VMware Cloud Foundation 9.1

Planning & Preparation Workbook — field guide

Detailed reference edition
Open workshop walkthrough
Field guide

How to use this guide

A live companion to the VCF 9.1 Planning & Preparation Workbook (v1.9.1.004, 27 tabs). One workbook tab per step. Open it on a second screen, walk the customer through each field, and answer “why do I need this?” with the card in front of you.

What each card gives you

What it is
Every meaningful workbook field as a card: what it is in plain language, why it’s needed, why this value / how to choose, and a validated Broadcom 9.1 doc link. Field-groups end with likely customer questions + crisp answers.
Why this value
Use the sidebar or the arrow keys (← →) to move between tabs. Home/End jump to the first/last step. The filter box searches tab names.

Tags & classification

What it is
Two independent labels on each field. Field tag: Required always needed for this operation, Conditional only if a toggle is set, Masked/API hidden in the installer UI or API-only. Component class: Mandatory Day-N Optional Licensed add-on.
Why this value
On input tabs, the Minimum-viable fields toggle hides everything conditional so you can show the bare-minimum bring-up set first, then reveal the rest.
Why “Rainpole”?Every sample value uses rainpole.io / sfo-* — that’s Broadcom’s fictional reference organisation used across all VCF documentation. It shows the shape of each answer; you replace it with the customer’s real domain, VLANs and IPs. Nobody keeps “Rainpole.”
3 IMAGESThe workbook embeds three pictures — a “vmw” logo tile, a “VMware Cloud Foundation” header banner, and a hero illustration of servers being craned into a cloud. All are decorative Broadcom branding, not data diagrams, so they are described here rather than reproduced.
Common first questions
Is this the official Broadcom workbook?
No — this is an enablement companion built from the workbook (v1.9.1.004) and validated against Broadcom TechDocs. Always download a fresh workbook before each design; it changes with every VCF release.
Do I fill values in here?
No. The workbook is where values are captured. This guide explains each field so you can speak to it and help the customer choose.
Tab 1 of 27

Prerequisite checklist

What must exist before bring-up. Hardware, network, external services and software. None of this is entered into the installer — it’s the environment the installer assumes is already there.

Hardware

Server count & type

MandatoryRequired
Workbook sample
2 servers (FC/NFS) · 3 (vSAN) · 4 for HA
What it is
The number and model of physical hosts for the management domain, from the VMware Compatibility Guide.
Why it’s needed
The management plane runs on these hosts; storage choice sets the floor.
Why this value
Two supported servers for a simple FC/NFS deployment, three for vSAN, four recommended for production HA. VCF supports 3-node vSAN in workload domains but 4+ is the production recommendation.
Broadcom Compatibility Guide

CPU / memory / boot & data storage

MandatoryRequired
Workbook sample
Rainpole: 1 TB RAM/host (4 hosts, N+1) · vSAN-ESA 4×3.2 TB NVMe/node
What it is
Per-host compute and the disks backing boot and the principal datastore (vSAN-OSA cache+capacity, vSAN-ESA NVMe, NFS or FC).
Why it’s needed
Drives whether the management appliances fit with a host failure tolerated.
Why this value
Size from the Management Domain Sizing tab, not a rule of thumb. SD-cards for boot are legacy/not recommended. Ensure no existing partitions on disks intended for vSAN. 25 GbE NICs recommended for vSAN-ESA.
Planning & Preparation (9.1)

NICs per server

MandatoryRequired
Workbook sample
1×10 GbE + 1×1 GbE BMC (single NIC supported with API-only)
What it is
Physical NICs per host — data plus a BMC/management NIC.
Why it’s needed
Determines uplink redundancy and which deployment paths are open.
Why this value
Two data NICs for resilient teaming is the norm; single-NIC is only supported via API. 25 GbE recommended for vSAN-ESA. VI workload-domain hosts support up to 64 pNICs.
Network design (9.1)
Network, services & software
Where you enter thisConfirmed with the customer’s network / AD / PKI teams — not entered in the installer.

Physical network

MandatoryRequired
Workbook sample
Jumbo frames · BGP AS numbers · ECMP · teaming
What it is
Fabric prerequisites: jumbo frames (vSAN, vMotion, host & edge overlay, NFS), BGP adjacency/AS numbers for dynamic routing, ECMP between edges and ToRs, and teaming on the VDS.
Why it’s needed
VCF’s storage, mobility and NSX overlay all assume these are in place.
Why this value
Confirm MTU 9000 end-to-end and BGP design with the network team before bring-up. Stretched-cluster deployments add cross-AZ routing requirements.
Network design (9.1)

Active Directory

MandatoryRequired
Workbook sample
Parent rainpole.io · Windows Server 2019/2022
What it is
An AD forest with DNS, time, and the SDDC users/groups, reachable by all management components.
Why it’s needed
Identity, DNS and time anchor the whole SDDC; the service accounts on the AD Inputs tab must pre-exist.
Why this value
All accounts/groups from the Active Directory Inputs tab must exist before install. Supported: Windows Server 2019 and 2022.
FeedsActive Directory Inputs tab
Planning & Preparation (9.1)

DNS & NTP

MandatoryRequired
Workbook sample
A+PTR for every FQDN · two NTP sources + CNAME
What it is
Forward and reverse DNS for every appliance/host FQDN, and at least two NTP sources.
Why it’s needed
Bring-up validates name resolution and time before it will proceed; cert trust and vSAN depend on time.
Why this value
Create A and PTR records for all FQDNs in the Deploy tabs; set dynamic updates and forest-wide zone replication. Use two NTP sources on different fault domains with a round-robin CNAME for cross-instance HA.
DNS/NTP prerequisites (9.1)

DHCP (optional) · SMTP · CA · SFTP · host-machine access

OptionalConditional
Workbook sample
DHCP scope for TEPs · mail relay · Microsoft CA · SFTP backup target
What it is
Supporting services: optional DHCP for host-overlay TEPs, an SMTP relay, a Certificate Authority able to sign CSRs, an SFTP target for NSX/SDDC Manager backups, and a jump host that routes to all management networks + internet.
Why it’s needed
Each underpins a specific later workflow (TEP auto-assignment, alerting, signed certs, backups, software download).
Why this value
DHCP needs 1 IP per NIC per host in scope. Microsoft CAs must support basic auth. Limit the SMTP relay to the SDDC management range. The SFTP target is configured through SDDC Manager.
Planning & Preparation (9.1)
Likely customer questions
Why four hosts when we see only a handful of VMs?
vSAN needs enough nodes to tolerate a failure and rebuild, and HA appliances spread across nodes. FC/NFS can run on two. The Sizing tab proves the exact number.
Do we have to use Microsoft CA?
No — signed certs are optional at bring-up (OpenSSL/self-signed works initially). If you do use Microsoft CA it must support basic authentication and CSR ingestion.
What single thing stalls bring-up most often?
Missing or wrong DNS records. Every FQDN here needs matching A and PTR entries before you start.
Tab 2 of 27

VCF & VVF planning options

The master switchboard. The selections here — deployment version, type, instance and operation — set defaults and unmask the relevant fields on every later tab. Get this right first; everything downstream inherits from it.

Deployment type
Where you enter thisInstaller UI wizard— these selections drive what appears on the Deploy tabs.

Deployment version

MandatoryRequired
Workbook sample
9.1.0.0
What it is
The VCF release being deployed.
Why it’s needed
Pins binary versions and the feature set; flows down to every tab’s Version field.
Why this value
Match the installer build you downloaded. Mixed versions aren’t supported within an instance.
Deployment (9.1)

Deployment specification (VCF vs VVF)

MandatoryRequired
Workbook sample
VMware Cloud Foundation
What it is
Whether you’re deploying full VMware Cloud Foundation (private cloud) or VMware vSphere Foundation (the lighter stack).
Why it’s needed
VVF is a subset — choosing it removes SDDC Manager-driven domains and several fleet components.
Why this value
VCF for the full private-cloud platform with workload domains and lifecycle; VVF when the customer only wants vSphere+vSAN+Operations without the full fleet.
VCF vs VVF (9.1)

Instance to operate on

MandatoryRequired
Workbook sample
First Instance
What it is
Whether this is the first VCF instance or an additional instance in an existing fleet.
Why it’s needed
The first instance deploys fleet-wide services (depot, LCM, identity broker); additional instances reuse them.
Why this value
First Instance for greenfield. Additional Instance when joining an existing fleet — sizing for shared services then becomes optional.
AffectsVCF services runtime sizing
Fleet & instances (9.1)

Operation to perform

MandatoryRequired
Workbook sample
Deploy deferred components
What it is
The action: deploy a new fleet, deploy an instance into a fleet, create a workload domain/cluster, or deploy components you deferred at bring-up.
Why it’s needed
Selects which Deploy/Configure tabs are in play for this pass.
Why this value
Drives the rest of the workbook. “Deploy deferred components” pairs with the Day-N fleet tab.
Deployment operations (9.1)
Likely customer questions
What’s the difference between VCF and VVF for us?
VVF is vSphere + vSAN + VCF Operations without the full SDDC-Manager fleet and workload-domain automation. Pick VCF if they want the managed private-cloud lifecycle and multiple domains.
Can we change these later?
Version and spec are foundational; changing them means a redeploy. Instance/operation are per-pass selections you revisit each time you run the workbook.
Classification

What’s included vs. what costs extra

The first question procurement asks. Sourced from the workbook’s Sizing and Planning logic — what bring-up forces on you, what you can defer to Day-N, what’s purely optional, and what needs a separate licence.

