VCP5-DCV学习指南：vSphere 7 Veeam Backup & Replication实战

5星 · 超过95%的资源需积分: 9 200 浏览量更新于2024-07-23 收藏 2.69MB PDF 举报

本学习指南是针对VMware VCP 5认证的专业课程，主要聚焦于vSphere 5环境下的开发和管理。由Jason Langer和Josh Coen共同编写，英文版本提供，旨在帮助读者深入了解和掌握vCenter Server与VMware ESXi的安装、配置、升级以及安全管理，同时涵盖了vSphere网络规划与配置的关键技术。在第1部分“Plan, Install, Configure and Upgrade vCenter Server and VMware ESXi”，共计四个主要目标： 1.1 安装和配置vCenter Server：这一章节将详细指导如何设置vCenter的核心组件，包括安装过程和必要的系统配置，确保其作为整个vSphere环境的管理中枢。 1.2 安装和配置VMware ESXi：这部分内容深入讲解如何在物理或虚拟环境中部署和配置ESXi主机，这是构建基础虚拟化平台的基础。 1.3 计划和执行vCenter Server及ESXi的升级：随着技术更新，这部分将涉及版本间的迁移策略，以保持系统的稳定性和性能优化。 1.4 安全性：强调vCenter Server和ESXi的安全措施，包括身份验证、授权、防火墙配置以及防止潜在威胁的策略，确保数据和系统的安全性。第2部分“Plan and Configure vSphere Networking”关注网络设计与配置： 2.1 配置标准交换机：介绍了如何设计和配置基础网络架构，确保虚拟机之间的通信畅通无阻。 2.2 配置分布式交换机：这部分着重讲解分布式交换机在vSphere中的应用，如何提高网络的灵活性和扩展性。 2.3 vSS（虚拟交换机策略）和vDSP（分布式安全策略）的配置：这两项策略对于优化网络性能和保护虚拟机安全至关重要。第3部分和第4部分未在提供的部分内容中列出，但可以推测会继续深化vSphere的规划和配置，可能包括存储管理、性能调优、备份和恢复（如提及的Veeam Backup & Replication v7）、高可用性和容灾解决方案等。通过本指南，学习者不仅能掌握VCP 5认证所需的技能，还能提升在现代数据中心环境中管理和优化虚拟基础设施的能力。为了进一步了解，访问<http://go.veeam.com/v7>获取更多关于Veeam Backup & Replication v7的信息，体验现代数据保护方案。

○ Default Roles in ESXi and vCenter Server

Role

Type

Description of User Capabilities

No Access

system

Cannot view or change the assigned object

vSphere Client tabs associated with an object appear without content.

Can be used to revoke perissions that would otherwise be propagated to an object from a parent

object

Available in ESXi and vCenter Server

Read Only

system

View the state and details about the object

View all the tab panels in the vphere Client except the Console tab

Cannot perform any actions through te menus and toolbars

Available on ESXi and vCenter Server

Administrator

system

All privileges for all objects

Add, remove, and set access rights and privileges for all the vCenter Server users and all the virtual

objects in the vSphere environment

Available in ESXi and vCenter Server

Virtual Machine

Power User

sample

A set of privileges to allow the user to interact with and make hardware changes to virutal machines,

as well as perform snapshot operations. Privileges granted include:

● All privileges for the scheduled task privileges group

● Selected privileges for global items, datastore, and virtual machine privileges groups

● No privileges for folder, datacenter, network, host, resource, alarms, sessions,

performance, and permissions privileges groups.

Usually granted on a folder that contains virtual machines or on individual virtual machines

Available on vCenter Server

Virtual Machine

User

sample

A set of privileges to allow the user to interact with a virtual machine’s console, insert media, and

perform power operations. Does not gratn privileges to make virtual hardware changes to the virtual

machine. Privileges granted include:

● All privileges for the scheduled taks privileges group

● Selected privileges for the global items and virtual machines privileges groups

● No privileges for the folder, datacenter, datastore, network, host, resource, alarms,

sessions, performance, and permissions privileges groups

Usually granted on a folder that contains virtual machines or on individual virtual machines.

Available on vCenter Server

Resource Pool

Administrator

sample

A set of privileges to allow the user to create child resource pools and modify the configuration of the

children, but not to modify the resource configuration of the pool or cluster on which the role was

granted. Also allows the user to grant permissions to child resource pools, and assign virtual

machines to the parent or child resource pools. Privileges granted include:

● All privileges for folder, virtual machine, alarms, and scheduled task privileges groups

● Selected privileges for resource and permissions privileges groups

● No privileges for datacenter, network, host, sessions, or performance privileges groups

Additional privileges must be granted on virtual machines and datastores to allow provisioning of

new virtual machines

Usually granted on a cluster or resource pool

Available on vCenter Server

Datastore

Consumer

sample

A set of privileges to allow the suer to consume space on the datastores on which this role is granted.

To perform a space-consuming operation, such as creating a virtual disk or taking a snapshot, the

use msut also have the appropriate virtual machine privileges granted for these operations

Usually granted on a datastore or a folder of datastores

Available on vCenter Server

Network

Consumer

sample

A set of privileges to allow the user to assign virtual machines or hosts to networks, if hte

appropriate permissions for the assignment are alos granted on the virtual machines or hosts

Usually granted on a network or folder of networks

Available on vCenter Server

● Describe how permissions are applied and inherited in vCenter Server

vSphere allows the assignment of permissions to objects in the vSphere Client. When assigning

permissions you select to have the permissions propagate down through the object tree or not. If

you allow for propagation objects lower in the tree “inherit” the set permissions. However, if a

permission is set at the child object it will take prescedance over an inherited permission.

