Check Lockdown Mode Powershell Script

For security reasons one of my customer has Lockdown mode activated on all them ESXi server. Unfortunately, with vSphere 5.5 at least, there is no way to configure the lockdown mode on the host profile. So you have to do it manually on each ESXi server that you add to the vCenter.

Then when an administrator want’s to manage something with SSH or vSphere Client directly to the ESXi host, they have first to disable the Lockdown mode. Often they forget to enable the Lockdown mode again.

For this reason I created this script whitch is scheduled on the vCenter Server with the Windows Task Scheduler. It checks every ESXi host if it has the Lockdown Mode enabled and when not, it enables it.

As an “nice to have”, it sends after every schedule an email with the hosts that were configured. If no ESXi server was configured, it sends an email saying everything is ok.

You just have to edit the 6 first variables with your system informations and it works.

Please be aware that I haven’t implemented any error handling in the script. It’s just an quick and dirty script for my own.

Feel free to use it and share it

Why is the network loadbalancing policy so important?

Last week I returned from my vacation and had allready a lot of tasks waiting for me.

One of them was to add some new ESXi-server to a persistent cluster.

No problem, I thought. This will be a quick task after my vacation.

After looking on the persistent esxi hosts, i’ve seen that they use LACP/etherchannel as network configuration, a lot of VLAN tags and so on.

With this information I went to our network provider and gave him the needed information.

After a hour I recieved an email with the confirmation that  the network was ready.

So I installed the ESXi server, added two vmnics and changed the load balancing policy to “routed based on IP hash” what mean’s that with this configuration you can use LACP. (see KB2006129)

vswitch

Now I began to test the network by removing one vmnic and trying to ping the VMs on the ESXi server.

Every time I removed one vmnic, I loosed the connection to the VMs on the ESXi server. So i tried all possible configurations on the ESXi server but I never had a successful fail over on the network.

cmd

After trying everything on my site I was quite sure that the network guys did not configure the switchs as I’ve told them.

So I went there and we looked at the configuration. They did forgot to activate LACP/etherchannel on the ports. They had no port-channel configured. This was also the reason why I loosed each time the connection to the VMs when I removed one vmnic.

After they changed the configuration I tested it again and I neither loosed one ping when the network had to make a switch over.  This is how it is proposed to run!

While I was troubleshooting my problem I’ve found some interesting posts from other guys and from VMWare which I would like to share with you. They helped me to find out my problem.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2006129

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004088

and here my favorite one (only in German available):

http://www.admin-magazin.de/Das-Heft/2010/05/Redundante-Netzanbindung-mit-VMware-ESX

Hope this can help someone 🙂