Attach a vCenter Server Instance Alone or Together with an NSX Manager Instance

You can attach a vCenter Server instance so that its resources become available for use in VMware Cloud Director. You can attach a vCenter Server instance together with its associated NSX Manager instance. For dedicated vCenter Server instances or for those associated with an NSX Manager instance, you can attach a vCenter Server instance alone.

VMware Cloud Director can use a vCenter Server instance either with its associated NSX Manager instance or with an NSX Manager instance.

If you want VMware Cloud Director to use this vCenter Server instance with its associated NSX Manager instance, you must attach the vCenter Server and NSX Manager instances together.

If you want VMware Cloud Director to use this vCenter Server instance with an NSX Manager instance, you must attach the vCenter Server instance alone. After you attach the vCenter Server instance alone, you must Register an NSX Manager Instance.

Note: After you attach a vCenter Server instance alone, you cannot add its associated NSX Manager instance at a later stage. You can unregister and attach again the vCenter Server instance together with its associated NSX Manager instance.

You can attach a vCenter Server instance to any site from your VMware Cloud Director environment.

You can attach a directly accessible vCenter Server instance or attach a vCenter Server instance that is behind a proxy. By using VMware Cloud Director OpenAPI, you can use proxy configurations within VMware Cloud Director to create a proxied connection between a VMware Cloud Director instance and the vCenter Server instance added to it. This way, the VMware Cloud Director and vCenter Server instances can exist in different locations or sites.

To attach a vCenter Server instance that is behind a proxy, first, you must declare a proxy configuration. Then, you must attach a vCenter Server instance, and configure VMware Cloud Director to use the proxy configuration when accessing the vCenter Server instance. You can also attach an NSX solution through a proxy. VMware Cloud Director does not support proxy configurations for NSX Data Center for vSphere. You do not need additional SSL configurations or an additional proxy configuration for the Platform Services Controller the vCenter Server instance is registered with.

Note: In a configuration with a proxy, the VMware Cloud Director to proxy communication can use only HTTP. VMware Cloud Director does not support HTTPS proxy configurations. The communication with the vCenter Server instance, tunneled through the proxy, is HTTPS and uses the vCenter Server certificates.

Prerequisites

• If you configured VMware Cloud Director to verify vCenter Server and vSphere SSO certificates, test the connection to the vCenter Server instance and establish a trust relationship. See Test the Connection to a Remote Server and Establish a Trust Relationship..
• If you configured VMware Cloud Director to verify NSX Manager or NSX Manager certificates, test the connection to the NSX Manager or NSX Manager instance and establish a trust relationship. See Test the Connection to a Remote Server and Establish a Trust Relationship.

Add the vCenter Server Instance

To add a vCenter Server instance, you must enter the vCenter Server access details.

Prerequisites

Familiarize yourself with the vSphere certificate management options. See the vSphere Certificate Management Overview and Certificate Replacement Overview documentation. The VMware Cloud Director certificate strategy depends on your vSphere certificate choices.

vSphere Option	VMware Cloud Director Action
Using VMCA-signed certificates	In VMware Cloud Director, trust the CA certificate.
Using the VMCA certificate as an intermediate certificate	In VMware Cloud Director, trust the intermediate VMware Certificate Authority (VMCA) certificate.
Using custom certificates where VMCA is not an intermediate certificate	Trust the appropriate certificate so that VMware Cloud Director trusts all vSphere components like vCenter Server and ESXi. Note: You must ensure that VMware Cloud Director trusts all necessary trust anchors.

Procedure

1. From the top navigation bar, under Resources, click Infrastructure Resources.
2. In the left pane, click vCenter Server Instances and click Add.
3. If you have a multisite VMware Cloud Director deployment, from the Site drop-don menu, select the site to which you want to add this vCenter Server instance, and click Next.
4. Enter a name and, optionally, a description for the vCenter Server instance in VMware Cloud Director.
5. Enter the URL of the vCenter Server instance.
   If the default port is used, you can skip the port number. If a custom port is used, include the port number.
   For example, https://FQDN_or_IP_address:<custom_port_number>.
6. Enter the user name and password of the vCenter Server administrator account.
7. (Optional) To deactivate the vCenter Server instance after the registration, turn off the Enabled toggle.
8. Click Next.
9. If you haven't already established a trust relationship to the endpoint, on the Trust Certificate window confirm if you trust the endpoint.