Component / capabilityClassWhy
SDDC Manager, management vCenter, NSX Manager (dedicated), VCF Operations + Cloud Proxy, VCF services runtimeMandatoryCore management plane — bring-up cannot complete without them. The Sizing tab marks the management domain and its NSX as “Mandatory” and the NSX instance as required and dedicated.
First workload domain NSXMandatoryMandatory once you add the first workload domain; later domains may share that NSX or deploy a dedicated instance.
Log Management, VCF Operations for Networks (+collector), Real-time Metrics, additional Software Depot / Identity Broker, VCF AutomationDay-NDefault to Exclude at bring-up and deploy later through the Deploy Fleet Management Day-N flow. Reduce the bring-up footprint without losing the option.
NSX Federation (Global Manager), Site Protection & DR, On-Prem / Cloud Ransomware Recovery, Cross Cloud Mobility, Private AI Ready InfrastructureOptionalToggled per design on the Planning and per-domain tabs; only sized and deployed if explicitly selected.
vDefend Security Services Platform (SSP / SSPI), Avi Load Balancer, License Hub for vDefend & AviLicensed add-onSeparately licensed. The workbook states a License Hub “is required if deploying Avi Load Balancers or Security Service Platform” (one per fleet). The appliances consume resources regardless of how many cores you licence.
Licensing scope ≠ footprintA partial vDefend/Avi licence does not shrink the appliances — SSP runs 1 SSPI + 3 controllers + 4 workers regardless. Decide first whether to deploy the capability, then separately which clusters to licence.
Likely customer questions
Is NSX an extra cost?
NSX Manager is mandatory and included — it underpins management connectivity, VPC networking and Supervisor. vDefend security services and Avi are the licensed add-ons, not base NSX.
What’s the absolute minimum to stand up?
The Mandatory core: SDDC Manager, VCF Operations (+ cloud proxy), the VCF services runtime and an NSX Manager — on 2 hosts (FC/NFS) or 4 (vSAN-ESA), N+1 for HA. Everything else is Day-N or optional.
Can we add the paid pieces later?
Yes — SSP, Avi and the recovery blueprints are all additive once the licence and License Hub are in place.
Tab 3 of 27

Management domain sizing

A standalone calculator. Inputs here don’t feed other tabs and vice-versa — it exists to prove how many hosts and how much CPU/RAM/storage the management plane needs, given the appliances and workload domains you intend to run.

Assumptions & host parameters
Where you enter thisSizing worksheet — a calculator, not installer input. Use it to justify the host count to the customer.

Host & operations reserve / storage growth

MandatoryRequired
Workbook sample
Reserve 30% · storage growth 10%
What it is
Headroom percentages the calculator holds back for host rebuild/operations and for storage growth.
Why it’s needed
Stops you sizing to 100% and having no room to patch, fail over or grow.
Why this value
30% reserve and 10% growth are sensible defaults; raise them for conservative customers or aggressive growth.
VCF Operations sizing (KB 397782)

Host parameters & oversubscription

MandatoryRequired
Workbook sample
128 cores · 1024 GB RAM · CPU 1:1 · mem 1:1 (max 2:1)
What it is
Per-host cores and RAM, and the CPU/memory oversubscription ratios.
Why it’s needed
Together with the appliance totals these decide the host count.
Why this value
Match the actual server spec. Oversubscription maxes at 2:1 for a performant management domain — keep 1:1 unless the customer accepts contention and monitors for it.
Configuration Maximums

Instance profile (model / availability / size)

MandatoryRequired
Workbook sample
First Instance · High Availability · Medium
What it is
The deployment model, availability model and size that set the predefined appliance footprints.
Why it’s needed
HA triples the node count for NSX/Ops/Automation — the biggest single sizing lever.
Why this value
HA + Medium for production. These mirror the choices on Deploy Management Domain but here they only drive the calculator.
Deploy the management domain (9.1)
Component include / exclude

VCF Management Services components

Day-NConditional
Workbook sample
Runtime Include · Log Mgmt / Ops-for-Networks / Real-time metrics Exclude
What it is
Toggles for each VCF services-runtime component and the Day-N additions.
Why it’s needed
Each included component adds nodes/VMs to the totals.
Why this value
Include only what you’ll run. Software Depot, LCM, Identity Broker and SALT are on by default on the first instance; Log Management/Real-time/Networks are typically Day-N. Log Management size shouldn’t exceed the instance profile — the cluster scales to fit it.
Lifecycle & services (9.1)

Per-domain sizing rows (vCenter / NSX / Avi / SSP)

OptionalConditional
Workbook sample
m01 Included · w01–w35 Excluded · NSX “Mandatory – HA Cluster”
What it is
One row per management and workload domain to select vCenter size, NSX model/size, federation, Avi and SSP per domain.
Why it’s needed
Each workload domain adds vSphere and (optionally) NSX components the management domain must host.
Why this value
Select the number and profile of domains you’ll deploy. Remember a single NSX Global Manager federates at most four Local Managers — factor that in before adding GM resources.
Design Guide (9.1)

Protection blueprint sizing

OptionalConditional
Workbook sample
VMware Live Recovery appliance · size Standard (no optionality)
What it is
Sizing rows for Site Protection & DR and On-Prem Ransomware Recovery appliances.
Why it’s needed
Adds the VMware Live Recovery footprint when those blueprints are selected.
Why this value
The Live Recovery appliance has no size options — it’s a fixed Standard footprint.
VMware Live Recovery
Standalone tabNothing here flows to the Deploy tabs and nothing flows in. It’s purely to calculate and justify host count — enter values to match your intended design, read the totals, size the hardware.
Likely customer questions
If we already run VCF Operations, do we size it again?
No — if Operations or Automation already exist, their sizing input isn’t required here; just exclude them.
Why does adding a workload domain grow the management domain?
Each workload domain needs its own vCenter and (optionally) NSX, and those run in the management domain — so more domains means more management-plane appliances.
Can we push oversubscription past 2:1?
You can set any ratio, but 2:1 is the supported max for a performant management domain. Beyond that, monitor continuously and add hardware when bottlenecks appear.
Tab 5 of 27

Deploy management domain

The bring-up sheet for the first VCF instance — the single most important tab. Depot, scale, networks, hosts, storage, the management appliances and the full FQDN/IP plan. Below: a networks-at-a-glance grid, then field-by-field cards grouped as the workbook orders them.

Networks at a glance
NetworkVLANMTUGateway (CIDR)IP pool / rangeNotes
ESX Management1111150010.11.11.1/24hosts .101–.116routable
VM Management1110150010.11.10.1/24appliance IPsroutable
VCF Management1199150010.11.99.1/24svcs .31–.45 · auto .46–.50routable
vMotion1112900010.11.12.1/24.101–.116L2-local ok
vSAN1113900010.11.13.1/24.101–.116L2-local ok
NFS (if NFS)1115900010.11.15.1/24.101–.116masked unless NFS
Host Overlay (TEP)11149000*10.11.14.1/24pool .101–.132*inherits VDS MTU
VPC uplink (transit GW)1198—10.11.98.1/24—must be routable
Jumbo framesvMotion, vSAN, NFS and overlay want MTU 9000 — confirm jumbo frames end-to-end on the fabric before bring-up. A wrong MTU passes validation but cripples vSAN.
FQDN / object conventionsfo01-m01-r01-esx01.sfo.rainpole.io · site-domain-rack-role
Depot settings & binary management
Where you enter thisInstaller UI wizard

Depot type

MandatoryRequired
Workbook sample
Online
What it is
Where the installer pulls VCF binaries from — Broadcom’s Online depot, or a customer-hosted Offline depot.
Why it’s needed
Bring-up and every later lifecycle action needs a binary source.
Why this value
Online if SDDC Manager has outbound internet (simplest). Offline for dark/air-gapped sites or to pin versions — then supply depot hostname/port.
Managing the software depot (9.1)

Download Service ID & Activation Code

MandatoryRequired
Workbook sample
Service ID rqkOYDQR…Rg4 · code sdfSDF…VBF
What it is
Your Broadcom entitlement token pair authorising binary downloads.
Why it’s needed
Authenticates the depot to your entitlement; without it the online depot returns nothing.
Why this value
Generated under your account at support.broadcom.com. One per fleet — treat as a secret.
Depot connectivity & tokens (9.1)

Offline depot hostname / port

OptionalMasked unless Offline
Workbook sample
my-offline-depot.rainpole.io : 443
What it is
FQDN and port of your internal binary depot mirror.
Why it’s needed
Tells the installer where to fetch bundles with no internet path.
Why this value
Resolvable in DNS, reachable on 443 from the management network. Use the host running your depot mirror.
Offline depot (9.1)

Proxy server (enable · protocol · FQDN · port · auth)

OptionalMasked unless enabled
Workbook sample
HTTPS · internet-proxy.rainpole.io : 443
What it is
An outbound proxy the depot rides through, with optional credentials.
Why it’s needed
Many enterprises only allow egress via a proxy.
Why this value
Use the corporate egress proxy; enable Authenticated only if it needs credentials.
Depot via proxy (9.1)
Match the installerAt least one DNS and one NTP entry on this sheet must match what the VCF Installer appliance itself uses, or bring-up validation fails early.
Deploy · scale · network · storage options
Where you enter thisInstaller UI wizard

Deployment model

MandatoryRequired
Workbook sample
High Availability (Three-Node)
What it is
Whether new VCF Operations, VCF Automation and NSX Manager come up single or as 3-node HA clusters.
Why it’s needed
Sets node count — the biggest driver of management-domain footprint.
Why this value
HA for production (survives a node loss); Simple only for labs/PoC. Doesn’t touch components you reuse.
Unlocks3-node sizingNoteSimple→HA later is disruptive
Deploy the management domain (9.1)

Size

MandatoryRequired
Workbook sample
Medium
What it is
The T-shirt size applied to the new management appliances.
Why it’s needed
Drives per-appliance vCPU/RAM/disk.
Why this value
Medium suits most first instances. Validate against the Sizing tab and your object counts — under-sizing Operations means a redeploy.
VCF Operations sizing (KB 397782)

VM / VCF management network model

MandatoryRequired
Workbook sample
VM mgmt: dedicated · VCF mgmt: dedicated or shared
What it is
How much you segregate management traffic — whether VCF management shares the VM management network or sits on its own.
Why it’s needed
Determines how many VLANs/subnets to pre-provision and how isolated the control plane is.
Why this value
Dedicated is cleaner for segmentation; shared uses fewer VLANs. Choose per the customer’s isolation posture.
Network design (9.1)

