This article provides steps to deploy vCenter High Availability (VCHA) in environments where the Primary and Secondary vCenter Server nodes are in separate subnets.

Terminology

• Management Network: The main interface used to connect to the vCenter server (eth0)
• VCHA Network: The private network configured strictly for VCHA replication traffic (eth1)
• Management vCenter Server: When deploying the vCenter Server Appliance (VC1) to an ESXi host managed by another vCenter Server (VC2), the latter (VC2) is considered the “Management vCenter Server”.

Requirements

• TCP ports 22, 5432, and 8182 are open and uninterrupted between all the nodes.
• VCHA network latency between each node cannot exceed 10ms.
• VCHA network throughput must be 1Gbps or higher.
• vCenter HA has been tested and certified to perform on physically adjacent ESXi hosts and is not designed as a disaster recovery solution for locations connected over long distances. The replication traffic is too sensitive to disruption in these configurations and commonly becomes a point of failure, even after a successful deployment.  For these reasons, the VCHA network does not support being configured over a WAN topology."

Step 1: Deploy the Primary vCenter Server that will be the Active VCHA node

• When deploying a new environment VMware recommends deploying the vCenter Server Appliance to an ESXi host of the same version or above.
• VMware recommends that the VCHA nodes are deployed to a DRS enabled cluster containing at minimum three ESXi hosts.

Step 2: Choose a network deployment strategy.

The steps to configure VCHA with differing networks will vary based on the decisions of which interfaces will have non-default configurations. The three options are:

• VCHA deployment with multiple management IPs and a single VCHA network
• VCHA deployment with multiple management IPs and multiple VCHA networks
• VCHA deployment with a single management IP and multiple VCHA networks

The relevant steps for each of these deployment strategies are explained in the following sections.
 

VCHA Deployment with multiple management IPs and a single VCHA network

1. Configure the ESXi hosts that will be running the nodes for management and VCHA network traffic with these conditions:

2. Ensure the following are reserved:

3. Add a second Network Adapter to the vCenter Server Appliance and attach it to the vCenter HA network port group. Ensure that the adapter type is same as the default Network Adapter the vCenter Server Appliance deployed with (the vCenter Server Appliance deploys with the VMXNet3 adapter).
4. Configure the IP address for the second Network Adapter using the address for the vCenter HA network. For more information on configuring a second adapter, see How to manually add a second NIC to the vCenter Server Appliance 6.5 for VCHA (2147155).

5. Configure forward and reverse DNS lookup for the secondary management network IP address
6. Log in to the Active node with the vSphere Client.
7. Select the vCenter Server object in the inventory and select the Configure tab.
8. Select vCenter HA under settings.
9. Click on the Set Up vCenter HA button to start the setup wizard.
   • If the vCenter server is self-managed, the Resource settings page is displayed. Proceed to step 13.
   • If your vCenter server is managed by another vCenter server in the same SSO domain, proceed to step 13.
   • If your vCenter server is managed by another vCenter server in a different SSO domain, input the location and credential details of that management vCenter server.
10. Click Management vCenter Server credentials. Specify the Management vCenter server FQDN or IP address, Single Sign-On username and password and click Next.
11. If you do not have the Single Sign-On administrator credentials, select the second bullet and click Next.
12. You may see a Certificate warning displayed. Review the SHA1 thumbprint and select Yes to continue.
13. In the Resource settings section, first select the vCenter HA network for the active node from the drop-down menu.
14. Select the checkbox to automatically create clones for Passive and Witness nodes.
15. For the Passive node, click Edit.

• Specify a unique name and target location.
• Select the destination compute resource for the operation.
• Select the datastore in which to store the configuration and disk files.
• Select virtual machine Management (NIC 0) and vCenter HA (NIC 1) networks.
• If there are issues with your selections, errors or compatibility warnings are displayed.

16. Review your selections and click Finish.
17. For the Witness node, click Edit.

• Specify a unique name and target location.
• Select the destination compute resource for the operation.
• Select the datastore in which to store the configuration and disk files.
• Select vCenter HA (NIC 1) network.
• If there are issues with your selections, errors or compatibility warnings are displayed.