   Option	Description
   Trust the connectivity to an endpoint when VMCA is in use	Use this option when in vSphere you are using VMCA-signed certificates or the VMCA as an intermediate certificate. Review the initial certificate. If VMCA is not included in the list of certificates, retrieve the additional CA certificates and, depending on your vCenter Server version, select one of the options. For vCenter Server 7.0 and later, to fetch the additional CA certificates, click Retrieve. Select the VMCA certificate authority from the updated certificate chain, and trust it. For vCenter Server 6.7 and earlier, you must manually retrieve the CA certificate from vSphere, and use the Import option to upload the certificate into the VMware Cloud Director certificates.
   Trust the connectivity to an endpoint when VMCA is not in use	Use this option when in vSphere you are using custom certificates where VMCA is not an intermediate certificate Review the initial certificate. Determine the trust anchor to trust so that the entire vSphere infrastructure is trusted. Depending on your deployment, you might have to trust additional CAs. You must ensure that VMware Cloud Director trusts all necessary trust anchors. If necessary, use the Trust Remote Connection option.
   Do not trust the connectivity to this endpoint	Click Cancel. Repeat Step 5 to Step 8 with a trusted endpoint.

10. (Optional) Skip adding the NSX Manager instance that is associated with the vCenter Server instance by turning off the Configure Settings toggle and click Next.

    If you want VMware Cloud Director to use this vCenter Server instance with an NSX Manager instance, you must add the vCenter Server instance alone.

    Note: You cannot add the associated NSX Manager instance at a later stage. You can unregister and attach again the vCenter Server instance together with its associated NSX Manager instance.
11. If you want to add a tenant dedicated vCenter Server that will not be used as a provider VDC, turn on the Enable tenant access toggle.
    After you add the vCenter Server instance to VMware Cloud Director, the tenant-related information appears in the details view of the instance.
12. If you want VMware Cloud Director to generate default proxies for the vCenter Server instance and SSO services, turn on the Generate proxies toggle.

    After you add the vCenter Server instance to VMware Cloud Director, the proxies appear in the Proxies tab under vSphere Resources.

13. On the Ready to Complete page, review the registration details and click Finish.
14. If you haven't already trusted the necessary certificates, on the Trust vSphere Certificate Authority window, confirm that you trust the certificate so that VMware Cloud Director trusts all vSphere components and the integration with vSphere is complete.
    Important: If you do not trust the vSphere CA, some VMware Cloud Director features do not work.

    You can trust the vSphere CA also after editing the vCenter Server instance.

What to do next

To enable operations across vCenter Server instances where the source and destination vCenter Server instances are not the same, verify that the vCenter Server instances trust each other independently of VMware Cloud Director. To view the certificates that a vCenter Server instance trusts, see the Explore Certificate Stores Using the vSphere Client in the VMware vSphere Product Documentation. Verify that each vCenter Server instance trusts the other vCenter Server instances that it needs to interact with. See also KB 89906.

(Optional) Add the Associated NSX Manager Instance

If you want VMware Cloud Director to use this vCenter Server instance with its associated NSX Manager instance, you must add NSX Manager access details.

Procedure

1. On the NSX-V Manager page, leave the Configure Settings toggle turned on.
2. Enter the URL of the NSX Manager instance.
   If the default port is used, you can skip the port number. If a custom port is used, include the port number
   For example, https://FQDN_or_IP_address:<custom_port_number>.
3. Enter the user name and password of the NSX administrator account.
4. (Optional) То enable cross-virtual data center networking for the virtual data centers backed by this vCenter Server instance, turn on the Cross-VDC networking toggle, and enter the control VM deployment properties and a name for the network provider scope.
   The control VM deployment properties are used for deploying an appliance on the NSX Manager instance for cross-virtual data center networking components like a universal router.

   Option	Description
   Network Provider Scope	Corresponds to the network fault domain in the network topologies of the data center groups. For example, boston-fault1. For information about managing cross-virtual data center groups, see the VMware Cloud Director Tenant Guide.
   Resource Pool Path	The hierarchical path to a specific resource pool in the vCenter Server instance, starting from the cluster, Cluster/Resource_Pool_Parent/Target_Resource . For example, TestbedCluster1/mgmt-rp. As an alternative, you can enter the Managed Object Reference ID of the resource pool. For example, resgroup-1476.
   Datastore Name	The name of the datastore to host the appliance files. For example, shared-disk-1.
   Management Interface	The name of the network in vCenter Server or port group used for the HA DLR management interface. For example, TestbedPG1.

5. Click Next.
6. If the endpoint does not have a trusted certificate, on the Trust Certificate window confirm if you trust the endpoint.
   • To add the endpoint to the centralized certificate storage area and continue, click Trust .
   • If you do not trust this endpoint, click Cancel and repeat Step 2 to Step 4 with a trusted endpoint.
7. Activate or deactivate the access configuration settings.
8. On the Ready to Complete page, review the registration details and click Finish.

What to do next

• Assign the NSX License Key in vCenter Server.
• Create a Provider Virtual Data Center.