Not sure it's possible to update via alternate link in vCenter/Esxi

Id like to update vCenter and ESXI without having a gateway on my Management Network as denoted in vCenter. Instead I would like to update using the second nic connected to vCenter which does have a gateway and allows only vCenter updates though.

 

My lab is air gapped. I dont want to expose management services to the public internet. I will only use this other NIC1 as the update NIC, using vCenter as a ?proxy? tot he ESXI hosts.

 

If I need to I can put a VMK on the ESXI hosts to reach the public as well, but would rather not put Management services on that VMK. This would allow my system to be connected from the Public Network, defeating the idea of Air Gapped – I will only use this second connection while updating vCenter and ESXi hosts.

 

NIC0 – Management Network – No Gateway

NIC1 – DHCP with access to Internet (no management services assigned)

 

Is this possible? Am I missing something?

 

Maybe I should just make a soft proxy vm or something.

 

 

Thanks,

Eric

NSXY-T limited export version issue

Hi Community, we are facing the following problem: We downloaded a NSX-T Evaluation Version from VMWare und tested our planned deployment.

 

After successful tests we decided to use this already working setup as productive deployment.

 

Now we stumbled across the issue, that in the eval-version there is no IPSec and L2TP available due to export restrictions, it is a “limited export” version.

 

Now here is my question: can we backup the manager node configurations, install the regular NSX-T version from VMWare and restore the backup to the manager nodes without issues in regards to the limited export limitations? Do we need to redeploy edge nodes or reinstall  NSXT agents on the hosts? Maybe somebody has done this before? 

 

An answer would be highly appreciated!

Thanks to all of you!

 

Micha

How to avoid VPN on host and only connect to LAN on host?

So I’ve got this work computer… yes it has too many group policies preventing me from what I want to do so I installed a VM using Player trying to set up my own stuff in the VM. I’m struggling to set up the VM’s network so it bypasses work VPN on the host and only acts as another computer on my LAN. Is this possible?

 

The VPN is Citrix Gateway, the network connection for the VPN is on Citrix Virtual Adapter network adapter. Windows 10 Enterprise.

 

In addition, the PC has cellular capability. But I don’t think it’s possible to bridge the VM to the cellular adapter? It’s a DW5820e Intel 7360 LTE-A cellular adapter.

 

I could set up a proxy server on my LAN and just use the proxy server. Citrix Gateway is letting me have access to my LAN. But I want to explore if it’s possible to have the VM completely separate from the VPN connection and only use my LAN connection, wired or wireless.

DEM Not Applying Default Apps

Hello there,

 

We have a new win 10 1909 environment we’re trying to roll out and we’re having extreme issues with DEM not applying/saving default apps and FTAs correctly and we cannot figure out why.

 

I have the Default Apps and FTAs flex engine enabled with a predefined forced setting to set Internet Explorer as default browser and to set adobe reader to open PDFs.

 

It seems to save and apply the adobe reader FTA, and it actually seems to map .http and .https files to Internet Explorer, but it only makes IE the default browser about 40-50% of the time, so when we click on a link inside of outlook it opens up in edge.

 

I worked with support and they had me drop the .xml file in the file type association page on DEM as well and like I said that part seems to be applying correctly just not for the default application part.

 

I’ll attach several pictures and a log of my latest login to see if that will help any.

 

I do appreciate it!

 

Edit: I apologize, I forgot to list that we are using DEM version 9.11 as well.

YARA’s XOR Modifier, (Mon, Oct 14th)

YARA searches for strings inside files. Strings to search for are defined with YARA rules.

With the release of YARA 3.8.0, support for searching for XOR encoded strings was introduced. By adding the modifier xor to the definition of a string, YARA 3.8.0 would search for strings that were XOR encoded, with a single-byte key, ranging from 1 to 255.

Here is an example of a string with xor modifier.

    rule xor_test {
        strings:
            $a = “https://isc.sans.edu” xor
        condition:
            $a
    }

This YARA version’s xor modifier would not match unencoded strings.

Apparently, that was not the purpose, and this was fixed with version 3.10.0.

The same rule would now also match unencoded strings.

With the latest version of YARA, 3.11.0, a YARA rule developer has now control over which XOR key range is used by modifier xor.

This is done by specifing an optional minimum-key – maximum-key range after the xor modifier, like this: xor(min-max).

The following rule has an xor modifier with key range 0x01-0xFF (minimum/maximum keys can be specified with decimal or hexadecimal values).

    rule xor_test {
        strings:
            $a = “https://isc.sans.edu” xor(0x01-0xFF)
        condition:
            $a
    }

This rule will not match unencoded strings.

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

WARNING: LRO: 977: cannot aggr pkt from port 0x5000002 as lro session port is 0x5000004

We have started receiving the warning: “WARNING: LRO: 977: cannot aggr pkt from port 0x5000002 as lro session port is 0x5000004″.  The esx hosts are running 6.5 build 10884925.  I searched through VMware’s knowledge base, without success.  AS of yet I do not see any indications of a problem.  Any information around the error would greatly be appreciated.  We are using a nimble array with HP Proliant DL 380 G10, usiing

 

 

Thanks,

ShineKnox

HPE Custom Image for ESXi 6.7 + Proliant Microserver Gen10 No IPMI capabilities

Hi there,

I’m really a newbie, so I may be asking something stupid, but I hope you can help me.

I downloaded and installed the HPE Custom Image for ESXi 6.7 GA Install CD on a HPE Proliant Microserver Gen 10 and everything went smoothly.

The thing now is about monitoring.

On the web client I go to Host > Monitor and the system says: This system has no IPMI capabilities, you may need to install a driver to enable sensor data to be retrieved.

Since here https://www.hpe.com/it/it/servers/hpe-esxi.html you can read (in Italian) “it supports Gen 9 and newer servers”

My understanding was that using this image I would not need to install anything else to monitor stuff like the RAID controller status.

 

Can you help me?

 

The final goal is to get to know ESXi, in order to make a step forward and offer our customers a better service but I am moving my first steps in this V-world and everything is really interesting but overwhelming.

 

Thanks in advance.

Hostd, vpxa and the vSphere API/SDK – Confusion on where the APIs actually live

Hi All,

I’m taking the VMware vSphere Deploy, Manage course and was confused about this:

  • In one slide, the instructor showed that vCenter Server communicated with the ESXi host using vSphere APi/SDK (The VMware Host Client also communicated using this)
  • In another slide, the instructor showed that the vCenter Server communicated with a vCenter agent living on the ESXi host (vpxa). This then communicated with another process called hostd, which then executed commands at the hypervisor…

With the second bullet point in mind, where does the vSphere API/SDK fit in? Is hostd the item that houses the vSphere API? Does vCenter communicate with vpxa, which then communicates with hostd using the vSphere API/SDK?

 

Clarification would be much appreciated.