Sep 222017
 

#This script is a Generic Host Profile that could be applied to an ESXi host after it is newly built from ISO or from a base build.  The configurations are for reference. Most commands are not required but do conform to most configuration baselines suggested in Performance and third party documents.  The commands do not require the host to be in Maintenance Mode to complete but some commands could cause an outage if not executed correctly.  Some commands below may require some additional changes, (editing the IP Address or vmnic numbers.)  Please review the commands before running against your Production hosts.

### Set the Vars
$myhost = “esx01.pcli.me”
$myDomain = “pcli.me”
$myDNSServer1 = “8.8.8.8″
$myDNSServer2 = “208.67.222.222″
$myNTPServer = “ntp.pcli.me”
$mySyslogServer = “loginsight.pcli.me”

$vmotionIP1 = “10.10.10.10″
$vmotionIP2 = “10.10.10.11″
$vmotionSubnetMask = “255.255.255.0″
$vmotionVlanID = “0″

$myVDSwitch = “dvs-pcliCore”
$myVDSSwitchNICs = “vmnic6″,”vmnic7″,”vmnic8″,”vmnic9″

### Run the commands…
##Set the domain
get-vmhostnetwork -VMHost $myhost | set-vmhostnetwork -searchdomain $yourDomain -domain $yourDomain -DnsAddress @($myDNSServer1,$myDNSServer2)

##Set the NTP server and restart the service.
if(get-vmhostntpserver -vmhost $myhost){remove-vmhostntpserver -host $myhost -ntpserver (get-vmhostntpserver -vmhost $myhost) -confirm:$false}
add-vmhostntpserver -vmhost $myhost -ntpserver @($myNTPServer)
Get-VmHostService -VMHost $myhost | Where-Object {$_.key -eq “ntpd”} | Set-VMHostService -Policy “on” -Confirm:$false
Get-VmHostService -VMHost $myhost | Where-Object {$_.key -eq “ntpd”} | ReStart-VMHostService -confirm:$false

##Set the syslog server and open the firewall
set-VMHostAdvancedConfiguration -VMHost $myhost -Name “Syslog.global.logHost” -Value $mySyslogServer -confirm:$false
Get-VMHostFirewallException -name ‘syslog’ -vmhost $myhost | Set-VMHostFirewallException -Enabled:$true

##Enable SSH, restart service and set session vars to meet Security Requirements
Get-VmHostService -VMHost $myhost  | Where-Object {$_.key -eq “TSM-SSH”} | Set-VMHostService -Policy “on” -Confirm:$false
Get-VmHostService -VMHost $myhost  | Where-Object {$_.key -eq “TSM-SSH”} | ReStart-VMHostService -confirm:$false
set-VMHostAdvancedConfiguration -VMHost $myhost  -Name “UserVars.SuppressShellWarning” -Value “1″ -confirm:$false
set-VMHostAdvancedConfiguration -VMHost $myhost  -Name “UserVars.ESXiShellTimeOut” -Value “900″ -confirm:$false
set-VMHostAdvancedConfiguration -VMHost $myhost  -Name “UserVars.ESXiShellInteractiveTimeOut” -Value “900″ -confirm:$false
set-VMHostAdvancedConfiguration -VMHost $myhost  -Name “Security.AccountLockFailures” -Value “5″ -confirm:$false

##Rename the local datastore to “hostname-local”
$localDS = “”+(($myhost).split(“.”))[0]+”-local”
if(get-vmhost $myhost |get-datastore | where {$_.name -match “datastore”}){get-vmhost $myhost | get-datastore | where {$_.name -match “datastore”} | set-datastore -name $localDS}

##Create a new standard switch for vmotion, add two physical nics, set the security policy, then create two vmotion vmknics
#### ** BE SURE to edit the VMNIC numbers below (vmnic2 and vmnic3) to match your physical nic numbers.
#### ** If you want to combine vmotion vmknics on the management vSwitch (vSwitch0) skip to the code below this.
$thevmotionswitch = new-virtualswitch -vmhost $myhost -name “vSwitchVMotion” -mtu 9000 -nic “vmnic2″,”vmnic3″
$esx=get-vmhost $myhost
$esxid=$esx |% {get-view $_.Id}
$esxidconfig=$esxid.configmanager
$esxns=$esxidconfig.networksystem
$esxnsview=get-view $esxns
$esxvSwitch=$esxnsview.NetworkConfig.Vswitch | where {$_.Name -eq $thevmotionswitch}
$specChange= $esxvSwitch.Spec
$specChange.policy.security.allowPromiscuous=$false
$specChange.policy.security.forgedTransmits=$false
$specChange.policy.security.macChanges=$false
$esxnsview.UpdateVirtualSwitch($esxvSwitch.name,$specChange)
new-VirtualPortGroup -virtualswitch $thevmotionswitch -name vmotion0 -vlanid $vmotionVlanID
New-VMHostNetworkAdapter -VMHost $myhost -PortGroup vmotion0 -VirtualSwitch $thevmotionswitch  -IP $vmotionIP1 -SubnetMask $vmotionSubnetMask -VMotionEnabled:$true
$vnicchange = get-virtualswitch -vmhost $myhost -name $thevmotionswitch | Get-virtualportgroup -name “vmotion0″ | get-nicteamingPolicy
$vnicchange | Set-NicTeamingPolicy -MakeNicActive “vmnic3″ -MakeNicStandby “vmnic2″
new-VirtualPortGroup -virtualswitch $thevmotionswitch -name vmotion1 -vlanid $vmotionVlanID
New-VMHostNetworkAdapter -VMHost $myhost -PortGroup vmotion1 -VirtualSwitch $thevmotionswitch  -IP $vmotionIP2 -SubnetMask $vmotionSubnetMask -VMotionEnabled:$true
$vnicchange | Set-NicTeamingPolicy -MakeNicActive “vmnic2″ -MakeNicStandby “vmnic3″
$vnicchange = get-virtualswitch -vmhost $myhost -name $thevmotionswitch | Get-virtualportgroup -name “vmotion1″ | get-nicteamingPolicy