For further information read pages 48 thru 53 (and the great diagram on pg 49) of the vSphere Security

document.

● Configure and administer the ESXi firewall

● Enable/Configure/Disable services in the ESXi firewall

1. Within the vSphere Client select a host and click on the Configuration tab

2. In the left hand pane under Software select Security Profile

3. In the right hand pane select Properties to the right of the Firewall section

4. Check or uncheck the services you wish to enable or disable

5. (Optional) With a service highlighted click Options in the lower right

6. (Optional) Select a Startup Policy from the following:

a. Start Automatically if any ports are open, and stop when all ports are closed

b. Start and stop with host

c. Start and stop manually

7. (Optional) Click OK

8. (Optional) Click the Firewall button in the lower right

9. (Optional) Select to Allow connections from any IP address or Only allow connections

from the following networks

10. (Optional) Click OK

11. Click OK

For further information, including command line syntax, refer to pages 34 thru 40 of the vSphere

Security document

● Enable Lockdown Mode

- Enabled via the vSphere Client

1. Within the vSphere Client select a host and click on the Configuration tab

2. In the left hand pane under Software select Security Profile

3. In the right hand pane select Edit to the right of Lockdown Mode

4. Check the box Enable Lockdown Mode

5. Click OK

-Enabled via the Direct Console User Interface (DCUI)

1. From the DCUI press F2 and log in

2. Select the option Configure Lockdown Mode and press Enter

3. Press the ESC to back out of the menus till you are back at the DCUI

● Configure network security policies

○ MAC Address Changes - With this policy set to Accept (Default), ESXi allows the

changing of effective MAC address to something other than the initial MAC address.

When set to Reject ESXi does not allow for those changes to occur. This prevents host

against MAC spoofing.

○ Forged Transmissions - With this policy set to Accept (Default), ESXi does not compare

source and effective MAC addresses. When set to Reject the ESXi host does compare the

source and effective MAC addresses of the client. If they do not match the ESXi host

drops the packet

○ Promiscuous Mode - With this policy set to Reject (Default) guest operating systems are

not allowed to receive all network traffic on the wire. When set to Accept the guest

operating system can receive all network packets. Helpful when doing troubleshooting

with a tool such as WireShark. Note however, this does introduce some security concerns

● View/Sort/Export user and group lists

1. Connect the vSphere Client directly to an ESXi host

2. Select the host and click the Local Users & Groups tab

3. Sort the columns either by UID, User, Name, GID, or Group

4. Right click any where in the right hand pane and click Export List

5. Provide a File Name as well as the Location in the Save As dialog box

6. Click Save

For further information read page 45 of the vSphere Security documentation

● Add/Modify/Remove permissions for users and groups on vCenter Server inventory

objects

1. Connect the vSphere Client directly to an ESXi host or vCenter Server

2. Select an inventory object and select the Permissions tab

3. In the right hand pane right click anywhere and select Add Permission

4. Select a given roll from the Assigned Role menu

5. Under Users and Groups click Add

6. Add the required user or groups to the role (either local or Active Directory)

7. Click OK

8. Click OK

9. Verify that permissions have been applied correctly

● Create/Clone/Edit vCenter Server Roles

○ Create a vCenter Server Role

1. Within the vSphere Client select the Home page and click Roles

2. In the upper left corner click Add Role

3. Provide a name of the new role in the Name

4. Select the privileges you would like to provide the roll from the tree

5. Click OK when completed

○ Clone a vCenter Server Role

1. Within the vSphere Client select the Home page and click Roles

2. Under Roles -> Name right click the role you wish to clone

3. Select Clone from the options menu

4. A new role is created with the name Copy of <role name>

○ Edit a vCenter Server Role

1. Within the vSphere Client select the Home page and click Roles

2. Under Roles -> Name right click the roll you wish to edit

3. In the Edit Role screen you can change the roll name as well as change the roles

privileges

4. When edits are completed click OK

For further information read pages 61 thru 63 of the vSphere Security documentation

● Add an ESXi Host to a directory service

1. Within the vSphere Client select a host and click on the Configuration tab

2. In the left hand pane under Software select Authentication Services

3. In the right hand pane select Properties to the right of Authentication Services Settings

4. Change the drop down to Active Directory under User Directory Service

5. Under Domain Settings enter the FQDN of the domain you wish to join in the Domain

field

6. Click the Join Domain button

7. Enter a user name and password for account that has the rights to join the system to the

Active Directory domain.

8. Click OK

9. Click OK to close the Directory Services Configuration window

剩余137页未读，继续阅读

darrell

粉丝: 1
资源: 1

VCP5-DCV学习指南：vSphere 7 Veeam Backup & Replication实战

VMware vSphere VCP实验手册（最完整版）

VMware威睿 VCP认证课程 vSphere 6.7企业级虚拟化教程 vSphere虚拟化技术学习课程.txt

VMware vSphere6学习资料.rar

(VCP)_VCP-NV_2V0-41.20.zip

vmware_vcp4_培训教材

vcp.zip_ST VCP_USB vcp_stm32f407_stm32f407 usb vcp

(VCP) _VCP7-DCV_2VO-21.20.pdf

STM32F103C8T6_USB__Dual_VCP.zip_STM32 Dual VCP_dual vcp_read6vw_

vmware_vcp4_培训教材1_CourseIntro.pptx

VCP6_培训资料.zip

最新资源