operations) and a superior developer experience with any Kubernetes on any cloud (Tanzu Application Platform). VMware embraces native public clouds and so it was very exciting for many customers when they announced the lifecycle management of Amazon Elastic Kubernetes Service (EKS) clusters – the direct provisioning and management of EKS clusters with Tanzu Mission Control. But what happened in the last 6 to 9 months since VMware Explore US and Europe? And how do I get parts of the VMware Tanzu portfolio nowadays?

    Tanzu Licensing

    Let us start with licensing first. in October 2022, VMware made it clear that they do not want to move forward anymore with the Tanzu Basic and Advanced editions, only Tanzu Standard was left. VMware replaced Tanzu Basic with “Tanzu Kubernetes Grid” (TKG), which comes with the following components:

    • vSphere capabilities / K8s Runtime
    • K8s Cluster Lifecycle Management – Cluster API
    • Image Registry – Harbor
    • Container Networking – Antrea/Calico
    • Load Balancing – NSX Advanced Load Balancer
    • Ingress Controller – Contour
    • Observability – Fluent Bit, Prometheus, Grafana
    • Operating System – Photon OS, Ubuntu, bring-your-own node image
    • Data Protection – Velero

    Note: Nothing is official yet, but according to this article intended for partners, VMware is going to announce the Tanzu Standard EOA (End of Availability) soon:

    …containing updated information on Tanzu Standard entering end of availability (EOA) and the new Tanzu Kubernetes Operations and Tanzu Application Platform partner resources.

    Looking at the “Tanzu Explainer” and its changelog from the 5th of May, one can find the following: “Updated to reflect new Tanzu for Kubernetes Operations SKUs“.

    Tanzu for Kubernetes Operations Bundles

    The Tanzu Explainer on Tech Zone lists the following new bundles/packages for Tanzu for Kubernetes Operations (TKO):

    1. Tanzu for Kubernetes Operations Foundation includes Tanzu Mission Control Advanced and Tanzu Service Mesh Advanced. Two add-on SKUs are available—one adds Antrea Advanced and Aria Operations for Applications, the other adds these plus NSX Advanced Load Balancer Enterprise. Tanzu Kubernetes Grid is not included in this bundle.
    2. Tanzu for Kubernetes Operations includes Tanzu Kubernetes Grid, Tanzu Mission Control Advanced, Tanzu Service Mesh Advanced, Antrea Advanced, and Aria Operations for Applications.
    3. Tanzu for Kubernetes Operations with NSX Advanced Load Balancer includes Tanzu Kubernetes Grid, Tanzu Mission Control Advanced, Tanzu Service Mesh Advanced, Antrea Advanced, Aria Operations for Applications, and NSX Advanced Load Balancer Enterprise.

    Note: Since Tanzu Mission Control Standard (TMC) was only sold as part of the Tanzu Standard Edition, we see VMware moving forward with TMC Advanced only. Which is good! But TMC Essentials still comes with vSphere+ and VMC on AWS.

    Tanzu Entitlements with vSphere and VMware Cloud Foundation Editions

    What about vSphere and VMware Cloud Foundation (VCF)? Let me give you an overview here as well:

    • vSphere+ Standard – No Tanzu entitlements included
    • vSphere+ – Includes TKG and TMC Essentials
    • vSphere Enterprise+ with TKG – Includes TKG
    • VMware Cloud Foundation – All VCF editions have Tanzu Standard included

    Note: We do not know yet what the Tanzu Standard EOA means for the Tanzu entitlements with VCF. Need to wait for guidance.

    VMware Cloud Packs

    In April 2023, VMware introduced new bundles called VMware Cloud Packs and they come in four different flavours:

    1. Compute with Advanced Automation. vSphere+ and Aria Universal Suite Advanced
    2. HCI. vSphere+, vSAN+ Advanced and Aria Universal Suite Standard
    3. HCI with Advanced Automation. vSphere+, vSAN+ Advanced and Aria Universal Suite Advanced
    4. VMware Cloud Foundation. vSphere+, vSAN+ Enterprise, NSX Enterprise Plus, SDDC Manager, Aria Universal Suite Enterprise, Aria Operations for Networks Enterprise add-on

    In addition to these four Cloud Packs offerings, customers can get the following add-ons:

    • Data Protection & Disaster Recovery
    • Network Detection and Response
    • Tanzu Mission Control
    • Ransomware Recovery
    • Advanced Load Balancer
    • Workload and Endpoint Security
    • Intrusion Detection and Prevention
    • VDI/Desktops

    Note: As you can see, all new cloud packs have TKG included and TMC is an add-on. vCenter Standard is with connected and disconnected subscriptions.