Transit Gateway type (VPC gateway connectivity)

MandatoryRequired
Workbook sample
Distributed connectivity
What it is
Whether north-south VPC routing is distributed (on hosts) or centralized (through an NSX Edge cluster).
Why it’s needed
Decides if you need an Edge cluster + BGP at bring-up or can defer.
Why this value
Distributed is the no-edge default. Centralized gives a Tier-0 with BGP — set up by a secondary workflow after bring-up.
Requires (if Centralized)Edge cluster + BGP (Configure Management Domain)
Centralized connectivity (9.1)

Storage option

MandatoryRequired
Workbook sample
vSAN-ESA · DiT encryption off · FTT 1
What it is
Principal storage: vSAN-ESA, vSAN-OSA, NFS or FC, plus encryption/FTT/dedupe toggles.
Why it’s needed
Sets datastore type, minimum host count, and which extra fields unmask.
Why this value
vSAN-ESA is the modern greenfield default (NVMe + 25 GbE). NFS/FC to reuse arrays or run 2-node. FTT/dedupe only apply to vSAN-OSA.
Storage design (9.1)
General information · DNS · NTP
Where you enter thisInstaller UI wizard

VCF instance name & management domain name

MandatoryRequired
Workbook sample
Instance San Francisco · domain sfo-m01
What it is
Friendly instance name and the SDDC identifier for its management domain.
Why it’s needed
Labels the instance across SDDC Manager/Operations and seeds object naming (≥3 chars).
Why this value
Use a site/region convention (sfo-m01 = San Francisco, management, 01). Consistency pays off across domains and sites.
Deploy the management domain (9.1)

DNS — suffix & two servers

MandatoryRequired
Workbook sample
suffix rainpole.io · 10.11.10.4, 10.11.10.5
What it is
Default DNS suffix and the two resolvers every appliance uses.
Why it’s needed
Every FQDN must resolve forward and reverse before bring-up.
Why this value
Use the customer’s authoritative DNS; one entry must match the installer’s resolver. Pre-create A + PTR for all hosts/appliances.
DNS prerequisites (9.1)

NTP — two servers

MandatoryRequired
Workbook sample
ntp0.sfo.rainpole.io, ntp1.sfo.rainpole.io
What it is
Two time sources for hosts, AD and every appliance.
Why it’s needed
Cert trust, vSAN, SSO and AD all break under clock skew.
Why this value
Two reachable sources on different upstreams; one must match the installer’s NTP. A CNAME round-robin gives cross-instance HA.
Time sources (9.1)
Hosts
Where you enter thisInstaller UI wizard

ESX root password & Host #1 FQDN (repeat per host, up to 16)

MandatoryRequired
Workbook sample
root VMw@re1! · sfo01-m01-r01-esx01.sfo.rainpole.io
What it is
The common ESX root credential and each host FQDN to commission. Hosts #2–#16 follow the same pattern.
Why it’s needed
Bring-up logs into each host by FQDN with this password to configure and claim it.
Why this value
FQDNs pre-staged in DNS (A+PTR), matching the host’s configured name. Host count from storage choice + HA (min 2 FC/NFS, 4 vSAN-ESA).
Commission hosts (9.1)
Repeat-per-hostThe workbook lists Host #1–#16 individually — cover Host #1 in full and note “repeat per host.”
Networks — detail
Where you enter thisInstaller UI wizard

ESX / VM / VCF management networks

MandatoryRequired
Workbook sample
ESX VLAN 1111 · VM 1110 · VCF 1199 (see grid)
What it is
The three management VLANs/subnets — host VMkernel, appliance VMs, and VCF services.
Why it’s needed
Host and appliance IPs are allocated from these subnets.
Why this value
Standard MTU 1500, routable to each other and DNS/NTP/AD. Sized /24s with growth headroom.
Network design (9.1)

VCF Management Services IP range

MandatoryRequired
Workbook sample
10.11.99.31 → 10.11.99.45
What it is
A contiguous pool the VCF services runtime draws node IPs from.
Why it’s needed
These services are multi-node and auto-scale.
Why this value
Minimum 12 IPs; size 30 for auto-scaling headroom. Free, contiguous, inside the VCF management subnet.
VCF services runtime networking (9.1)

VCF Automation IP range

Day-NConditional
Workbook sample
10.11.99.46 → 10.11.99.50 (5 IPs)
What it is
IPs for the VCF services runtime backing VCF Automation.
Why it’s needed
Automation runs on its own runtime nodes.
Why this value
4 active + 1 spare for rolling upgrades. Only if deploying Automation.
RequiresVCF Operations first
VCF Automation networking (9.1)

vMotion & vSAN networks

MandatoryRequired
Workbook sample
vMotion VLAN 1112 · vSAN VLAN 1113 · MTU 9000 · pools .101–.116
What it is
Dedicated VMkernel networks for live migration and vSAN, each with a host IP pool.
Why it’s needed
Bring-up assigns each host a vMotion and vSAN VMkernel from these pools.
Why this value
Jumbo frames required; ToR must support 9000 end-to-end. Pool ≥ host count. L2-local is fine.
vSAN / vMotion design (9.1)

NFS network

OptionalMasked unless NFS
Workbook sample
VLAN 1115 · MTU 9000 · 10.11.15.1/24 · .101–.116
What it is
VMkernel network for NFS datastore traffic.
Why it’s needed
Only when NFS is principal storage.
Why this value
Jumbo frames; reachable to the NAS; pool ≥ host count.
NFS design (9.1)

Host overlay network (TEP)

MandatoryRequired
Workbook sample
VLAN 1114 · IP Pool .101–.132
What it is
The NSX host Tunnel Endpoint network where Geneve overlay tunnels terminate.
Why it’s needed
NSX is mandatory in VCF 9; every host needs a TEP.
Why this value
MTU inherited from VDS (≥1600, 9000 recommended). IP Pool simplest (range ≥ 2× host count for multi-TEP); DHCP alternative.
Host TEP design (9.1)
Management appliances — FQDNs
Where you enter thisInstaller UI wizardFQDNs · API-onlypasswords & per-appliance sizing (JSON Generator).

VCF Operations (primary / replica / data / LB)

MandatoryRequired
Workbook sample
primary flt-ops01a · replica …b · data …c · LB flt-ops01
What it is
FQDNs for the 3-node VCF Operations cluster and optional LB VIP.
Why it’s needed
Operations is mandatory core; HA needs three node names.
Why this value
Fleet-level (flt-) naming — Operations spans the fleet. All in DNS. LB FQDN only for external-LB HA.
UnlocksVCF Automation
VCF management appliances (9.1)

Cloud Proxy · License Server · fleet / instance / identity-broker / runtime FQDNs

MandatoryRequired
Workbook sample
sfo-cp01 · flt-lc01 · flt-fc01 · sfo-ic01 · flt-idb01 · sfo-sr01
What it is
The hosted fleet/instance services: collection proxy, license server, fleet & instance components, identity broker, VCF services runtime.
Why it’s needed
Each addressable service needs an FQDN for access and certificates.
Why this value
flt- for fleet-wide, instance prefix for per-instance. The runtime FQDN’s hostname is prepended to its node VM names — choose deliberately.
Fleet / instance components (9.1)

VCF Automation FQDN (+ dedicated runtime)

Day-NConditional
Workbook sample
flt-auto01 · runtime flt-vcfa-sr01
What it is
VCF Automation and its own VCF services runtime (separate from the MGMT services runtime).
Why it’s needed
Only if deploying Automation; it brings a dedicated runtime.
Why this value
Don’t reuse the MGMT runtime FQDN. Can be deferred to the Day-N fleet flow.
RequiresVCF Operations first
VCF Automation (9.1)

vCenter — FQDN, datacenter, cluster, SSO domain

MandatoryRequired
Workbook sample
sfo-m01-vc01 · DC sfo-m01-dc01 · cluster sfo-m01-cl01 · SSO vsphere.local
What it is
The management vCenter FQDN, the vSphere objects it creates, and the SSO domain.
Why it’s needed
vCenter is the heart of the management domain.
Why this value
Keep vsphere.local unless mandated (changing complicates federation). SSO username only unmasks when importing an existing vCenter.
Management vCenter (9.1)

NSX Manager — cluster VIP + 3 nodes + VPC uplink

MandatoryRequired
Workbook sample
cluster sfo-m01-nsx01 · nodes …a/b/c · VPC uplink VLAN 1198
What it is
NSX Manager cluster VIP, its three node FQDNs, and the external VLAN for distributed transit-gateway uplink.
Why it’s needed
NSX is mandatory; a 3-node cluster gives control-plane HA.
Why this value
All four NSX FQDNs in DNS. The VPC uplink VLAN must be routable in the customer environment.
NoteFederation needs dedicated NSX — not shared
NSX Manager deployment (9.1)

SDDC Manager — FQDN & installer location

MandatoryRequired
Workbook sample
sfo-vcf01.sfo.rainpole.io · deployed on a management host
What it is
FQDN of SDDC Manager — the VCF Installer converts into SDDC Manager during bring-up.
Why it’s needed
SDDC Manager is the lifecycle/control point for the instance.
Why this value
This exact FQDN must be the one set on the VCF Installer. Pre-stage in DNS.
SDDC Manager / installer (9.1)

vDefend Security Services Platform

Licensed add-onConditional
What it is
The vDefend SSP/SSPI security stack (distributed firewall intelligence, NDR, malware prevention).
Why it’s needed
Separately licensed; only sized/deployed if selected.
Why this value
Appliances consume resources regardless of licence scope. Production = 1 SSPI + 3 controllers + 4 workers; ATP adds one 16 vCPU/64 GB worker.
RequiresLicense Hub for vDefend & Avi (one per fleet)
vDefend / Security Services (9.1)
Storage & distributed switch
Where you enter thisInstaller UI wizard

