In this lab, you perform the following tasks: 1 . Create and Export a Host Profile 2 . Import a Host Profile
3. Attach an ESXi Host to the Imported Host Profile
4. Run an Initial Compliance Check 5. Introduce a Configuration Drift
6. Run a Compliance Check and Remediate the Configuration Drift 7. Detach the Host Profile
Task 1 : Create and Export a Host Profile
A host profile is a configuration template that is applied to any or all ESXi hosts in a cluster to verify and enforce specific configuration rules. Normally, a host profile has a reference host.
You export a profile for importation. The imported profile lacks a reference host. 1 . In vSphere Web Client, point to the Home icon and select Policies and Profiles.
2. In the left pane, select Host Profiles.
3. Extract a host profile from an ESXi host.
a. In the Objects panel, click the Extract profile from a host icon (green plus sign).
The Extract Host Profile wizard appears.
b. On the Select Host page, click sa-esxi-0 1.vclass.local and click Next.
c. On the Name and Description page, enter Local-Profile in the Name text box and click
Next.
d. On the Ready to complete page, click Finish.
e . In the Recent Tasks pane, monitor the task to completion.
4. Export the host profile to a file.
a. In the center pane, right-click the new profile and select Export Host Profile.
b. In the warning message box, click Save.
c. Navigate to the desktop of the student machine and save the profile as pro f i l e . vp f .
Task 2: Im port a Host Profi le
You import the host profile that you exported in task 1 . Because host profiles do not store the reference host, host profiles can easily be imported and exported.
1 . At the top of the Objects panel, click the Import Host Profile icon. Objects
+ Extract flt I m port Hos .. D u p l i cate ..
1. .... C o m p l i ant Ho:rts
� Loc a l- P rofile
2. In the Import Host Profile dialog box, import the host profile that you previously saved.
a. Click Browse, navigate to the desktop of the student machine, select the profile.vpf file, and click Open.
b. Enter Imported- Profile in the Name text box and click OK.
c. In the Recent Tasks pane, monitor the task to completion.
Task 3: Attach an ESXi Host to the Im ported Host Profile
Hosts and clusters can be attached or detached from a host profile in the host profiles view or in the Hosts and Clusters inventory.
1 . In the Objects panel, click the Imported-Profile link to navigate to that object. 2. In the center pane, click the Configure tab.
You can review and edit the comprehensive list of configuration settings that define the host profile.
3 . Select Attach/Detach Hosts and Clusters from the Actions drop-down menu. IJJ-Imported-Profile rn ilJ' � {§}Actions ...
Getting Started Summ ary Monitor Configun 11'.J Actions - Imported-Profile Check Host Profile Compliance
Remediate.
Settings View: Attach/Detach Hosts and Clusters...
The Attach/Detach Hosts and Clusters wizard appears.
4. On the Select hosts/clusters page, attach sa-esxi-0 1 .vclass.local to the host profile. a. In the Host/Cluster list, expand the SA Management cluster and select sa-esxi-
01. vclass.local.
b. Click Attach> to move the selected host to the list on the right and click Next.
A list of settings that can be customized for the first ESXi host appears. The customized values are prepopulated based on information extracted from the selected host.
c. Review the host customization settings and click Finish.
d. In the Recent Tasks pane, monitor the task to completion.
Task 4: Run an Initial Compliance Check
You run a compliance check to verify the attached host configuration against all the settings that are specified by the host profile.
1 . In the center pane, click the Monitor tab and click Compliance.
2. Select sa-esxi-01.vclass.local and click the Check Host Profile Compliance icon.
Getting Started Summary Monitor C o nfigure H o sts I s s u e s Scheduled Tasks Compliance
H ost/C I usle r H ost C o m p l i a nce
sa-esxi- 0 1 .vc lass.local ® U n known
3 . In the Recent Tasks pane, monitor the compliance check to completion.
4. Select the ESXi host and view the compliance information near the bottom of the panel .
The host is not compliant, because the IPv6 vmknic gateway configuration does not match the specification.
5 . Resolve the IPv6 configuration issue occurring on the ESXi host.
a. In the center pane, click the Configure tab.
b. Click Edit Host Profile.