18. Review your selections and click Finish.
19. Click Next.
20. In the IP settings section, select the IP version from the drop-down menu.
21. Enter the IPv4 address (NIC 1) and Subnet mask or prefix length information for the Active, Passive and Witness nodes.
22. Under the Passive Node section, click Edit Management Network Settings and enter the network settings for the secondary subnet that will be used.  
23. Click Finish.

VCHA Deployment with multiple management IPs and multiple VCHA networks

1. Configure the ESXi hosts that is running vCenter HA nodes for the vCenter Management traffic and the vCenter HA traffic with these conditions:

2. Ensure the following are reserved:

3. Add a second Network Adapter to the vCenter Server Appliance and attach it to the vCenter HA network port group. Ensure that the adapter type is same as the default Network Adapter the vCenter Server Appliance deployed with (the vCenter Server Appliance deploys with the VMXNet3 adapter).
4. Configure the IP address for the second Network Adapter using the address for the vCenter HA network. For more information on configuring a second adapter, see How to manually add a second NIC to the vCenter Server Appliance 6.5 for VCHA (2147155).

5. Configure forward and reverse DNS lookup for the secondary management network IP address.
6. Use an SSH client to connect to the vCenter with root.
7. Use a text editor (such as vi) manually add routes for the passive and witness VCHA networks on eth1 in /etc/systemd/network/10-eth1.network

8. Restart the networkd service

9. Log in to the Active node with the vSphere Client.
10. Select the vCenter Server object in the inventory and select the Configure tab.
11. Select vCenter HA under settings.
12. Click on the Set Up vCenter HA button to start the setup wizard.
    • If the vCenter server is self-managed, the Resource settings page is displayed. Proceed to step 16.
    • If your vCenter server is managed by another vCenter server in the same SSO domain, proceed to step 16.
    • If your vCenter server is managed by another vCenter server in a different SSO domain, input the location and credential details of that management vCenter server.
13. Click Management vCenter Server credentials. Specify the Management vCenter server FQDN or IP address, Single Sign-On username and password and click Next.
14. If you do not have the Single Sign-On administrator credentials, select the second bullet and click Next.
15. You may see a Certificate warning displayed. Review the SHA1 thumbprint and select Yes to continue.
16. In the Resource settings section, first select the vCenter HA network for the active node from the drop-down menu.
17. Deselect the box to automatically create clones for Passive and Witness nodes
18. Click Next.
19. In the IP settings section, select the IP version from the drop-down menu.
20. Enter the VCHA network information for the Active, Passive and Witness nodes.
21. Under the Passive Node section, click Edit Management Network Settings and enter the network settings for the secondary management IP that will be used.  
22. Click Finish. The VCHA configuration should report that the other nodes are not reachable. This is expected until the end of the workflow.
23. Right click the vCenter virtual machine and select Clone > Clone to Virtual Machine
24. Select a name, location, and datastore for the passive node. Do not choose to customize or power on the virtual machine in clone or vApp options.
25. Once the clone process is done, edit the new passive vm settings and place the network interfaces on the proper vm portgroups.
26. Power on the Passive node

Note: The management interface will automatically be brought down at boot to prevent an IP conflict.

27. Open a direct console session to the passive node and press ALT-F1 to login with root
28. Configure the eth1 interface with the new VCHA network IP address and routes to the active and witness nodes by updating the /etc/systemd/network/10-eth1.network file.

29. Configure the eth0 interface with the secondary management IP address by updating the /etc/systemd/network/10-eth0.network file

30. Restart the networkd service

31. Right click the vCenter virtual machine and select Clone > Clone to Virtual Machine
32. Select a name, location, and datastore for the witness node. Do not choose to customize or power on the virtual machine in clone or vApp options
33. Once the clone process is done, edit the new witness vm settings and place the network interfaces on the proper portgroups.
    • Optional: You may also elect to lower the vCPU count to 1 and the memory to a minimum of 1GB at this point. A memory reservation of 1GB is also recommended to match what a basic deployment would automatically assign the witness node. This will save resources in the cluster and will not affect the performance of the vCenter Server.
34. Power on the Witness node
35. Open a direct console session to the witness node and press ALT-F1 to login with root
36. Configure the VCHA network eth1 interface with the new IP address and routes to the active and passive nodes by updating the /etc/systemd/network/10-eth1.network file

37. The eth0 interface is not changed as it will be kept offline on the witness node.
38. Restart the networkd service

39. Test network connectivity over the VCHA network by pinging each VCHA network IP from each node. If necessary, you can reboot the primary node at this point without disrupting the VCHA configuration process.
40. Reboot the passive and witness nodes. The VCHA configuration page should mark both online after a few minutes once the services have started.