Datastore name & storage detail

MandatoryRequired
Workbook sample
sfo-m01-cl01-ds-vsan01 · NFS share /share/… @ 10.11.15.200
What it is
Principal datastore name plus storage-specific detail: vSAN rekey settings, or NFS share path/server.
Why it’s needed
Names the datastore bring-up creates/mounts; supplies NFS array detail.
Why this value
Follow the cluster naming convention. Rekey fields unmask with vSAN DiT encryption; NFS share/server only with NFS.
Storage design (9.1)

Distributed switch profile, VDS, MTU, uplinks & LAG

MandatoryRequired
Workbook sample
profile Default · VDS sfo-m01-cl01-vds01 MTU 9000 · 2 uplinks vmnic0/1
What it is
The vSphere Distributed Switch layout applied to every host: name, MTU, uplink count, NIC mapping, optional LAG/LACP. Up to three VDS by profile.
Why it’s needed
Defines how host pNICs carry every traffic type.
Why this value
MTU 9000 end-to-end. Two uplinks is the resilient default. LAG/LACP fields unmask only with VDS Uplinks = LAG; most use active/active “route based on physical NIC load.”
VDS design (9.1)

Port groups per traffic type + NSX operational mode

MandatoryRequired
Workbook sample
…-pg-esx-mgmt / -vm-mgmt / -vcf-mgmt / -vmotion / -vsan · NSX Enhanced Datapath Standard
What it is
Distributed port-group names and teaming per traffic type, and the NSX overlay operational mode.
Why it’s needed
Each traffic type lands on a named port group; NSX needs its datapath mode.
Why this value
Default teaming “route based on physical NIC load”, both uplinks active. Enhanced Datapath Standard is the default NSX mode. NFS PG only with NFS.
Port-group / NSX datapath (9.1)
Passwords & appliance sizing (API-only)
Where you enter thisAPI-onlyNot in the installer UI — use the VCF JSON Generator once planning is complete.

Auto-generate vs explicit passwords (all appliances)

MandatoryAPI-only
Workbook sample
auto-generate Selected · else per-appliance admin/root/audit
What it is
Whether VCF auto-generates and vaults appliance passwords, or you set them explicitly across Operations, Cloud Proxy, Automation, NSX, SDDC Manager and vCenter SSH.
Why it’s needed
Every appliance needs credentials; this decides who owns them.
Why this value
Auto-generate is recommended — rotatable in VCF Operations password management. Explicit passwords are API-only.
Managing passwords (9.1)

Customize appliance sizing (per appliance)

OptionalAPI-only
Workbook sample
Ops Medium 8/32 · Proxy Standard 8/48 · vCenter Medium 8/30 · NSX Medium 6/24/300
What it is
Per-appliance size overrides beyond the single global Size.
Why it’s needed
Right-size individual appliances when the global size doesn’t fit.
Why this value
API-only — generate JSON with the VCF JSON Generator. Cross-check the Sizing tab and KB 397782.
VCF Operations sizing (KB 397782)
FQDN & IP address plan (summary)

Consolidated IP map — every appliance & host

MandatoryRequired
Workbook sample
runtime .10 · LB VIP .21 · Ops .52–.54 · vCenter 10.11.10.70 · NSX .71–.74 · ESX 10.11.11.101–116
What it is
The single table capturing the reference IP for every FQDN — appliances, NSX, vCenter, SDDC Manager, installer, each ESX host.
Why it’s needed
It’s the DNS work order: every row needs a matching A + PTR record.
Why this value
IPs sit inside the relevant subnet (appliances on VM/VCF mgmt, hosts on ESX mgmt). Hand this table to the DNS team early — missing records are the #1 bring-up stall.
Planning & Preparation (9.1)
Tab-level customer questions
What must exist before bring-up?
DNS A+PTR for every FQDN here, two NTP sources, the VLANs/subnets trunked (jumbo where noted), hosts imaged and reachable, and the depot reachable. The IP-map table is your DNS checklist.
Which fields are UI vs API-only?
Explicit passwords and per-appliance sizing are API-only via the JSON Generator. Everything else is in the installer wizard — flagged with the Masked/API tag.
Why two columns in the workbook?
“Sample” is the Rainpole reference to show format; “Your Value” is what you fill for this customer.
Tab 6 of 27

Configure management domain

Post-deployment options for the management domain. Each is gated by a toggle at the top of the tab — turn one on and its fields unmask. Covers backups, signed certificates, NSX edge/BGP connectivity, Supervisor, Avi, vSAN stretched cluster and NSX Federation.

Post-deployment option selectors
Where you enter thisSDDC Manager / VCF Operations workflowsEach toggle gates a section below.

Feature toggles

MandatoryRequired
Workbook sample
SFTP backups · signed certs · NSX connectivity · Supervisor · Avi · stretched cluster · federation — each Include/Exclude
What it is
The switchboard for which post-config workflows run.
Why it’s needed
Determines which sections of this tab apply; excluded ones stay masked.
Why this value
Enable only what this design needs now — most are additive later. SFTP backups should always be on.
Post-deployment configuration (9.1)
SFTP backups (SDDC Manager & NSX)
Where you enter thisSDDC Manager / VCF Operations

SFTP target — host, port, protocol, user, dir, fingerprint, passphrase

MandatoryRequired
Workbook sample
20.10.5.10:22 · user svc-vcf-bck · dir /backups/ · SHA256 fingerprint
What it is
The SFTP server and credentials VCF uses to back up SDDC Manager and NSX configuration.
Why it’s needed
Protects the control-plane config; backups are configured through SDDC Manager.
Why this value
Reachable from each SDDC component; limit access to the management range. Encryption passphrase ≥ 8 chars, 2 upper, 2 lower, 2 digits. Capture the SSH fingerprint for trust.
Configure backups (9.1)
Apply signed certificates (Microsoft / OpenSSL CA)
Where you enter thisVCF Operations — certificate management

Microsoft CA — server URL, basic-auth account, template, SDDC service account

OptionalConditional
Workbook sample
CA URL https://rpl-ad01.rainpole.io/certsrv · template VMware · svc svc-vcf-ca
What it is
Connects VCF Operations to a Microsoft CA so it can request signed certs for the appliances, plus the CSR attributes (org, OU, country, key size).
Why it’s needed
Replaces self-signed certs with enterprise-trusted ones.
Why this value
Microsoft CA must support basic auth. Pre-create the VMware template and the svc-vcf-ca account with cert-management rights. Key size 4096, algorithm RSA.
RequiresMicrosoft CA + service account (Prerequisite Checklist)
Certificate management (9.1)

OpenSSL-signed certificate CSR attributes

OptionalConditional
Workbook sample
RSA · 4096 · OU IT · O Rainpole · San Francisco, CA, US
What it is
The certificate-signing-request fields when using OpenSSL/self-signed instead of Microsoft CA.
Why it’s needed
Drives the generated CSR/cert identity.
Why this value
Use real org/locality details so issued certs read correctly. Alternative to the Microsoft CA path.
Certificate management (9.1)
NSX network connectivity — edge cluster + BGP
Where you enter thisvCenter / NSX workflowOnly if Centralized connectivity was chosen.

Edge cluster — name, form factor, edge node FQDNs

OptionalConditional
Workbook sample
cluster sfo-m01-ec01 · Medium · nodes sfo-m01-en01/02
What it is
The NSX Edge cluster and its edge node VMs that provide centralized north-south connectivity.
Why it’s needed
A Tier-0 with BGP rides on these edges.
Why this value
Two edge nodes for HA; Medium form factor for management. Edge nodes deploy on the management cluster/datastore with management IPs.
RequiresCentralized connectivity selected
Edge clusters (9.1)

Edge TEP — VLAN, pool/static, CIDR, gateway

OptionalConditional
Workbook sample
TEP VLAN 1119 · pool sfo-m01-ip-pool02-edge · 10.11.19.2–.5
What it is
Tunnel-endpoint network for the edge nodes — IP pool or static list.
Why it’s needed
Edge overlay tunnels terminate here.
Why this value
Edge TEP can reuse the host TEP VLAN. Edge TEP MTU (1700) is set by the Global Fabric setting. Pool sized for 2 TEPs per edge.
Edge TEP (9.1)

Tier-0 gateway + BGP uplinks (per edge)

OptionalConditional
Workbook sample
GW sfo-m01-ec01-t0-gw01 · Active-Active · ASN 65101 · uplink VLANs 1117/1118 · peers .10 ASN 65111 · BFD
What it is
The Tier-0 gateway, its uplink interfaces (VLAN + IP), and BGP peering to the top-of-rack switches.
Why it’s needed
Establishes dynamic routing between the SDDC and the physical fabric.
Why this value
Active-Active for throughput. Local ASN per design; peer ASN/IP/password from the network team (two ToR peers). BFD on for fast failover. MTU 9000.
RequiresBGP AS numbers + ToR peering (network team)
Tier-0 / BGP (9.1)

VPC external & private IP blocks

OptionalConditional
Workbook sample
ext 192.168.21.0/24 · priv (transit GW) 172.16.0.0/16
What it is
External (routable) and private (transit-gateway) IP blocks for VPC networking, plus the virtual network appliance cluster.
Why it’s needed
VPCs draw external and private addressing from these blocks.
Why this value
External block must be routable in the customer environment; private block is internal-only. Name blocks by convention.
VPC networking (9.1)
Supervisor (vSphere IaaS / Kubernetes)
Where you enter thisvCenter — Supervisor enablement

Supervisor — name, networking stack, zone, control-plane HA & size

OptionalConditional
Workbook sample
sfo-m01-sn01 · VCF Networking with VPC · CP HA on · Small
What it is
Enables vSphere Supervisor on the management cluster — name, networking stack, vSphere zone, control-plane size.
Why it’s needed
Provides the Kubernetes control plane for modern apps / Private AI.
Why this value
Use VCF Networking with VPC for the NSX-integrated path. Small CP for management-domain Supervisor; enable CP HA for production.
Using the Supervisor (9.1)

Supervisor management & workload networks

OptionalConditional
Workbook sample
mgmt 10.11.10.201–.205 · service CIDR 172.31.0.0/16 · VPC CIDR 172.32.0.0/16
What it is
The management IP range (5 control-plane IPs), DNS/NTP/search domains, and the NSX project/VPC blocks plus service/pod CIDRs.
Why it’s needed
Supervisor control plane and workloads need addressing that doesn’t collide with the SDDC.
Why this value
Five contiguous management IPs. Service/VPC CIDRs must not overlap existing networks. API server DNS name pre-staged.
Supervisor networking (9.1)
Avi Load Balancer
Where you enter thisSDDC workflow—

Avi controller — version, form factor, 3 node IPs, VIP, FQDN, admin password

Licensed add-onConditional
Workbook sample
v31.1.1 · Medium · nodes 10.11.10.92–.94 · VIP .91 · sfo-m01-avilb01
What it is
The Avi (NSX Advanced) Load Balancer controller cluster.
Why it’s needed
Provides advanced L4–L7 load balancing; licensed separately.
Why this value
Three controller nodes + a cluster VIP for HA. Admin password ≥ 15 chars, 1 upper, 1 special.
RequiresLicense Hub for vDefend & Avi
Avi Load Balancer (9.1)
vSAN stretched cluster & witness
Where you enter thisSDDC Manager API + vCenterMulti-AZ only.