    Important: Please note as well that the individual components of the bundles cannot be upgraded independently. Example – Aria Universal Suite Standard as part of the HCI Cloud Pack cannot be upgraded to Aria Universal Suite Enterprise.

    Conclusion

    VMware is clearly moving in the right direction: They want to simplify their portfolio and improve how customers can consume/subscribe services. As always, it is going to take a while until they have figured out which bundles and product versions make sense for most of the customers. Be patient. 🙂

     

    VMware Cloud on Equinix Metal – The New Intercloud?

    VMware Cloud on Equinix Metal – The New Intercloud?

    It was November 2022 when VMware and Equinix announced an expanded partnership to deliver new infrastructure and multi-cloud services. Called VMware Cloud on Equinix, this solution combines VMware Cloud Infrastructure-as-a-Service (IaaS) with Equinix Metal Hardware-as-a-Services (HWaaS) independently. In other words, the SDDC (software-defined data center) stack is sold by VMware, and HWaaS is sold by Equinix. Looking at this partnership and solution, one could say that Equinix might become “the” intercloud in this multi-cloud era.

    What is VMware Cloud on Equinix Metal (VMC-E)?

    VMC-E combines VMware’s managed and supported cloud IaaS with Equinix’s baremetal-as-a-service (BMaaS) offering. This gives enterprises the advantage to run this cloud offering almost everywhere globally. Another benefit is that VMC-E will be available in over 30 of the most interconnected global Equinix locations, connected to all the major public clouds and networks (Equinix Fabric).

    Equinix Multi-Cloud App

    What is Equinix Fabric?

    This service allows organizations to connect to other Equinix customers and other internet resources like service providers:

    • Amazon Web Services (AWS)
    • Microsoft Azure
    • Google Cloud
    • Oracle Cloud
    • Alibaba Cloud
    • IBM Cloud
    • and many more

    For me, Equinix Fabric is an interesting way to interconnect different VMware-based Clouds like VMware Cloud on AWS, Azure VMware Solution, Google Cloud VMware Engine, Alibaba Cloud VMware Solution, or Oracle Cloud VMware Solution.

    VMC-E for multi-cloud apps?

    A lot of enterprises are not “cloud-first” anymore, they became “cloud-smart”. They put the right apps in the right cloud based on the right reasons.

    VMware Cloud-Smart

    VMC-E has the potential to become a true multi-cloud enabler by letting VMware and Equinix customers move their applications to an ideal place. Imagine lifting and shifting a legacy application to VMC-E. This application then sits in the middle of all major clouds and customers can use different services and components for the same application. This is my definition of a multi-cloud app.

    Multi-Cloud App on VMC-E

    What are the use cases?

    VMware and Equinix mention distributed environments and mission-critical applications that rely on high-performance network bandwidth and low latency, such as smart cities, video analytics, game development, VDI, real-time financial market trading, retail POS, IoT, and machine learning.

    Which hosts are available?

    VMware Cloud on Equinix Metal comes with multiple host configs that can be found here. It is not clear yet which host type(s) will be available during the initial lunch. But the tech preview on YouTube shows the “n3.xlarge.x86” instance type.

    Tech Preview VMware Cloud on Equinix Metal - YouTube

    How can I get VMC-E?

    VMC-E is currently in an early access phase for selected customers in H1 2023.

    Tech Preview VMware Cloud on Equinix Metal

    Where can I get more information?

    To learn more and to participate in the early access program for VMware Cloud on Equinix Metal, please email your interest to  .

    A Closer Look at VMware NSX Security

    A Closer Look at VMware NSX Security

    A customer of mine asked me a few days ago: “Is it not possible to get NSX Security features without the network virtualization capabilities?”. I wrote it already in my blog “VMware is Becoming a Leading Cybersecurity Vendor” that you do not NSX’s network virtualization editions or capabilities if you are only interested in “firewalling” or NSX security features.

    If you google “nsx security”, you will not find much. But there is a knowledge base article that describes the NSX Security capabilities from the “Distributed Firewall” product line: Product offerings for NSX-T 3.2 Security (87077).

