You will take an existing vSphere environment that already runs vSAN storage and NSX networking, and bring it under VCF management as a VI workload domain. Import keeps the vCenter, the hosts, the vSAN datastore and the NSX configuration in place, so nothing is redeployed and no workload moves. After import completes, the domain appears in the VCF Operations fleet inventory and gains VCF lifecycle and fleet management.

Import differs from converge in one important way. Converge turns a standalone vSphere environment into your first VCF management domain when you have no VCF yet. Import assumes a VCF instance already exists and adds the brownfield environment alongside it. If you are starting with no VCF at all, follow the converge walkthrough in Part 15 first, then return here to bring in your remaining estates. Import registers the environment the same way a native VI workload domain is created, so day 2 operations behave consistently across both.

Prerequisites

Work through every row before you start. A single missing reverse DNS record or an unsynced clock will stop the precheck, so clear these first.

What import changes and what it leaves alone

Import is a control plane operation. It records your vCenter, clusters, hosts, vSAN datastore and NSX configuration in SDDC Manager and the VCF Operations fleet inventory, and it registers the domain for VCF lifecycle. Your running virtual machines keep running. No host is reinstalled, no datastore is reformatted, and no NSX segment is recreated. Because of that, import carries no guest workload downtime by itself.

After import, a few management behaviors change. Lifecycle for the imported domain now flows through VCF, so future ESX and NSX updates come from the VCF depot rather than standalone tooling. Password and certificate rotation for the domain move under VCF management. Plan a short maintenance window for the import run so no one edits the source vCenter while the tool writes its inventory, even though guest workloads stay online.

Step 1, verify the source versions and health

Confirm the source estate clears the version floors and reports no storage or NSX faults.

1. Log in to the source vSphere Client as administrator@vsphere.local.
2. Open Menu, then Administration, and read the vCenter build under Deployment.
3. Confirm that build maps to vSphere 8.0 Update 3 or later.
4. Select each cluster, open the Hosts tab, and confirm every host runs ESXi 8.0 Update 3 or later.
5. Open the vSAN cluster, select Monitor, then vSAN, then Skyline Health, and clear every red item.
6. Open the NSX Manager UI, select System, then Appliances, and confirm NSX reports 4.2 or later.

Step 2, prepare the source vCenter

Enable SSH, record names, and confirm no stale VCF registration blocks the import.

1. Open the vCenter appliance management page at https://your-vcenter-fqdn:5480.
2. Log in as root, select Access, and set SSH Login to Enabled.
3. Record the fully qualified domain name of the vCenter and of every ESX host.
4. Confirm forward and reverse DNS resolve for each of those names.
5. Confirm no SDDC Manager extension is registered on the vCenter by checking with your VCF administrator or the Managed Object Browser.

Step 3, download and stage the VCF Import Tool

Import Tool binaries are not inside the SDDC Manager OVA, so download the package and copy it across.

1. Sign in to the Broadcom Support portal and open My Downloads.
2. Select VMware Cloud Foundation, then the 9.1 release.
3. Download the VCF Import Tool package that matches your SDDC Manager build.
4. Copy the package to the SDDC Manager appliance with scp.

scp vcf-brownfield-import-9.1.tar.gz vcf@sddc-manager.example.com:/tmp/

5. Open an SSH session to the SDDC Manager appliance as the vcf user.
6. Extract the package into the import tool directory.

tar -xzf /tmp/vcf-brownfield-import-9.1.tar.gz -C /opt/vmware/vcf/domainmanager/scripts/vcf-import-tool/

Step 4, run the import precheck

Precheck confirms connectivity, versions, DNS, NTP and the absence of a stale SDDC Manager extension.

1. Change into the import tool directory on the SDDC Manager appliance.
2. Run the precheck against the source vCenter.

python3 vcf_brownfield.py check --vcenter importedvcenter.example.com --sso-user administrator@vsphere.local

3. Enter the SSO password when prompted.
4. Read the precheck report and confirm every check returns PASS.
5. Fix any failed check before you continue, for example a missing reverse DNS record or an NTP offset above 5 seconds.

Step 5, generate the NSX deployment specification

Import reads the source NSX configuration and writes a specification file that the import run consumes.

1. Run the tool in specification mode to produce the NSX deployment specification.

python3 vcf_brownfield.py generate-nsx-spec --vcenter importedvcenter.example.com --sso-user administrator@vsphere.local --output /tmp/nsxDeploymentSpec.json

2. Open /tmp/nsxDeploymentSpec.json and confirm it lists the correct NSX Manager cluster and virtual IP.
3. Adjust the specification only if your topology uses bare metal edge nodes, which VCF 9.1 supports on import.
4. Save the file and keep the path ready for the import run and the VCF Operations wizard.

If your source uses edge nodes, review how edges map into a fleet in Part 9 on NSX Edge clusters so the imported topology stays consistent.

Step 6, start the import from VCF Operations

VCF Operations is the entry point for the fleet import workflow. Set it up first if you have not, using Part 7 on VCF Operations setup.

1. Log in to VCF Operations for your fleet.
2. Open Fleet Management, then Inventory, and select your VCF instance.
3. Click Add Workload Domain.
4. Select Import a vCenter Server.
5. Enter the source vCenter FQDN and the SSO administrator credentials.
6. Select the NSX deployment specification you generated in Step 5.
7. Review the summary, then click Start Import.