AZ2 host config, network pool, commission, stretch API

OptionalConditional
Workbook sample
AZ2 ESX VLAN 1211 · pool sfo02-m01-r01-network-pool-01 · vMotion/vSAN/NFS VLANs 1212/1213/1215
What it is
The second availability zone: ESX management network, a new VCF network pool, host commissioning, and the SDDC Manager stretch API.
Why it’s needed
Stretches the management vSAN cluster across two AZs for site resilience.
Why this value
AZ2 mirrors AZ1’s network layout on a different subnet range. Requires routing between AZ1/AZ2 ESX management subnets and stretched L2 for the listed networks.
Stretched cluster design (9.1)

vSAN witness — FQDN, IP, networks, NTP, register

OptionalConditional
Workbook sample
witness sfo-m01-cl01-vsw01 · IP 10.21.10.218 · on lax-m01-vc01
What it is
The vSAN witness appliance in a third fault domain — deploy, register, NTP, VMkernel config.
Why it’s needed
Provides the quorum component for the stretched cluster.
Why this value
Host the witness on a vCenter outside AZ1 and AZ2. DNS servers should be in different fault domains.
Requireswitness OVA + third site/vCenter
vSAN witness (9.1)
NSX Federation (Global Manager)
Where you enter thisNSX + vCenter workflows

Global Manager cluster — 3 nodes, VIP, anti-affinity, certs

OptionalConditional
Workbook sample
GM nodes sfo-m01-nsx-gm01a/b/c · VIP 10.11.10.81 · Medium
What it is
A 3-node NSX Global Manager cluster (VM names, IPs, passwords, VIP, anti-affinity rule, CA-signed certs) that federates Local Managers across sites.
Why it’s needed
Provides consistent multi-site networking/security policy and faster DR failover.
Why this value
Three GM nodes with an anti-affinity rule and a VIP. A single GM federates at most four Local Managers.
Requiresdedicated NSX (not shared)
NSX Federation (9.1)
Tab-level customer questions
Do we have to do all of this at bring-up?
No — every section here is gated by a toggle and most are additive later. SFTP backups and signed certs are the common day-one items; edge/BGP, Supervisor, Avi, stretch and federation come when the design calls for them.
Why does Centralized connectivity need an edge cluster?
Distributed connectivity routes on the hosts; Centralized puts a Tier-0 gateway with BGP on dedicated NSX Edge nodes — so you must deploy and peer those edges.
Can we run Federation on shared NSX?
No — federated domains need a dedicated NSX instance. Plan that before sharing NSX across domains.
Tab 7 of 27

Deploy fleet management (Day-N)

The deferred-components flow. Anything you excluded at bring-up to keep the footprint small — VCF Operations/Automation, Log Management, Operations for Networks — is deployed here later, onto the existing management domain.

Operation selectors
Where you enter thisVCF Installer — deferred components· some options API-only

Networking model + which components to deploy

Day-NRequired
Workbook sample
Shared Management Network · Ops & Automation / Auth / Log mgmt / Ops-for-Networks each Include/Exclude
What it is
Selects the networking model for the deferred deploy and which capabilities to add now.
Why it’s needed
Drives which sections unmask.
Why this value
Shared Management Network reuses the VM management network. Add only what the customer is ready to operate.
Deploy deferred components (9.1)
VCF fleet target & SSO
Where you enter thisVCF Installer

SDDC Manager FQDN + SSO admin

Day-NRequired
Workbook sample
sfo-vcf01.sfo.rainpole.io · administrator@vsphere.local
What it is
The existing SDDC Manager and SSO administrator the deferred deploy authenticates against.
Why it’s needed
Day-N components attach to the already-deployed fleet.
Why this value
Use the SDDC Manager FQDN and SSO admin set at bring-up.
Deploy deferred components (9.1)
Scale, network & component FQDNs
Where you enter thisVCF Installer

Scale options (model / size / CEIP)

Day-NRequired
Workbook sample
HA (three-node) or Simple · Medium · CEIP on
What it is
Deployment model and size for the newly deployed Operations/Automation.
Why it’s needed
Sets the footprint of the deferred appliances.
Why this value
Match the management-domain model. Note: Simple forces size Small in the installer UI.
Scale options (9.1)

VCF management traffic network + Automation IP range

Day-NRequired
Workbook sample
PG sfo-m01-cl01-vds01-pg-vm-mgmt · GW 10.11.10.1/24 · Auto 10.11.10.46–.50
What it is
The port group/gateway the deferred Operations/Automation use, and the Automation IP range.
Why it’s needed
The new appliances need a network and addresses.
Why this value
Reuse the VM management port group for shared networking. Automation range = 4 active + 1 spare.
Deferred networking (9.1)

Operations / Cloud Proxy / License Server / Automation FQDNs + IPs

Day-NRequired
Workbook sample
Ops flt-ops01a/b/c · proxy sfo-cp01 · license flt-lc01 · auto flt-auto01
What it is
FQDNs and reference IPs for each deferred appliance — same set as the bring-up tab, deployed later.
Why it’s needed
Each needs an addressable name and a DNS record.
Why this value
Same naming/DNS rules as Deploy Management Domain. The IP table mirrors that tab’s plan.
VCF management appliances (9.1)

Customize passwords / portgroup / sizing

OptionalAPI-only
Workbook sample
all Unselected by default — JSON Generator
What it is
Optional overrides for appliance passwords, proxy portgroup/networking, and sizing.
Why it’s needed
Right-size or set explicit credentials on deferred components.
Why this value
API-only via the VCF JSON Generator; otherwise system defaults apply.
Managing passwords (9.1)
Tab-level customer questions
Why defer components at all?
To keep the bring-up footprint and risk small. You stand up the mandatory core, validate it, then add Operations-for-Networks, Log Management, Automation when the customer needs them.
Does deferring cost us anything?
No functional loss — the same components, deployed later onto the running fleet. Just plan the IPs/FQDNs up front so DNS is ready.
Tab 8 of 27

Deploy workload domain

Stand up a VI workload domain through VCF Operations. Its own vCenter and NSX (new or shared), hosts, network pool and the same traffic networks as the management domain — but on a workload addressing range.

Networks at a glance
NetworkVLANMTUGateway (CIDR)IP pool / rangeNotes
ESX Management1311150010.13.11.1/24hosts .101–.116routable
vMotion13129000—.101–.116pool
vSAN13139000—.101–.116pool
vSAN storage client13159000—.101–.116if separate storage cluster
WLD FQDN conventionsfo01-w01-r01-esx01.sfo.rainpole.io · site-WLD-rack-role
Domain & component options
Where you enter thisVCF Operations — workload domain workflow

Deploy a workload domain + storage model

MandatoryRequired
Workbook sample
vSAN-ESA principal storage · external-cert option
What it is
The toggle to create a WLD and its principal storage model (vSAN-ESA/OSA, NFS, FC, VMFS-on-FC).
Why it’s needed
First WLD makes its NSX mandatory; storage sets host minimums.
Why this value
vSAN-ESA for greenfield. The external-certificate option is for hosts pre-loaded with signed certs.
Create a workload domain (9.1)

vCenter — external/new, FQDN, root password

MandatoryRequired
Workbook sample
sfo-w01-vc01.sfo.rainpole.io · connected to NSX
What it is
The workload-domain vCenter — a new appliance or an external one to import.
Why it’s needed
Each WLD has its own vCenter (running in the management domain).
Why this value
New vCenter for standard deployments. “Connected to NSX” when importing a vCenter already registered with NSX.
Workload domain vCenter (9.1)

NSX Manager — new instance or shared, 3 FQDNs + VIP, passwords

MandatoryRequired
Workbook sample
nodes sfo-w01-nsx01a/b/c · VIP sfo-w01-nsx01
What it is
A new NSX Manager cluster for this WLD or sharing an existing instance, plus admin/root/audit passwords.
Why it’s needed
NSX is mandatory; first WLD’s NSX is required.
Why this value
Create new for isolation or if you’ll federate; share to save resources. Overlay can reuse ESX management VMkernel networking.
NoteFederation needs dedicated NSX
WLD NSX Manager (9.1)
Hosts, network pool & traffic networks
Where you enter thisVCF Operations

ESX management network + host IPs (repeat per host)

MandatoryRequired
Workbook sample
VLAN 1311 · GW 10.13.11.1/24 · hosts 10.13.11.101+
What it is
The WLD ESX management VLAN/subnet and each host’s management IP. Hosts 2–16 repeat.
Why it’s needed
Hosts are commissioned on this network.
Why this value
Workload addressing range (10.13.x here vs 10.11.x management). Pre-stage DNS A+PTR.
Commission WLD hosts (9.1)

Network pool — vMotion / vSAN / storage-client VLANs & ranges

MandatoryRequired
Workbook sample
pool sfo01-w01-r01-network-pool-01 · vMotion 1312 · vSAN 1313
What it is
A VCF network pool grouping vMotion, vSAN and (optional) storage-client networks with IP ranges.
Why it’s needed
Hosts draw VMkernel IPs from the pool.
Why this value
Jumbo frames on vMotion/vSAN. Ranges ≥ host count. Storage-client only for disaggregated vSAN.
Network pools (9.1)

Host FQDNs & storage type

MandatoryRequired
Workbook sample
sfo-w01-vc01 hosts · vSAN HCI · ESA selected
What it is
The host FQDNs to commission and the vSAN type (HCI/ESA) or external storage.
Why it’s needed
Defines cluster membership and storage.
Why this value
Match DNS. vSAN ESA for NVMe; HCI-classic or external for reuse.
Workload domain storage (9.1)
Tab-level customer questions
Where does the WLD vCenter/NSX actually run?
In the management domain. The workload domain provides capacity for workloads; its control-plane appliances live on the management cluster.
New NSX or shared?
Dedicated NSX isolates the WLD and is required if you’ll federate it; sharing the management/first-WLD NSX saves appliances. It’s a design trade-off, not a hard rule (except federation).
Three hosts or four?
Three-node vSAN is supported; four is the production recommendation to tolerate a failure and rebuild cleanly.
Tab 9 of 27

Configure workload domain

Post-deployment options for a workload domain — the WLD mirror of the management-domain post-config: signed certs, NSX edge/BGP connectivity, Avi and NSX Federation, on the workload addressing range.