    Believe it or not, there are customers that haven’t started their zero-trust or “micro-segmentation” journey yet. Segmentation is about preventing lateral (east-west) movement. The idea is to divide the data center infrastructure into smaller security zones and that the traffic between the zones (and between workloads) is inspected based on the organization’s defined policies.

    Perimeter Defense vs Micro-Segmentation

    If you are one of them and want to deliver east-west traffic introspection using distributed firewalls, then these NSX Security editions are relevant for you:

    VMware NSX Distributed Firewall

    • NSX Distributed Firewall (DFW)
    • NSX DFW with Threat Prevention
    • NSX DFW with Advanced Threat Prevention

    VMware NSX Gateway Firewall

    • NSX Gateway Firewall (GFW)
    • NSX Gateway Firewall with Threat Prevention
    • NSX Gateway Firewall with Advanced Threat Prevention

    Network Detection and Response

    • Network Detection and Response (standalone on-premises offering)

    Note: If you are an existing NSX customer using network virtualization, please have a look at Product offerings for VMware NSX-T Data Center 3.2.x (86095).

    VMware NSX Distributed Firewall

    The NSX Distributed Firewall is a hypervisor kernel-embedded stateful firewall that lets you create access control policies based on vCenter objects like datacenters and clusters, virtual machine names and tags, IP/VLAN/VXLAN addresses, as well as user group identity from Active Directory.

    If a VM gets vMotioned to another physical host, you do not need to rewrite any firewall rules.

    The distributed nature of the firewall provides a scale-out architecture that automatically extends firewall capacity when additional hosts are added to a data center.

    Should you be interested in “firewalling” only, want to implement access controls for east-west traffic (micro-segmentation) only, but do not need threat prevention (TP) capabilities, then “NSX Distributed Firewall Edition” is perfect for you.

    So, which features does the NSX DFW edition include?

    The NSX DFW edition comes with these capabilities:

    • L2 – L4 firewalling
    • L7 Application Identity-based firewalling
    • User Identity-based firewalling
    • NSX Intelligence (flow visualization and policy recommendation)
    • Aria Operations for Logs (formerly known as vRealize Log Insight)

    What is the difference between NSX DFW and NSX DFW with TP?

    With “NSX DFW with TP”, you would get the following additional features:

    • Distributed Intrusion Detection Services (IDS)
    • Distributed Behavioral IDS
    • Distributed Intrusion Prevention Service (IPS)
    • Distributed IDS Event Forwarding to NDR

    Where does the NSX Distributed Firewall sit?

    This question comes up a lot because customers understand that this is not an agent-based solution but something that is built into the VMware ESXi hypervisor.

    The NSX DFW sits in the virtual patch cable, between the VM and the virtual distributed switch (VDS):

    NSX Distributed Firewall

    Note: Prior to NSX-T Data Center 3.2, VMs must have their vNIC connected to an NSX overlay or VLAN segment to be DFW-protected. In NSX-T Data Center 3.2, distributed firewall protects workloads that are natively connected to a VDS distributed port group (DVPG).

    VMware NSX Gateway Firewall

    The NSX Gateway Firewall extends the advanced threat prevention (ATP) capabilities of the NSX Distributed Firewall to physical workloads in your private cloud. It is a software-only, L2 – L7 firewall that includes capabilities such as IDS and IPS, URL filtering and malware detection as well as routing and VPN functionality.

    If you are not interested in ATP capabilities yet, you can start with the “NSX Gateway Firewall” edition. What is the difference between all NSX GFW editions?

    VMware NSX GFW Editions

    The NSX GFW can be deployed as a virtual machine or with an ISO image that can run on a physical server and it shares the same management console as the NSX Distributed Firewall.

    VMware Cloud Foundation – A Technical Overview (based on VCF 4.5)

    VMware Cloud Foundation – A Technical Overview (based on VCF 4.5)

     

    Update: Please follow this link to get to the updated version with VCF 5.0.

    This technical overview supersedes this version, which was based on VMware Cloud Foundation 4.3, and now covers all capabilities and enhancements that were delivered with VCF 4.5.

    What is VMware Cloud Foundation (VCF)?

    VMware Cloud Foundation is a multi-cloud platform that provides a full-stack hyperconverged infrastructure (HCI) that is made for modernizing data centers and deploying modern container-based applications. VCF is based on different components like vSphere (compute), vSAN (storage), NSX (networking), and some parts of the Aria Suite (formerly vRealize Suite). The idea of VCF follows a standardized, automated, and validated approach that simplifies the management of all the needed software-defined infrastructure resources.

