🖧

VMware Cluster Implementation Handbook

vSphere, vSAN, NSX and Cloud Foundation, phase by phase

By Richard Gamarra

A working reference for standing up and running a VMware cluster the right way: sizing and planning before a single host is racked, deploying vSphere and vSAN, wiring up NSX networking and vDefend security, and keeping the whole stack healthy once it's live. Built around the same product family shown in VMware Cloud Infrastructure, organized here by implementation phase instead of by product name, so it reads like a build guide.

Visible reference cards

🏗️ Architecture 🖥️ vSphere 💾 vSAN 🌐 NSX 🛡️ vDefend ☁️ Cloud Foundation 🧭 IT Operations

🏗️ Architecture & Planning

Everything that happens before a host is racked decides how smooth the rest of the implementation goes. VMware Cloud Foundation ties compute, storage, networking, and security into one automated stack, but it still needs a real plan behind it: sizing, network segmentation, and a clear picture of how each layer depends on the ones below it.

VMware Cluster Implementation infographic: vSphere, vSAN and Cloud Foundation phase by phase

Quick reference: the four implementation phases, the core building blocks, and the minimum cluster health numbers worth remembering at a glance.

How the layers stack up

VMware Cloud Foundation, layer by layer

Physical hostsCPU, RAM, local disks, NICs

↓

vSphere (ESXi + vCenter)Compute virtualization

↓

vSANShared storage from local disks

↓

NSXSoftware-defined networking

↓

vDefend + Cloud Foundation OperationsSecurity and lifecycle management

Planning checklist

📐

Sizing

Size compute, memory, and storage per workload profile

Don't size for today's VM count alone; account for HA failover capacity (N+1 at minimum) and headroom for vSAN rebuild traffic after a disk or host failure.

🖥️

Hardware

Choose vSAN ReadyNode or build your own

ReadyNodes are pre-validated hardware configurations from VMware's compatibility guide, the safer default unless there's a specific reason to hand-build the hosts.

🔀

Networking

Define management, vMotion, and vSAN network segments

Each of these traffic types should sit on its own VLAN with its own VMkernel adapter; mixing them on one segment is a common source of vMotion or vSAN performance problems later.

🗺️

IP planning

Reserve IP ranges and VLANs before bring-up

Cloud Foundation's automated bring-up process asks for these ranges up front; having them decided and documented in advance avoids a stalled deployment mid-process.

🖥️ Cluster Deployment

This is where the cluster actually comes online: ESXi installed on every host, vCenter Server managing them as one logical unit, and the cluster-level features that make a group of hosts behave like a resilient platform instead of a pile of separate servers.

Deployment sequence

Step	What happens
1. Install ESXi	Apply the same build and patch level to every host; inconsistent versions across a cluster cause compatibility warnings and can block vMotion
2. Deploy vCenter Server Appliance	The central management plane for the cluster; sized according to how many hosts and VMs it will manage
3. Create the cluster and add hosts	Group ESXi hosts under one cluster object in vCenter, this is what makes HA and DRS possible
4. Enable HA and DRS	High Availability restarts VMs automatically after a host failure; Distributed Resource Scheduler rebalances VM placement live based on load
5. Run Cloud Foundation bring-up	Automates steps 1 through 4 plus vSAN and NSX configuration into one guided workflow for a full SDDC stack

Cluster-level features

🔁

vSphere High Availability

Monitors host health and automatically restarts affected VMs on a surviving host if one fails. Needs enough unreserved capacity across the cluster to actually absorb a host loss.

⚖️

DRS

Distributed Resource Scheduler

Live-migrates VMs between hosts to balance CPU and memory load, and can automate initial VM placement when a new VM powers on.

📦

Cluster minimum

Three hosts minimum for a resilient vSAN cluster

Two hosts can technically run vSAN with a witness appliance, but three or more real hosts is the standard baseline for fault tolerance without an external witness.

🌐 Networking

NSX is the software-defined networking layer that replaces or augments physical network configuration with policy defined in software, portable across the cluster and independent of the underlying physical switches.

Traffic reaching a workload behind NSX

External request

→

Avi Load BalancerApp-facing distribution

→

NSX overlay segment

→

Workload VM or container

Core networking components

Component	Job
NSX	Overlay networking, logical switches and routers, and micro-segmentation independent of physical topology
Avi Load Balancer	Software-defined load balancing and security for application traffic across VMware Cloud Foundation
Container Networking with Antrea	Connects, secures, and manages VMware Kubernetes Service workloads at the network layer
Virtual Private Clouds (VPCs)	Self-service private cloud networking through NSX, giving application teams their own isolated network space
Cloud Foundation Operations for Networks	Intelligent network operations and app-centric visibility across the whole SDDC

Design guidance

🧩

Segmentation

Use micro-segmentation instead of one flat network

NSX lets policy follow the workload rather than a physical port, which keeps east-west traffic between VMs restricted to only what's actually needed.