Post-deployment selectors
Where you enter thisvCenter / NSX workflows

Feature toggles

OptionalRequired
Workbook sample
signed certs · NSX connectivity · Avi · federation — each Include/Exclude
What it is
Which WLD post-config workflows run.
Why it’s needed
Gates the sections below.
Why this value
Enable per design; certs and edge connectivity are the common ones.
Workload domain configuration (9.1)
NSX edge connectivity for the workload domain
Where you enter thisvCenter / NSX workflowCentralized connectivity only.

Edge cluster + nodes (Large form factor)

OptionalConditional
Workbook sample
cluster sfo-w01-ec01 · Large · nodes sfo-w01-en01/02
What it is
The WLD NSX Edge cluster providing centralized north-south for workloads.
Why it’s needed
Workload VPCs/segments route north-south through these edges.
Why this value
Large form factor for workload throughput (vs Medium for management). Two nodes for HA.
RequiresCentralized connectivity selected
Edge clusters (9.1)

Edge TEP + Tier-0 + BGP uplinks

OptionalConditional
Workbook sample
TEP VLAN 1319 · uplinks 1317/1318 · BGP to ToRs
What it is
Edge TEP network, Tier-0 gateway and BGP uplinks on the workload addressing range.
Why it’s needed
Dynamic routing between WLD overlay and the fabric.
Why this value
Same pattern as the management edge, on 10.13.x. ASN/peer details from the network team.
RequiresBGP AS numbers + ToR peering
Tier-0 / BGP (9.1)
Avi & Federation

Avi Load Balancer (WLD)

Licensed add-onConditional
Workbook sample
controller cluster + VIP on the WLD
What it is
Avi load balancing scoped to the workload domain.
Why it’s needed
Advanced L4–L7 for workloads; licensed separately.
Why this value
Three controllers + VIP. Requires the License Hub.
RequiresLicense Hub for vDefend & Avi
Avi Load Balancer (9.1)

NSX Federation for workload domain

OptionalConditional
Workbook sample
Global Manager federation of the WLD’s NSX
What it is
Federates the WLD’s NSX Local Manager under a Global Manager for multi-site policy.
Why it’s needed
Consistent policy and faster DR across sites.
Why this value
Requires dedicated NSX for the WLD; a single GM federates at most four LMs.
Requiresdedicated NSX
NSX Federation (9.1)
Tab-level customer questions
Is this different from the management-domain post-config?
Same workflows, scoped to the workload domain and its addressing. Edge form factor is typically Large here for workload throughput.
Do all workload domains need edges?
Only if they use Centralized connectivity. Distributed connectivity needs no edges.
Tab 10 of 27

Deploy cluster

Add a cluster to an existing workload domain — single-rack or multi-rack Layer-2, optionally stretched. Hosts, a network pool and traffic networks, much like a WLD deploy but attaching to a domain that already exists.

Networks at a glance
NetworkVLANMTUGateway (CIDR)IP pool / rangeNotes
ESX Management1311150010.13.11.1host IPsroutable
vMotion13129000—.101–.116pool
vSAN13139000—.101–.116pool
vSAN storage client13159000—.101–.116if disaggregated
vSAN storage cluster13169000—.101–.116separate vSAN cluster
Cluster options & hosts
Where you enter thisVCF Operations / SDDC Manager — add cluster

Target workload domain + storage model + stretched toggle

OptionalRequired
Workbook sample
domain sfo-w01 · vSAN-ESA · stretched Exclude
What it is
Which existing WLD to add the cluster to, its storage model, and whether it’s a vSAN stretched cluster.
Why it’s needed
Determines placement and storage; stretched adds AZ2 + witness fields.
Why this value
Pick the parent domain. Multi-rack L2 spreads the cluster across racks on one L2 domain.
Add a cluster (9.1)

ESX management network + host IPs & FQDNs (repeat per host)

OptionalRequired
Workbook sample
VLAN 1311 · hosts 10.13.11.101+ · sfo01-w01-r01-esx01
What it is
The cluster’s management VLAN/subnet and each host’s IP/FQDN. Hosts 2–16 repeat.
Why it’s needed
Hosts are commissioned onto this network and joined to the new cluster.
Why this value
Reuse the WLD addressing scheme. DNS A+PTR pre-staged.
Commission hosts (9.1)

Network pool — vMotion / vSAN / storage VLANs & ranges

OptionalRequired
Workbook sample
pool sfo01-w01-r01-network-pool-01 · jumbo frames
What it is
The network pool for the new cluster’s vMotion/vSAN/storage VMkernels.
Why it’s needed
Hosts draw VMkernel IPs from it.
Why this value
Jumbo frames; ranges ≥ host count. Storage-cluster network only for disaggregated vSAN (separate storage cluster).
Network pools (9.1)

Storage type, network pool name, host password

OptionalRequired
Workbook sample
vSAN HCI · ESA selected · root VMw@re1!
What it is
The cluster storage type and the common host root password.
Why it’s needed
Sets cluster storage and host access.
Why this value
vSAN ESA for NVMe; classic/external for reuse.
Cluster storage (9.1)
Tab-level customer questions
Cluster vs workload domain — what’s the difference?
A workload domain is a management boundary (its own vCenter/NSX). A cluster is compute capacity inside a domain. Add clusters to scale a domain; add domains to isolate.
What’s multi-rack L2?
A single cluster spanning racks that share one Layer-2 domain — for scaling beyond a rack while keeping one cluster. Additional Racks covers the per-rack networks.
Tab 16 of 27

Additional racks

Per-rack networks for a multi-rack Layer-2 cluster. Each added rack needs its own ESX management, vMotion and vSAN ranges — this tab captures rack 2, rack 3, and so on.

Per-rack networks (rack 2 shown — repeat per rack)
Where you enter thisSDDC Manager / VCF Operations — expand cluster

Rack ESX management network + host IPs

OptionalRequired
Workbook sample
VLAN 1322 · GW 10.13.22.1 · hosts 10.13.22.101+
What it is
The added rack’s ESX management VLAN/subnet and host IPs.
Why it’s needed
Each rack is a distinct L2/subnet within the stretched-L2 cluster.
Why this value
Allocate a new VLAN/subnet per rack (1322 for rack 2, etc.). DNS for each host.
Multi-rack clusters (9.1)

Rack network pool — vMotion / vSAN VLANs & ranges

OptionalRequired
Workbook sample
pool sfo01-w01-r02-network-pool-01 · vMotion 1323 · vSAN 1324
What it is
The per-rack network pool for vMotion and vSAN.
Why it’s needed
Rack hosts draw VMkernel IPs locally.
Why this value
One pool per rack; jumbo frames; ranges ≥ rack host count.
Network pools (9.1)

Rack host FQDNs, storage type, password

OptionalRequired
Workbook sample
sfo01-w01-r02-esx01… · vSAN · root VMw@re1!
What it is
The added rack’s host FQDNs and storage/credentials.
Why it’s needed
Defines the rack’s host membership.
Why this value
Naming carries the rack id (r02). Match DNS.
Commission hosts (9.1)
Repeat per rackThe workbook repeats this block for each additional rack — cover rack 2 and note “repeat per rack,” incrementing the VLAN/subnet and rack id each time.
Tab-level customer questions
Why separate networks per rack?
In a multi-rack L2 cluster each rack typically has its own management/vMotion/vSAN subnets behind its ToR pair, stretched at L2 where needed. It keeps fault domains and addressing clean.
Is this only for stretched L2?
Yes — it’s for expanding a cluster across racks. A single-rack cluster doesn’t need it.
Tab 27 of 27

Active Directory inputs

Completed by the customer’s AD team. Every service account and security group VCF needs — these must exist in AD before install. The accounts enable application-to-service and application-to-application communication; the groups map to product roles.

AD structure
Where you enter thisCreated in the customer’s Active Directory — not in any VCF UI. Values surface in the relevant workflow tabs.

Parent/child FQDN, NetBIOS & OUs

MandatoryRequired
Workbook sample
Parent RAINPOLE · child SFO · OU ou=Security Users,dc=sfo,dc=rainpole,dc=io
What it is
The AD forest/child domain names, NetBIOS names and the OUs that hold the SDDC users and groups.
Why it’s needed
VCF binds to these domains and places/reads accounts in these OUs.
Why this value
Use the customer’s real forest. Separate user and group OUs per domain as shown.
AD prerequisites (9.1)
Service accounts (application ↔ service / application)
Where you enter thisPre-created in AD; referenced by the certificate, identity and integration workflows.

