Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm familiar to vSphere and large installations, and not at all familiar with the free products.

Topology & configuration

We have some branch offices that use ESXi and have a DC resident on them, as a virtualized host. This is the only local DC they can access.

To make things more complex, these remote offices are the "spokes" in a hub and spoke configuration. No spoke can ever talk to another spoke (through lack of routing) and each spoke has a RODC.

Question

To make management easier, I'm considering adding these hosts to our domain, but unsure if I'll lose "local admin" capability, or what will happen when the DC is unavailable.

That being said, I see an entry to configure an AD domain. It's not clear how the DCs will be selected, or how fault tolerance works, if at all on esxi.

I'm looking for someone smarter than me to help me think through the implications of connecting esxi to AD in the following scenarios:

  • ESXI is hosting a VM that is a DC and is hung (1/100 DCs failed)
  • ESXI can't access the servers in the hub (99/100 DCs failed)
  • Normal access, where spokes are unreachable (80/100 unreachable, might seem failed)

I think these scenarios are interesting because it's entirely possible that ESXI will get a list of every NS for ADDomain.com, which equals every domain controller hosting LDAP.*

*Footnote: I assume ESXI is using LDAP.. but I'm not sure

Bottom line

Should I connect esxi in a spoke to the domain in this configuration?

Will I lose local access if no DC is available?

share|improve this question

3 Answers 3

ESXi (just like any other system) will always allow local authentication (i.e. the local root user and any local user account you created) when other authentication methods are unavailable; if you have local credentials, you'll always be able to login to an ESXi server, even if vCenter, AD, or whatever else is not available.

Documentation:

http://pubs.vmware.com/vsphere-51/index.jsp#com.vmware.vsphere.security.doc/GUID-D7AEC653-EBC8-4573-B990-D8E58742F8ED.html

share|improve this answer
    
+1 I'm also interested in the LDAP question... as to how DCs are selected and chosen, which I don't see that detail in the docs. –  makerofthings7 Jul 15 '14 at 15:08
1  
It should use the Microsoft-defined way to properly locate the nearest domain controller (i.e. query DNS SRV records for a DC in the AD site associated with the computer's IP subnet), but we don't know if VMware did this The Right Way or if ESXi simply chooses a random DC amongst the existing ones. I'd like to know this, too... –  Massimo Jul 15 '14 at 17:08

My experience with ESXi AD integration (actually Likewise) is it can be flaky. It's probably fine for small, simple topologies, but it can fall down with more complex, distributed topologies. In every case for me, a vanilla computer can join or authenticate with AD just fine using the same connection or network segment when ESXi is exhibiting issues.

Your best bet is to enable the logging for the Likewise components, otherwise you aren't going anywhere when there is an issue. And you can't do this through the UI, get the CLI.

Enabling logging for Likewise agents on ESXi/ESX (1026554)
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1026554

Regarding the "how" is it should be doing exactly what a Windows client does, and follow the DC Locator process. I would suspect it is not, or is deviating in some way.

Domain Controller Location Process
http://technet.microsoft.com/en-us/library/cc978011.aspx

share|improve this answer

Notes Regarding ESX(i) AD Integration:

What i've discovered (on ESXi 5.0) is when joining the ESXi host to the domain (GUI) the process via Likewise agent (on host) enumerates the trusted domains and domain controllers at the time of the join and populates a file in /etc/likewise/krb5-affinity.conf with each child/domain and associated DC.

The process seems to only enumerate the domain at that single point in time. Examining the file showed me that the listed DC's were never automatically updated because there were many old DC IPs that were decommissioned or replaced and still in that list.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.