Step 7, run the import from the CLI and monitor

For a scripted or repeatable run, drive the same import from the SDDC Manager CLI and watch the log.

1. Run the import command with the domain name and the specification path.

python3 /opt/vmware/vcf/domainmanager/scripts/vcf-import-tool/vcf_brownfield.py import \
  --skip-ssh-thumbprint-validation \
  --sso-user administrator@vsphere.local \
  --domain-name brownfield-wld-01 \
  --vcenter importedvcenter.example.com \
  --internal-vcf-auth \
  --nsx-deployment-spec-path /tmp/nsxDeploymentSpec.json \
  --output-dir /var/log/vmware/vcf/domainmanager/brownfield/run01/ \
  --non-interactive

2. Watch the console for each stage to report completed.
3. Tail the log in a second session if you need detail.

tail -f /var/log/vmware/vcf/domainmanager/brownfield/run01/output/vcf-import.log

4. Wait for the final stage to report the domain imported into SDDC Manager inventory.

Step 8, assign licenses and finish

Import registers the domain in an unlicensed state, so assign capacity before you hand it over.

1. In VCF Operations, open Administration, then Licensing.
2. Add or select a VCF 9.1 subscription with capacity for the imported cores.
3. Assign the license to the newly imported workload domain.
4. Open Fleet Management, then Inventory, and confirm the domain shows a green status.

flowchart TD
  A[Existing vSphere with vSAN and NSX] --> B{VCF fleet already running}
  B -->|Yes| C[Import as VI workload domain]
  B -->|No| D[Converge into management domain first]
  C --> E[Assign license and validate in VCF Operations]
  D --> E

Sizing and network notes

Import adds no new appliances of its own. It uses the SDDC Manager and VCF Operations that already run in your fleet, and it keeps the source NSX Manager cluster in place. Confirm the run host reaches the source vCenter on port 443 and the source NSX Manager on port 443, and reaches SDDC Manager on its internal service ports. Keep the source vCenter and hosts on the same NTP source as the fleet so the token exchange in Step 4 does not fail on clock skew. Budget 30 to 90 minutes for a single cluster import, and longer for domains with many hosts, since inventory collection scales with host and object count.

Verify the import

Confirm the import finished cleanly before you hand the domain to day 2 teams. Each check below has a clear place to look and a clear expected result.

Common errors and fixes

Existing SDDC Manager extension detected

Precheck stops with a message that an SDDC Manager extension is already registered on the vCenter. Remove the stale com.vmware.vcf.sddc.manager extension from the vCenter Managed Object Browser, confirm the vCenter belongs to no other VCF instance, then rerun the precheck.

Could not generate a token from SDDC Manager

Precheck reports it cannot obtain a token. Confirm the SDDC Manager appliance is reachable from the run host, that its clock is in sync, and that the internal VCF auth flag is set on the command. Retry once connectivity and time are correct.

Cluster common datastore check failed

Import halts on a vSAN partition or absent components. Open vSAN Skyline Health, resolve any partition and bring absent components back online, confirm a single common datastore per cluster, then run the import again.

SSH thumbprint validation failed

Import cannot validate the vCenter SSH thumbprint. Enable SSH on the source vCenter, or verify the host identity yourself and pass the skip-ssh-thumbprint-validation flag on the import command.

Common questions

Import versus converge. Converge builds your first VCF management domain from a standalone vSphere environment. Import adds a brownfield environment to a fleet that already exists, as a VI workload domain.

Whether workloads move during import. No workload moves. Hosts, vSAN storage and running VMs stay where they are. Import registers the environment with VCF and leaves the data plane untouched.

Support for bare metal NSX edges. VCF 9.1 adds import support for environments that use bare metal NSX edge nodes, so those topologies no longer block onboarding.

Rollback if import fails. Your source environment stays intact throughout. If a stage fails, fix the flagged item and rerun. Import is idempotent enough to resume after a corrected precheck.

vSphere versions accepted. Source clusters must run vSphere 8.0 Update 3 or later and NSX 4.2 or later, including the back in time builds that VCF 9.1 supports for import.

Time a single cluster import takes. Plan 30 to 90 minutes for one cluster, and more for larger domains, because inventory collection scales with host count.

Whether the source NSX Manager stays in place. Yes. Import keeps your existing NSX Manager cluster and binds it to the new workload domain rather than deploying a fresh one.

References

• VMware Cloud Foundation 9.1 documentation on Broadcom TechDocs
• How to converge a vSphere environment to VMware Cloud Foundation, VCF blog
• Existing SDDC Manager extension detected, Broadcom KB 404182
• Workload domain import cluster common datastore check, Broadcom KB 423358

About The Author

Dr. Pranay Jha

Dr. Pranay Jha is a Cloud and AI Consultant with 18+ years of experience in hybrid cloud, virtualization, and enterprise infrastructure transformation. He specializes in VMware technologies, multi-cloud strategy, and Generative AI solutions. He holds a PhD in Computer Applications with research focused on Cloud and AI, has published multiple research papers, and has been a VMware vExpert since 2016 and a VMUG Community Leader.

See author's posts