Identity / IAM bind accounts

MandatoryRequired
Workbook sample
svc-vsphere-ad · svc-nsx-ad
What it is
Bind accounts for vSphere and NSX to read AD for authentication.
Why it’s needed
LDAP(S) bind for identity source configuration.
Why this value
Least-privilege read accounts; non-expiring passwords are common for service accounts.
Identity sources (9.1)

Operations / Logs / Networks / Automation / HRM / HCX service accounts

Day-NConditional
Workbook sample
svc-ops-vcf, svc-logs-ad, svc-net-vsphere, svc-cmp-nsx, svc-hrm-ops, svc-hcx-vsphere …
What it is
Per-integration service accounts for Operations→VCF/vCenter/Automation, Logs→AD, Networks→vCenter, Automation→vSphere/NSX/VCF, Health Reporting, and HCX.
Why it’s needed
Each product-to-product integration authenticates with its own account.
Why this value
Create only the accounts for components you’ll deploy (many are Day-N). Naming convention svc-<role>-<target>.
Service accounts (9.1)
Security groups (product roles)
Where you enter thisPre-created in AD; mapped to roles during identity configuration.

Role groups across SDDC Manager, NSX, vSphere, Ops, Logs, Networks, Automation, Kubernetes

OptionalConditional
Workbook sample
gg-vcf-admins, gg-nsx-network-admins, gg-ops-admins, gg-kub-admins, gg-cmp-org-owners …
What it is
Global groups that map to admin/operator/read-only roles in each product.
Why it’s needed
Role assignment is group-based, not per-user — cleaner governance.
Why this value
Create the groups for products in scope; add the customer’s admins. Convention gg-<product>-<role>.
Roles &amp; groups (9.1)
Service account / group conventionsvc-ops-vcf · gg-vcf-admins · svc-<role>-<target> / gg-<product>-<role>
Tab-level customer questions
Who fills this in?
The customer’s AD team — it’s the one tab explicitly owned outside the VCF deployment team. Hand it over early; accounts and groups must exist before install.
Do we need every account?
No — only those for components you’ll deploy. Identity binds (vSphere/NSX) are core; Ops/Logs/Networks/Automation/HCX accounts follow whatever you turn on.
Why groups instead of direct user roles?
Group-based role mapping scales and audits better — add/remove people in AD without touching VCF role assignments.
Tab 17 of 27

Site protection &amp; DR

VMware Live Recovery for site protection and disaster recovery. A protected site and a recovery site, paired vCenters, replication appliances, protection groups and recovery plans. Optional — only if the customer is buying DR.

VMware Live Recovery appliance &amp; pairing
Where you enter thisvCenter / VMware Live Recovery

VLR appliance — cluster, network, IP, passwords

OptionalConditional
Workbook sample
cluster sfo-m01-cl01 · PG …-pg-vm-mgmt · FQDN sfo-m01-vlr01 · IP 10.11.10.125
What it is
The VMware Live Recovery appliance deployment — placement, management network, IP and initial root/admin passwords.
Why it’s needed
VLR orchestrates replication and recovery between sites.
Why this value
Deploy on the management cluster/VM-management network. Fixed Standard size (no optionality).
VMware Live Recovery (9.x)

vSphere Replication network (VRMS) + host IPs

OptionalConditional
Workbook sample
PG sfo01-m01-cl01-vds01-pg-vrms · VLAN 1109 · GW 10.11.9.1
What it is
A dedicated replication port group/VLAN and the per-host replication VMkernel IPs.
Why it’s needed
Replication traffic is isolated from management.
Why this value
Dedicated VLAN for VR traffic; one VMkernel IP per host.
vSphere Replication (9.x)

Site pairing — recovery vCenter, site names, license

OptionalConditional
Workbook sample
pair sfo-m01-vc01 ↔ lax-m01-vc01 · site SFO-M01 · license key
What it is
Pairs the protected and recovery vCenters and supplies the VLR license key.
Why it’s needed
Establishes the bidirectional DR relationship.
Why this value
Recovery site is a second VCF instance/location (e.g. LAX). License key per the entitlement.
Requiresa recovery site (second instance)
Site pairing (9.x)
Protection groups &amp; recovery plans

Network mappings, RPO, protection group, recovery plan

OptionalConditional
Workbook sample
RPO 15 min · PG VCF-OPS-PG · RP VCF-OPS-RP
What it is
Protected/recovery network mappings, the Recovery Point Objective, and the named protection group and recovery plan.
Why it’s needed
Defines what is protected, how current the copy is, and the failover runbook.
Why this value
RPO per the customer’s tolerance (15 min shown). Map protected→recovery networks; group the management/workload VMs that fail over together.
Protection groups (9.x)
Tab-level customer questions
Is two management domains overkill for DR?
It’s the recommended pattern — a management domain at the recovery site keeps a control plane alive to manage recovered workloads if the primary is lost.
What RPO can we hit?
Down to minutes with vSphere Replication (15 min shown). Tighter RPO means more replication bandwidth — size accordingly.
Tab 18 of 27

Cyber recovery

Cyber Recovery for VCF — an isolated clean room and a protection/recovery appliance with a connector VM, so workloads can be recovered into a quarantined environment after an attack. Optional.

Protection &amp; recovery appliance
Where you enter thisvCenter / VMware Live Recovery

Appliance — cluster, network, IP, passwords

OptionalConditional
Workbook sample
cluster sfo-m01-cl01 · IP 10.11.10.218
What it is
The Cyber Recovery protection/recovery appliance placement and addressing.
Why it’s needed
Drives replication into the clean room and recovery orchestration.
Why this value
On the management cluster/VM-management network. IPv4 family shown.
Cyber Recovery (9.x)

Replication network + per-host IPs

OptionalConditional
Workbook sample
PG sfo-w01-cl01-vds01-pg-vrms · VLAN 1316 · hosts 10.13.16.101+
What it is
The replication port group/VLAN and per-host replication IPs on the protected WLD.
Why it’s needed
Isolates recovery replication traffic.
Why this value
Dedicated VLAN; one IP per host.
Replication network (9.x)
Clean room &amp; pairing

Clean room, connector VM, cluster pairing, license

OptionalConditional
Workbook sample
clean room VCF-CR-Clean-Room · pair sfo-w01-cl01 ↔ lax-w01-cl01
What it is
The isolated clean-room name, the connector VM, the protected↔recovery cluster pairing and the license key.
Why it’s needed
Recovery happens into a quarantined network so suspected-compromised workloads can be validated safely.
Why this value
Clean room is network-isolated by design. Connector VM uses static IP allocation. Recovery cluster at a second site.
Requiresrecovery site + license
Clean room (9.x)
Tab-level customer questions
How is this different from DR?
DR recovers to a running recovery site after an outage. Cyber Recovery recovers into an isolated clean room so you can inspect and clean potentially-compromised workloads before reintroducing them.
Does it need its own hardware?
It needs recovery-side capacity and an isolated network for the clean room — typically at a second site.
Tab 19 of 27

On-prem ransomware recovery

VMware Live Recovery for on-premises ransomware recovery — like Cyber Recovery but the isolated recovery network and pairing are fully on-prem. Optional.

VLR appliance — cluster, network, IP, passwords

OptionalConditional
Workbook sample
cluster sfo-m01-cl01 · FQDN sfo-w01-vlr01 · IP 10.11.10.127
What it is
The Live Recovery appliance for on-prem ransomware recovery.
Why it’s needed
Orchestrates isolated recovery on-premises.
Why this value
Management cluster/VM-management network; Standard size.
Ransomware recovery (9.x)

Replication network + isolated recovery + pairing + RPO

OptionalConditional
Workbook sample
VRMS VLAN 1309 · isolated GW 192.168.90.1/24 · pair sfo-w01 ↔ lax-w01 · RPO 24h
What it is
Replication network, the isolated recovery segment, site pairing and RPO.
Why it’s needed
Recovers workloads into an isolated on-prem network for cleaning.
Why this value
Dedicated VR VLAN; an isolated recovery segment; RPO per tolerance (24h shown for ransomware).
Requiresrecovery site/cluster
On-prem ransomware (9.x)
Tab-level customer questions
On-prem vs cloud ransomware recovery?
This keeps everything on-premises (recovery cluster + isolated segment). The cloud-based variant recovers into a cloud Recovery SDDC instead — see the next blueprint.
Tab 25 of 27

Cloud-based ransomware recovery

VMware Live Cyber Recovery using a cloud Recovery SDDC (e.g. on AWS) and a cloud file system, with connector appliances on-prem. Optional; involves cloud-side resources and firewall rules.

Recovery SDDC + cloud file system + region

OptionalConditional
Workbook sample
SDDC aws-recovery-sddc · region Europe (Ireland)
What it is
The cloud Recovery SDDC and cloud file system that receive replicated data.
Why it’s needed
Provides cloud-side recovery capacity without owning a second datacenter.
Why this value
Choose the region nearest the customer / per data-residency. Recovery SDDC is provisioned cloud-side.
Cloud ransomware recovery (9.x)

Firewall rules + vCenter inbound + connector appliances

OptionalConditional
Workbook sample
inbound rule for 69.34.34.11 · connector on …-pg-esx-mgmt · IP 10.11.10.44
What it is
Cloud firewall rules (vCenter/HCX inbound), the on-prem Live Cyber Recovery connector appliances, and anti-affinity placement.
Why it’s needed
Connectors bridge on-prem to the cloud Recovery SDDC; firewall rules permit the control traffic.
Why this value
Scope firewall rules to known source IPs. Connectors use static IPs on the management network.
Requirescloud subscription + Recovery SDDC
Connectors &amp; firewall (9.x)
Tab-level customer questions
Do we need a cloud account?
Yes — a cloud Recovery SDDC and file system are provisioned cloud-side, plus the licensing. On-prem you only run the connector appliances.
Is the recovered environment isolated?
Yes — recovery is into the cloud Recovery SDDC, separated from production, for safe validation.
Tab 26 of 27

Cross cloud mobility

VMware HCX for migrating/extending workloads to a cloud Mobility SDDC (e.g. VMC on AWS). HCX connector, network profiles, compute profile and service mesh. Optional.