The Edit Host Profile wizard appears.
c. On the Name and description page, click Next.
d. On the Edit host profile page, expand Networking configuration > Host virtual NIC.
e. Expand dvs-SA Datacenter: pg-SA Management: management.
f. Select IP address settings.
g. In the right pane, from the Vnic Default gateway for 1Pv6 routing list, select User must explicitly choose the policy option and click Finish.
h. In the Recent Tasks pane, monitor the task to completion.
6. Check the ESXi host for compliance.
a. In the center pane, click the Monitor tab.
b. Select the ESXi host and click the Check Host Profile Compliance icon.
c. In the Recent Tasks pane, monitor the compliance check to completion. d. View the Compliance panel.
e. Verify that the host is compliant.
Task 5: I ntrod uce a Configuration Drift
You test host profile compliance verification and remediation by introducing a noncompliant change on the host. The noncompliant change is that you remove the vmnic2 adapter from the dvs-Lab distributed switch.
1 . Point to the Home icon and select Networking.
2. In the left pane, right-click the dvs-Lab distributed switch and select Add and Manage Hosts.
The Add and Manage Hosts wizard appears.
3. On the Select task page, select Manage host networking and click Next. 4. On the Select hosts page, click Attached hosts.
5. In the Select member hosts window, select the sa-esxi-0 1.vclass.local check box and click OK. 6. Click Next.
7. On the Select network adapter tasks page, deselect the Manage VMkernel adapters check box and click Next.
8 . On the Manage physical network adapters page, unassign the vmnic2 adapter on sa-esxi- 0 1 .vclass.local.
a. Under the sa-esxi-0 1 . vclass.local, select vmnic2 and record the attached uplink.
b. Click Unassign adapter and click Next.
c. Click OK in the warning message dialog box. 9. On the Analyze impact page, click Next.
1 0 . On the Ready to complete page, click Finish.
Task 6: Run a Compl iance C heck and Remed iate the Configuration Drift You run a compliance check to detect noncompliant configuration changes that were made to hosts attached to a host profile.
1 . Point to the Home icon and select Policies and Profiles.
2 . In the left pane, select Host Profiles.
3. In the left pane, select Imported-Profile.
4. In the center pane, click Monitor > Compliance.
5. Select the ESXi host and click the Check Host Profile Compliance icon.
6. In the Recent Tasks pane, monitor the compliance check to completion. 7. In the Compliance panel, review the compliance categories.
Q1. How do the resu lts of the compliance check differ from the compl iance check performed in task 4?
Q2. In the new category, does the specific issue reported relate to the configuration change made in task 5?
8 . Remediate the host.
a. Click the Remediate host based on its host profile icon. Getting Started Summ ary Monitor C 1
I s s u e s Scheduled Tasks Comp lian c e
Host/Cluster
Ii
sa-esxi-02.vcl a s s .localThe ESXi host is listed on the Ready to complete page .
b. Click Pre-check Remediation.
The precheck remediation takes several seconds to complete.
Q3. Will the host be put in maintenance mode?
For the host to enter maintenance mode, the virtual machines on this host must be powered off or moved to another host. All virtual machines on this host are currently powered off. c . Expand the ESXi host to review the host customization tasks to b e performed.
d. Click Finish.
9. In the Recent Tasks pane, monitor the remediation and subsequent compliance check tasks to completion.
1 0 . Verify that the host is now compliant. 1 1 . Verify the action taken by host remediation.
a. Point to the Home icon and select Networking.
b. In the left pane, select the dvs-Lab distributed switch.
c . In the center pane, click the Configure tab and click Topology on the left.
d. Verify that remediation automatically reconnected vmnic2 on sa-esxi-0 1 . vclass.local to the appropriate uplink.
Task 7: Detach the Host Profi le
Detach the host profile from sa-esxi-01 .vclass. local.
1 . Point to the Home icon and select Policies and Profiles.
2. In the left pane, click Host Profiles. 3. In the left pane, select Imported-Profile.
4. In the center pane, select Attach/Detach Hosts and Clusters from the Actions drop-down menu.
The Attach/Detach Hosts and Clusters wizard appears.
5. On the Select hosts/clusters page, detach sa-esxi-0 1 .vclass.local from the host profile.
a. In the Host/Cluster list on the right, select sa-esxi-0 1.vclass.local.
b. Click < Detach to move the selected host to the list on the left.
c. Click Next.
6. On the Customize hosts page, click Finish.
7. In the Recent Tasks pane, monitor the task to completion.
8 . Point to the Home icon and select Home.