    This stack provides customers with consistent infrastructure and operations in a cloud operating model that can be deployed on-premises, at the edge, or in the public cloud.

    Tanzu Standard Edition is included in VMware Cloud Foundation with Tanzu Standard, Advanced, and Enterprise editions.

    Note: The VMware Cloud Foundation Starter, Standard, Advanced and Enterprise editions do NOT include Tanzu Standard.

    What software is being delivered in VMware Cloud Foundation?

    The BoM (bill of materials) is changing with each VCF release. With VCF 4.5 the following components and software versions are included:

    • VMware SDDC Manager 4.5
    • vSphere 7.0 Update 3g
    • vCenter Server 7.0 Update 3h
    • vSAN 7.0 Update 3g
    • NSX-T 3.2.1.2
    • VMware Workspace ONE Access 3.3.6
    • vRealize Log Insight 8.8.2
    • vRealize Operations 8.8.2
    • vRealize Automation 8.8.2
    • (vRealize Network Insight)

    Note: Only one vCenter Server license is required for all vCenter Servers deployed in a VMware Cloud Foundation system.

    VMware Cloud Foundation Components

    What is VMware Cloud Foundation+ (VCF+)?

    With the launch of VMware Cloud Foundation (VCF) 4.5 in early October 2022, VCF introduced new consumption and licensing models.

    VCF+ is the next cloud-connected SaaS product offering, which builds on vSphere+ and vSAN+. VCF+ delivers cloud connectivity to centralize management and a new consumption-based OPEX model to consume VMware Cloud services.

    VMware Cloud Foundation Consumption Models

    VCF+ components are cloud entitled, metered, and billed. There are no license keys in VCF+. Once the customer is onboarded to VCF+, the components are entitled from the cloud and periodically metered and billed.

    VMware Cloud Foundation+

    The following components are included in VCF+:

    • vSphere+
    • vSAN+
    • NSX (term license)
    • SDDC Manager
    • Aria Universal Suite (formerly vRealize Cloud Universal aka vRCU)
    • Tanzu Standard
    • vCenter (included as part of vSphere+)

    Note: In a given VCF+ instance, you can only have VCF+ licensing, you cannot mix VCF-S (term) and VCF perpetual licenses with VCF+.

    What are other VCF subscription offerings?

    VMware Cloud Foundation Subscription (VCF-S) is an on-premises (disconnected) term subscription offer that is available as a standalone VCF-S offer using physical core metrics and term subscription license keys.

    VMware Cloud Foundation Subscription TLSS

    You can also purchase VCF+ and VCF-S licenses as part of the VMware Cloud Universal program.

    Note: You can mix VCF-S with perpetual license keys as long as you use the same key (either or) for a workload domain.

    Which VMware Cloud Foundation editions are available?

    A VCF comparison matrix can be found here.

    VMware Cloud Foundation Architecture

    VCF is made for greenfield deployments (brownfield not supported) and supports two different architecture models:

    • Standard Architecture
    • Consolidated Architecture

    VMware Cloud Foundation Deployment Options

    The standard architecture separates management workloads and lets them run on a dedicated management workload domain. Customer workloads are deployed on a separate virtual infrastructure workload domain (VI workload domain). Each workload domain is managed by a separate vCenter Server instance, which allows autonomous licensing and lifecycle management.

    VMware Cloud Foundation Single Site Deployment

    Note: The standard architecture is the recommended model because it separates management workloads from customer workloads.

    Customers with a small environment (or a PoC) can start with a consolidated architecture. This allows you to run customer and management workloads together on the same workload domain (WLD).

    Note: The management workload domain’s default cluster datastore must use vSAN. Other WLDs can use vSAN, NFS, FC, and vVols for the principal storage.

    VMware Cloud Foundation Storage Options

    What is a vSAN Stretched Cluster?

    vSAN stretched clusters extend a vSAN cluster from a single site to two sites for a higher level of availability and inter-site load balancing.

    VMware Cloud Foundation Stretched Cluster

    Does VCF provide flexible workload domain sizing?

    Yes, that’s possible. You can license the WLDs based on your needs and use the editions that make the most sense depending on your use cases.

    VMware Cloud Foundation Flexible Licensing

    How many physical nodes are required to deploy VMware Cloud Foundation?