Mobility SDDC + HCX license + admin

OptionalConditional
Workbook sample
SDDC mobility-sddc · HCX license key · cloud admin
What it is
The target cloud Mobility SDDC and HCX licensing/credentials.
Why it’s needed
The destination for migrated/extended workloads.
Why this value
Provisioned cloud-side. HCX license key per entitlement.
Cross Cloud Mobility (9.x)

HCX connector, network profiles, compute profile, service mesh, firewall

OptionalConditional
Workbook sample
connector (child) · compute profile sfo-w01-compute-profile · mesh sfo-w01-service-mesh
What it is
The on-prem HCX connector, its network/compute profiles, the service mesh and cloud firewall rules.
Why it’s needed
HCX builds the transport fabric for live migration and network extension.
Why this value
Connector deploys on-prem; compute/network profiles describe each side; the service mesh ties them together. Firewall rules scoped to known IPs.
Requirescloud Mobility SDDC + HCX license
HCX deployment (9.x)
Tab-level customer questions
What’s this for?
Migrating or extending workloads between the on-prem VCF and a cloud SDDC — lift-and-shift, datacenter evacuation, or hybrid extension — using HCX.
Does it need AD accounts?
Yes — HCX-to-vCenter and HCX-to-NSX service accounts (svc-hcx-*) from the AD Inputs tab.
Tab 24 of 27

Private AI ready infrastructure

GPU-ready Kubernetes on VCF — a Tanzu Kubernetes cluster, GPU VM classes, the NVIDIA GPU and network operators, and the NSX/vSphere plumbing for AI workloads. Optional; builds on Supervisor.

NSX/vSphere Kubernetes plumbing

OptionalConditional
Workbook sample
segment sfo-w01-seg01-tanzu · prefix/route-map on …-t0-gw01 · tag vsphere-with-tanzu-tag
What it is
The NSX segment, IP prefix list and route map, plus vCenter category/tag/storage-policy/content-library for Kubernetes.
Why it’s needed
Provides the network and placement constructs Tanzu/Supervisor needs.
Why this value
Names by convention. Requires Supervisor enabled (Configure Management/Workload Domain).
RequiresSupervisor enabled
vSphere IaaS / Supervisor (9.1)

Tanzu Kubernetes cluster + namespace

OptionalConditional
Workbook sample
cluster sfo-w01-tkc01 on sfo-m01-cl01 · namespace sfo-w01-tkc01
What it is
The TKG cluster and its namespace where AI workloads run.
Why it’s needed
The Kubernetes runtime for containerised AI.
Why this value
One namespace per cluster shown; size per workload.
Tanzu Kubernetes (9.1)

GPU VM class + GPU/network operators

Licensed add-onConditional
Workbook sample
class vgpu-a100-16vcpu-128gb · 16 vCPU / 64 GB reserved · gpu-operator / nvidia-network-operator
What it is
The vGPU VM class and the NVIDIA GPU Operator and Network Operator namespaces.
Why it’s needed
Exposes physical GPUs to Kubernetes pods for AI/ML.
Why this value
VM class matches the physical GPU (A100 shown) with CPU/memory reservations. NVIDIA AI Enterprise licensing applies.
RequiresNVIDIA GPUs + AI Enterprise licensing
GPU workloads (9.1)
Tab-level customer questions
What hardware does this need?
GPU-equipped hosts (e.g. NVIDIA A100/L40S) in the workload domain, plus NVIDIA AI Enterprise licensing for the operators.
Is it separate from Supervisor?
No — it builds on vSphere Supervisor/Tanzu. Enable Supervisor first, then layer the GPU operators and VM classes.
Tab 20 of 27

Management domain as-built

An output, not an input. After bring-up this records the management domain’s NSX routing and network values so post-config tasks and future audits have one source of truth. You read it; you don’t design from it.

What this records
Where you enter thisReference sheet — populated from the deployed environment, used by later workflows.

NSX routing reference — VLANs, gateways, MTUs

MandatoryReference
Workbook sample
VM mgmt VLAN 1110 · uplink1 1117 · uplink2 1118 · edge overlay 1119 (MTU 9000)
What it is
The as-deployed VM management, uplink and edge-overlay networks — VLAN, gateway/CIDR and MTU — for the management domain.
Why it’s needed
Post-config tasks (BGP, edge add/remove, troubleshooting) reference these exact values; it’s the record of what was actually built.
Why this value
Each value maps to a process in the deployment documentation. Treat as the authoritative record — keep it current if networks change.
NSX connectivity reference (9.1)
Tab-level customer questions
Do we fill this in?
Largely no — it captures what was deployed. It’s your hand-off/audit sheet, useful for change control and the next engineer.
Why does it duplicate the deploy tabs?
It consolidates the routing-relevant values in one place so post-deployment NSX tasks don’t hunt across tabs.
Tab 21 of 27

Workload domain as-built

The workload-domain equivalent of the previous sheet — the as-deployed NSX routing and network record for a WLD, on the workload addressing range. An output for reference and audit.

What this records
Where you enter thisReference sheet — populated from the deployed WLD.

WLD NSX routing reference — VLANs, gateways, MTUs

MandatoryReference
Workbook sample
VM mgmt VLAN 1310 · uplink1 1317 · uplink2 1318
What it is
The as-deployed VM management, uplink and overlay networks for the workload domain.
Why it’s needed
Used by WLD post-config and troubleshooting; the record of what was built.
Why this value
Keep aligned with the deployed state; reference for BGP/edge changes.
NSX connectivity reference (9.1)
Tab-level customer questions
One per workload domain?
Effectively yes — each WLD has its own routing record. Duplicate the sheet per domain in practice.
Tabs 4, 22–23, 11–15

Reference &amp; machinery tabs

The remaining tabs are the workbook’s engine, not customer input. They drive dropdowns, validation and the JSON Generator behind the scenes. Know what they are so you can tell a customer “you don’t touch these” — and where the few useful lookups live.

Lookups you can read

Static Reference Tables

ReferenceDon’t edit
Workbook sample
vCenter sizes (Tiny…XLarge) · NSX Manager/Edge sizes · Include/Exclude lists
What it is
The lookup lists every dropdown in the workbook pulls from — appliance sizes, storage models, yes/no and include/exclude enumerations.
Why it’s needed
Centralises the allowed values so the input tabs stay consistent.
Why this value
Read-only reference. Handy when a customer asks “what sizes exist for X?” — the answer is here.
Design Guide — sizing reference (9.1)

Public Reference Sheet

ReferenceDon’t edit
What it is
Published reference values and constants shared across the workbook.
Why it’s needed
Backs formulas and validation.
Why this value
Read-only. No customer input.
Planning &amp; Preparation (9.1)

Version History

ReferenceDon’t edit
Workbook sample
v1.9.1.004 · dated 15 Jun 2026
What it is
The workbook’s own changelog and version stamp.
Why it’s needed
Confirms you’re on the current workbook for this VCF release.
Why this value
Check this first — always design from the latest workbook. Download a fresh copy per engagement.
Planning &amp; Preparation (9.1)
Back-end engine (never edit)

Change Control · Arkham · Value Reference Tables · Dumping Ground

InternalDon’t edit
What it is
The hidden machinery: change-control metadata, the “Arkham” and value-reference engines, and a scratch “Dumping Ground” that feed the JSON Generator and cross-sheet formulas.
Why it’s needed
They make the dropdowns, validation and API/JSON export work.
Why this value
Leave them alone. Editing risks breaking validation and the JSON Generator. If a customer asks, these are internal plumbing — not deployment input.
Deployment (9.1)
One thing to actually checkOpen Version History at the start of every engagement and confirm the workbook version matches the VCF release you’re deploying. Everything else in this step is read-only or hands-off.
Tab-level customer questions
Can we delete the tabs we don’t use?
No — the reference/machinery tabs feed formulas, dropdowns and the JSON Generator across the whole workbook. Hide them if you like, but don’t delete or edit them.
What’s the JSON Generator?
A capability (new in this workbook version) that emits the API/JSON for the fields the installer UI can’t set — explicit passwords and per-appliance sizing. The machinery tabs build that output.
Reference

Validated Broadcom 9.1 references

Every doc linked in this guide, in one place — all validated against Broadcom TechDocs for VCF 9.1. Use these when a customer wants the authoritative source behind an answer.

Planning & Preparation (9.1)https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/planning-and-preparation.htmlDeployment (9.1)https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/deployment.htmlDeploy the management domainhttps://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/deployment/deploying-vcf/deploy-the-management-domain.htmlVCF management applianceshttps://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/deployment/vcf-management-appliances.htmlDesign Guide (9.1)https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/design.htmlManaging the software depothttps://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/managing-the-vcf-software-depot.htmlOffline depothttps://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/managing-the-vcf-software-depot/download-vcf-binaries-to-an-offline-depot.htmlCentralized connectivity / edge clustershttps://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/building-your-private-cloud-infrastructure/managing-network-connectivity-in-vcenter/managing-centralized-network-connectivity-with-edge-clusters.htmlBuilding your private cloud (workload domains)https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/building-your-private-cloud-infrastructure.htmlManaging passwordshttps://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/administration/managing-passwords.htmlLifecycle managementhttps://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/lifecycle-management.htmlSecurity (vDefend)https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/security.htmlUsing and managing the Supervisorhttps://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/using-and-managing-the-supervisor.htmlVCF Operations sizing (KB 397782)https://knowledge.broadcom.com/external/article/397782/Configuration Maximumshttps://configmax.broadcom.com/homeCompatibility Guidehttps://compatibilityguide.broadcom.comVMware Live Recoveryhttps://techdocs.broadcom.com/us/en/vmware-cis/vlr/9-0.html
Enablement companion built from the VCF 9.1 Planning & Preparation Workbook (v1.9.1.004, 15 Jun 2026) and validated against Broadcom TechDocs. Sample values are Broadcom’s fictional “Rainpole” reference org. Always download a fresh workbook per engagement — fields change with every release. