The one page to open during a VCF 9.x deployment session. Copy-paste host commands, the depot and firewall ports, MTU values, and the pre-validation checks, all in one place. For the full detail, use the links below.
1. Host Pre-Check Commands
Run on each ESX host shell (SSH). Replace placeholders in <angle brackets>.
Connectivity & depot
Depot reachable (TCP 443)
nc -zv dl.broadcom.com 443Depot TLS handshake
curl -v https://dl.broadcom.comESX build (match BOM)
vmware -vDNS, NTP & time
Forward DNS
nslookup <esxi-fqdn>Reverse DNS (PTR)
nslookup <esxi-ip>DNS servers configured
cat /etc/resolv.confHost FQDN
hostname -fNTP reachable
esxcli system ntp testCurrent time (compare hosts)
dateCertificates
Host cert CN = FQDN?
openssl x509 -in /etc/vmware/ssl/rui.crt -noout -subjectRegenerate host cert (then restart hostd/vpxa)
/sbin/generate-certificatesNetworking & MTU
SSH enabled
esxcli network firewall ruleset list -r sshServerNICs up / speed
esxcli network nic listMgmt gateway reachable
vmkping -I vmk0 <gateway-ip>Jumbo MTU 9000 (vMotion/vSAN)
vmkping -I vmkX -d -s 8972 <peer-ip>Overlay MTU 1600 (TEP)
vmkping -I vmkX -d -s 1572 <peer-ip>Port groups / VLANs
esxcli network vswitch standard portgroup listStorage
Datastores / filesystems
esxcli storage filesystem list2. Hardware, Firmware & Driver Validation
Capture model, NIC/HBA driver and firmware, and disk eligibility, then check the combo against the HCL.
Server & platform
Server model / vendor / serial
esxcli hardware platform getCPU details
esxcli hardware cpu global getMemory (vSAN ESA wants 128GB+)
esxcli hardware memory getNIC driver & firmware
List NICs / models
esxcli network nic listDriver + firmware for one NIC
esxcli network nic get -n vmnic0PCI device to driver map
vmkchdev -l | grep vmnicStorage adapter & devices
Storage adapters / HBAs
esxcli storage core adapter listDevices (check Is SSD: true for flash)
esxcli storage core device listDrivers (VIBs)
All installed driver VIBs
esxcli software vib listOne driver (e.g. nenic, nfnic, nvme)
esxcli software vib list | grep -i <driver>vSAN device eligibility
Disk eligibility for vSAN
vdq -qDisks claimed by vSAN
esxcli vsan storage listHardware compatibility: the running driver and firmware combination must be on the VMware Compatibility Guide (and the vSAN ESA ReadyNode HCL for vSAN, which requires NVMe flash). On Cisco UCS, manage and update firmware via Intersight / UCSM and confirm against the Cisco UCS HCL and interoperability matrix before deployment.
3. Depot & Key Firewall Ports
| Source | Destination | Port | Purpose |
|---|---|---|---|
| VCF Installer / SDDC Mgr / Fleet Mgr | dl.broadcom.com | TCP 443 | Online depot (binaries) |
| SDDC Manager | ESXi hosts | TCP 443, 902, 22 | Host mgmt / lifecycle |
| All mgmt appliances | DNS / NTP | UDP/TCP 53, UDP 123 | Name resolution / time |
| ESXi TEP | ESXi TEP | UDP 6081 | NSX overlay (Geneve) |
| NSX Manager nodes | NSX Manager nodes | TCP 443, 1234, 1235 | NSX cluster |
| ESXi vSAN VMkernel | ESXi vSAN VMkernel | TCP/UDP 2233 | vSAN data |
| SDDC Mgr / vCenter / NSX | SFTP backup server | TCP 22 | File-based backups |
Full list: see the Pre-Installation Checklist (Section B) and confirm against ports.broadcom.com (select VCF 9.0).
4. MTU per Traffic Type
| Traffic | Recommended MTU | Minimum | Notes |
|---|---|---|---|
| Management (vmk0) | 1500 | 1500 | Default; jumbo not required |
| vMotion | 9000 | 1500 | Jumbo improves throughput |
| vSAN | 9000 | 1500 | Jumbo strongly recommended |
| NSX Host Overlay / TEP (Geneve) | 1700 (or 9000) | 1600 | Must be 1600 or higher for Geneve |
| NSX Edge TEP / Uplink | 9000 | 1600 | Match host overlay and physical path |
| Physical switch trunk | 9000 | 1600 | Must carry the largest MTU on the path |
vmkping payload = MTU minus 28 (test 9000 with 8972, 1600 with 1572). Trunk must carry the largest VMkernel MTU on the path.
5. Pre-Validation Quick Checklist
| Check | Pass criteria |
|---|---|
| Forward + reverse DNS | Every host and mgmt VM resolves both ways |
| NTP / time sync | All hosts within 1 to 2 seconds |
| Host cert CN | Matches FQDN |
| Depot connectivity | dl.broadcom.com:443 reachable + download token ready |
| Mgmt IPs free | Installer, vCenter, SDDC/Ops, NSX (+VIP), Automation reserved |
| Shared storage | vSAN (NVMe for ESA) / NFS / VMFS-FC mounted (not local) |
| Passwords | 15+ chars, full complexity (clears all components) |
Top 3 that cause most failures: forward + reverse DNS, NTP time sync, and host certificate CN. After those, the most common blocker is depot egress on dl.broadcom.com:443.
DrJha