    A minimum of four physical nodes is required to start in a consolidated architecture or to build your management workload domain. Four nodes are required to ensure that the environment can tolerate a failure while another node is being updated.

    VI workload domains require a minimum of three nodes.

    This means, to start with a standard architecture, you need to have the requirements (and money) to start with at least seven physical nodes.

    What are the minimum hardware requirements?

    These minimum specs have been listed for the management WLD since VCF 4.0 (September 2020):

    VMware Cloud Foundation Hardware Requirements

    Can I mix vSAN ReadyNodes and Dell EMC VxRail deployments?

    No. This is not possible.

    What about edge/remote use cases?

    When you would like to deploy VMware Cloud Foundation workload domains at a remote site, you can deploy so-called “VCF Remote Clusters”. Those remote workload domains are managed by the VCF instance at the central site and you can perform the same full-stack lifecycle management for the remote sites from the central SDDC Manager.

    VMware Cloud Foundation Remote Cluster

    Prerequisites to deploy remote clusters can be found here.

    Note: If vSAN is used, VCF only supports a minimum of 3 nodes and a maximum of 4 nodes per VCF Remote Cluster. If NFS, vVOLs or Fiber Channel is used as principal storage, then VCF supports a minimum of 2 and a maximum of 4 nodes.

    Important: Remote clusters and remote workload domains are not supported when VCF+ is enabled.

    Does VCF support HCI Mesh?

    Yes. VMware Cloud Foundation 4.2 and later supports sharing remote datastores with HCI Mesh for VI workload domains.

    HCI Mesh is a software-based approach for disaggregation of compute and storage resources in vSAN. HCI Mesh brings together multiple independent vSAN clusters by enabling cross-cluster utilization of remote datastore capacity within vCenter Server. HCI Mesh enables you to efficiently utilize and consume data center resources, which provides simple storage management at scale.

    Note: At this time, HCI Mesh is not supported with VCF ROBO.

    What is SDDC Manager?

    SDDC Manager is a preconfigured virtual appliance that is deployed in the management workload domain for creating workload domains, provisioning additional virtual infrastructure and lifecycle management of all the software-defined data center (SDDC) management components.

    VMware Cloud Foundation SDDC Manager

    You use SDDC Manager in VMware Cloud Foundation to perform the following operations:

    • Commissioning or decommissioning ESXi hosts
    • Deployment of workload domains
    • Extension of clusters in the management and workload domains with ESXi hosts
    • Adding clusters to the management domain and workload domains
    • Support for network pools for host configuration in a workload domain
    • Product licenses storage
    • Deployment of vRealize Suite components.
    • Lifecycle management of the virtual infrastructure components in all workload domains, and of vRealize Suite Lifecycle Manager components.
    • Certificate management
    • Password management and rotation
    • NSX-T Edge cluster deployment in the management domain and workload domains
    • Backup configuration

    VMware Cloud Foundation SDDC Manager Dashboard

    How many resources does the VCF management WLD need during the bring-up process?

    We know that VCF includes vSphere (ESXi and vCenter), vSAN, SDDC Manager, NSX-T and eventually some components of the vRealize Suite. The following table should give you an idea what the resource requirements look like to get VCF up and running:

    VMware Cloud Foundation Resource Requirements

    If you are interested to know how many resources the Aria Suite (formerly vRealize Suite) will consume of the management workload domain, have a look at this table:

    VMware Cloud Foundation Resource Requirements vRealize

    How can I migrate my workloads from a non-VCF environment to a new VCF deployment?

    VMware HCX provides a path to modernize from a legacy data center architecture by migrating to VMware Cloud Foundation.

    VMware Cloud Foundation HCX

    What is NSX Advanced Load Balancer?

    NSX Advanced Load Balancer (NSX ALB) formerly known as Avi is a solution that provides advanced load balancing capabilities for VMware Cloud Foundation.

    Which security add-ons are available with VMware Cloud Foundation?

    VMware has different workload and network security offerings to complement VCF:

    Can I get VCF as a managed service offering?

    Yes, this is possible. Please have a look at Data Center as a Service based on VMware Cloud Foundation.

    Can I install VCF in my home lab?

    Yes, you can. With the VLC Lab Constructor, you can deploy an automated VCF instance in a nested configuration. There is also a Slack VLC community for support.

    VCF Lab Constructor

    Where can I find more information about VCF?

    Please consult the VMware Foundation 4.5 FAQ for more information about VMware Cloud Foundation.