🔗

Overlay

Overlay networks decouple logical from physical

Logical switches and routers exist independent of the physical network underneath, which makes workload mobility across hosts and even sites far simpler.

📊

Visibility

Turn on app-centric network visibility early

Cloud Foundation Operations for Networks surfaces which applications are actually consuming network resources, which is far easier to configure before troubleshooting an incident than during one.

💾 Storage

vSAN turns each host's local disks into a single pool of shared, resilient storage, no external SAN array required. Getting the storage policy right up front matters more than almost any other single setting in the cluster.

vSAN setup sequence

Step	What it does
1. Claim disks into a disk group	Each host contributes local disks (cache tier plus capacity tier) into vSAN's storage pool
2. Set the storage policy	Defines Failures To Tolerate (FTT), RAID level (mirroring or erasure coding), and whether deduplication and compression are enabled
3. Dedicate a vSAN VMkernel adapter	vSAN traffic needs its own network path, sharing it with management or vMotion traffic degrades performance under load
4. Run the vSAN health checks	Built into vCenter; validates network, disk, and cluster configuration before any workload gets placed on it

Storage components

💽

vSAN

Enterprise-class hyperconverged storage

Policy-driven, defined per VM or per VMDK rather than per LUN, which makes storage requirements portable with the workload itself.

🗄️

Data Services

VMware Data Services Manager

Automates the databases that drive AI and private cloud workloads, provisioning and managing database instances on top of the same cluster.

⚠️

FTT

Failures To Tolerate drives host count

FTT=1 with mirroring needs at least 3 hosts, FTT=2 needs at least 5. Setting FTT higher than the cluster can support blocks the policy from being applied at all.

🛡️ Security

vDefend applies zero trust principles inside the cluster itself, not just at the network edge, so a compromised workload can't move laterally to everything else sharing the same cluster.

Security layers

Component	What it protects
vDefend Distributed Firewall	Zero trust lateral security enforced at the vNIC level, stopping east-west movement between VMs on the same cluster
vDefend Gateway Firewall	Zone-based controls at the network edge, a next-generation internal firewall between segments
vDefend Advanced Threat Prevention	Multi-layer defense for Cloud Foundation workloads: intrusion detection, malware analysis, behavioral monitoring
Advanced Cyber Compliance	Elevated security, compliance, and resilience posture reporting across the whole Cloud Foundation deployment

Rollout guidance

🧪

Test first

Start distributed firewall rules in monitor mode

Log what traffic would be blocked before enforcing rules; flipping straight to block mode on a production cluster risks cutting off traffic nobody documented as necessary.

🔍

Baseline

Map real east-west traffic before segmenting

Use flow visibility tools to see what's actually talking to what, then build micro-segmentation policy around that reality instead of guessing.

📋

Compliance

Treat compliance posture as an ongoing check, not a one-time audit

Advanced Cyber Compliance reporting is most useful when reviewed on a regular cadence, catching drift before it becomes an audit finding.

📈 Operations & Monitoring

Once the cluster is live, day-to-day operations shift from building it to keeping it healthy: proactive monitoring, usage tracking, and workload mobility when hosts need maintenance or capacity needs to shift.

Operations tooling

📊

Operations

VMware Cloud Foundation Operations

Streamlines private cloud operations with proactive, intelligent management across compute, storage, and networking in one place.

🌐

Network ops

Cloud Foundation Operations for Networks

App-centric network visibility and intelligent operations focused specifically on the networking layer.

🚚

Mobility

Cloud Foundation Operations Workload Mobility

Discover and move workloads across data centers and clouds, useful for planned maintenance, capacity rebalancing, or migration projects.

📐

Usage

VMware Cloud Foundation Usage Meter

Monitors and reports on actual consumption across the deployment, useful for licensing reconciliation and internal chargeback.

🗂️

Delivery

VMware Cloud Director

Provisions software-defined data center services through a self-service delivery platform, useful for service provider or multi-tenant environments.

📡

Edge

VMware Telco Cloud Platform / Cloud Foundation Edge

Deploys a horizontal cloud-native platform for edge computing and 5G network functions, or a lighter private cloud footprint for edge sites specifically.

🚀 Workloads & Kubernetes

A modern VMware cluster runs more than traditional VMs. vSphere Kubernetes Service and the container networking layer bring native Kubernetes support directly onto the same cluster as everything else.