##**** If you want to run vmotion on your management switch (vSwitch0) use this code instead.
##** Again, edit the vmnic numbers below as needed.
$thevmotionswitch = get-virtualswitch -vmhost $myhost -name “vSwitch0″
new-VirtualPortGroup -virtualswitch $thevmotionswitch -name vmotion0 -vlanid $vmotionVlanID
New-VMHostNetworkAdapter -VMHost $myhost -PortGroup vmotion0 -VirtualSwitch $thevmotionswitch  -IP $vmotionIP1 -SubnetMask $vmotionSubnetMask -VMotionEnabled:$true
$vnicchange = get-virtualswitch -vmhost $myhost -name $thevmotionswitch | Get-virtualportgroup -name “vmotion0″ | get-nicteamingPolicy
$vnicchange | Set-NicTeamingPolicy -MakeNicActive “vmnic0″ -MakeNicStandby “vmnic1″
new-VirtualPortGroup -virtualswitch $thevmotionswitch -name vmotion1 -vlanid $vmotionVlanID
New-VMHostNetworkAdapter -VMHost $myhost -PortGroup vmotion1 -VirtualSwitch $thevmotionswitch  -IP $vmotionIP2 -SubnetMask $vmotionSubnetMask -VMotionEnabled:$true
$vnicchange = get-virtualswitch -vmhost $myhost -name $thevmotionswitch | Get-virtualportgroup -name “vmotion1″ | get-nicteamingPolicy
$vnicchange | Set-NicTeamingPolicy -MakeNicActive “vmnic1″ -MakeNicStandby “vmnic0″

##Add the host to a vDS then add its Physcial NICs to the switch
Add-VDSwitchVMHost -vdswitch $myVDSwitch -vmhost $myhost
$hostadapter = get-vmhost -name $myhost | Get-vmhostnetworkadapter -physical -name $myVDSSwitchNICs
get-vdswitch $myVDSwitch  | add-vdswitchphysicalnetworkadapter -vmhostnetworkadapter $hostadapter -confirm:$false

##Create a portgroup on an existing Standard Switch
$vswitch0 = get-virtualswitch -vmhost $myhost -name “vSwitch0″
new-VirtualPortGroup -virtualswitch $vswitch0 -name “10.10.10.0″

##Set the host Power Policy to “High Performance” to reduce cpu latency.
$view = (Get-VMHost $myhost | Get-View)
(Get-View $view.ConfigManager.PowerSystem).ConfigurePowerPolicy(1)

##Move the local datastore into a datastore folder named “localdisk”  Folder must exist.
get-vmhost $myhost | get-datastore | where {$_.name -match “-local”} | move-datastore -destination (get-folder “localdisk”)

##Make sure both physical adapters on your management switch (vSwitch0) are set to active,active to prevent an outage.
$theManagementSwitch = get-virtualswitch -vmhost $myhost -name “vSwitch0″
$thenics = get-virtualswitch -vmhost $myhost -name $theManagementSwitch | Get-vmhostnetworkadapter | where {$_.name -notmatch “vmk”}
$vnicchange = get-virtualswitch -vmhost $myhost -name $theManagementSwitch | Get-virtualportgroup -name “Management Network” | get-nicteamingPolicy
$vnicchange | Set-NicTeamingPolicy -MakeNicActive $thenics

##If you use NFS storage, set the host NFS Advanced Vars to NFS Storage Vender Specs:
$Cmyhost = Get-VMHost $myhost
$Cmyhost | get-advancedsetting -name VMFS3.hardwareacceleratedlocking | set-advancedsetting -Value 1 -confirm:$false
$Cmyhost | get-advancedsetting -name Net.TcpipHeapSize | set-advancedsetting -Value 32 -confirm:$false
$Cmyhost | get-advancedsetting -name Net.TcpipHeapMax  | set-advancedsetting -Value 1536 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.MaxVolumes  | set-advancedsetting -Value 256 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS41.MaxVolumes  | set-advancedsetting -Value 256 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.MaxQueueDepth  | set-advancedsetting -Value 64 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.HeartbeatMaxFailures  | set-advancedsetting -Value 10 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.HeartbeatFrequency  | set-advancedsetting -Value 12 -confirm:$false
$Cmyhost | get-advancedsetting -name NFS.HeartbeatTimeout  | set-advancedsetting -Value 5 -confirm:$false

##If you need to add a vmknic for NFS traffic on a Virtual Distributed Switch:
$theswitch = get-vdswitch “myNFSVDSwitch”
$thePG = $theswitch | get-vdportgroup | where {$_.name -match “10.10.10.0-NFSvPG”}
New-VMHostNetworkAdapter -VMHost (Get-VMHost $myhost) -virtualswitch $theswitch -PortGroup $thePG -IP “10.10.10.9″ -SubnetMask “255.255.255.0″

##Mount up some NFS vols
Get-VMHost $myhost| New-Datastore -Nfs -Name “MyNFSDevice” -Path “/NFSShare1/MyNFSShare” -NfsHost “10.10.10.2″

 

#Here is the PowerCLI 6.5 Command Reference to look up these commands.
https://www.vmware.com/support/developer/PowerCLI/PowerCLI651/html/