VCHA Deployment with a single management IP and multiple VCHA networks

1. Configure the ESXi hosts that is running vCenter HA nodes for the vCenter Management traffic and the vCenter HA traffic with these conditions:

2. Ensure the following are reserved:

3. Add a second Network Adapter to the vCenter Server Appliance and attach it to the vCenter HA network port group. Ensure that the adapter type is same as the default Network Adapter the vCenter Server Appliance deployed with (the vCenter Server Appliance deploys with the VMXNet3 adapter).
4. Configure the IP address for the second Network Adapter using the address for the vCenter HA network. For more information on configuring a second adapter, see How to manually add a second NIC to the vCenter Server Appliance 6.5 for VCHA (2147155).

5. Use an SSH client to connect to the vCenter with root.
6. Use a text editor (such as vi) to manually add routes for the passive and witness VCHA networks on eth1 in /etc/systemd/network/10-eth1.network

7. Restart the networkd service

8. Log in to the Active node with the vSphere Client.
9. Select the vCenter Server object in the inventory and select the Configure tab.
10. Select vCenter HA under settings.
11. Click on the Set Up vCenter HA button to start the setup wizard.
    • If the vCenter server is self-managed, the Resource settings page is displayed. Proceed to step 15.
    • If your vCenter server is managed by another vCenter server in the same SSO domain, proceed to step 15.
    • If your vCenter server is managed by another vCenter server in a different SSO domain, input the location and credential details of that management vCenter server.
12. Click Management vCenter Server credentials. Specify the Management vCenter server FQDN or IP address, Single Sign-On username and password and click Next.
13. If you do not have the Single Sign-On administrator credentials, select the second bullet and click Next.
14. You may see a Certificate warning displayed. Review the SHA1 thumbprint and select Yes to continue.
15. In the Resource settings section, first select the vCenter HA network for the active node from the drop-down menu.
16. Deselect the box to automatically create clones for Passive and Witness nodes
17. Click Next.
18. In the IP settings section, select the IP version from the drop-down menu.
19. Enter the VCHA network information for the Active, Passive and Witness nodes.
20. Click Finish. The VCHA configuration should report that the other nodes are not reachable. This is expected until the end of the workflow.
21. Right click the vCenter virtual machine and select Clone > Clone to Virtual Machine
22. Select a name, location, and datastore for the passive node. Do not choose to customize or power on the virtual machine in clone or vApp options.
23. Once the clone process is done, edit the new passive vm settings and place the network interfaces on the proper vm portgroups.
24. Power on the Passive node

25. Open a direct console session to the passive node and press ALT-F1 to login with root
26. Configure the eth1 interface with the new VCHA network IP address and routes to the active and witness nodes by updating the /etc/systemd/network/10-eth1.network file.

27. Restart the networkd service

28. Right click the vCenter virtual machine and select Clone > Clone to Virtual Machine
29. Select a name, location, and datastore for the witness node. Do not choose to customize or power on the virtual machine in clone or vApp options
30. Once the clone process is done, edit the new witness vm settings and place the network interfaces on the proper portgroups
    • Optional: You may also elect to lower the vCPU count to 1 and the memory to a minimum of 1GB at this point. A memory reservation of 1GB is also recommended to match what a basic deployment would automatically assign the witness node. This will save resources in the cluster and will not affect the performance of the vCenter Server.
31. Power on the Witness node
32. Open a direct console session to the witness node and press ALT-F1 to login with root
33. Configure the VCHA network eth1 interface with the new IP address and routes to the active and passive nodes by updating the /etc/systemd/network/10-eth1.network file

34. Restart the networkd service

35. Test network connectivity over the VCHA network by pinging each VCHA network IP from each node. If necessary, you can reboot the primary node at this point without disrupting the VCHA configuration process.
36. Reboot the passive and witness nodes. The VCHA configuration page should mark both online after a few minutes once the services have started.