Workload types on the same cluster

Component	What it enables
vSphere	The enterprise workload engine for traditional and next-generation applications alike
VMware vSphere Kubernetes Service	Deploy, manage, and scale Kubernetes clusters (VKS) directly on top of vSphere infrastructure
VMware Container Networking with Antrea	Connects, secures, and manages VKS workloads at the network layer, same policy model as the rest of NSX
VMware Cloud Foundation Operations Workload Mobility	Moves both VM-based and container-based workloads across data centers and clouds

Why run Kubernetes on the same cluster

Running VKS on vSphere means container workloads share the same HA, DRS, vSAN storage, and NSX networking as traditional VMs, instead of standing up a completely separate infrastructure stack just for Kubernetes. One cluster, one set of operational practices, two workload models.

⚡ PowerCLI Quick Fixes

Fast PowerCLI commands for the moment a host, a VM, or the cluster itself needs attention right now.

🔌

Connect

Connect to vCenter Server

Connect-VIServer -Server vcenter.domain.local -User admin@vsphere.local

🖥️

Host status

List host connection and power state

Get-VMHost | Select Name, ConnectionState, PowerState

🚧

Maintenance

Put a host into maintenance mode

Set-VMHost -VMHost esxi01.domain.local -State Maintenance

🔄

vMotion

Live-migrate a VM to another host

Move-VM -VM "app-server-01" -Destination (Get-VMHost esxi02.domain.local)

📊

Cluster health

Check overall cluster HA and DRS status

Get-Cluster "Production-Cluster" | Select Name, HAEnabled, DrsEnabled, DrsAutomationLevel

💾

vSAN health

Run the vSAN cluster health check

Get-VsanClusterHealth -Cluster "Production-Cluster"

📈

Resource usage

Pull CPU and memory usage for every VM

Get-VM | Get-Stat -Stat cpu.usage.average,mem.usage.average -Realtime

🔁

Restart

Restart the management agents on a host

No native PowerCLI cmdlet for this; connect over SSH and run services.sh restart, or use Get-VMHost | Get-VMHostService to check individual service state first.

🧯 Troubleshooting

The issues that come up most often once a cluster is in production, with the fastest verified path to a fix.

Symptom	Likely cause	Fix
HA won't restart a VM after a host failure	Not enough unreserved capacity across the remaining hosts to power the VM back on	Check the cluster's admission control settings and current resource reservations, free up headroom or raise the failover capacity
vMotion fails between two hosts in the same cluster	CPU feature mismatch, or the hosts aren't on the same vMotion network	Verify Enhanced vMotion Compatibility (EVC) is enabled at the cluster level, and confirm both hosts share a vMotion VMkernel network
vSAN health check reports a disk group failure	A physical disk in the group has failed or is inaccessible	Check disk status in the vSAN health UI, replace the failed disk, and let vSAN resync automatically
New VM can't power on due to a storage policy violation	The cluster doesn't have enough hosts to satisfy the assigned FTT setting	Lower the policy's FTT requirement, or add hosts until the policy can be satisfied
NSX segment can't reach another segment	Missing or misconfigured distributed firewall rule blocking the traffic	Check the distributed firewall rule table for that segment pair; confirm the rule exists and is set to allow, not just logged
DRS keeps moving a specific VM back and forth	Conflicting affinity or anti-affinity rule, or a resource pool limit set too tight	Review the VM's DRS rules and resource pool settings for a conflict causing rebalance thrashing
Cloud Foundation bring-up fails partway through	An IP range, VLAN, or DNS entry reserved during planning doesn't match what was actually configured	Re-check the bring-up JSON or spreadsheet input against the actual network configuration before retrying

📚 Resources

Official documentation and tooling for going deeper on anything covered in this handbook.

Docs

VMware by Broadcom Documentation

The primary source for vSphere, vSAN, NSX, and Cloud Foundation setup guides and configuration reference.

Open ↗

Compatibility

VMware Compatibility Guide

Look up vSAN ReadyNode hardware and confirm any server, storage, or I/O device is supported before buying it.

Open ↗

PowerCLI

VMware PowerCLI Documentation

Full cmdlet reference for automating vSphere, vSAN, and NSX from PowerShell.

Open ↗

Community

VMware Community

Official forums for vSphere, vSAN, and NSX admin questions and real-world configuration discussions.

Open ↗

vSAN

vSAN Design and Sizing Guide

Reference for planning FTT, disk group layout, and network requirements before deployment.

Open ↗

NSX

NSX Documentation Center

Overlay networking, distributed firewall, and micro-segmentation concepts and configuration.

Open ↗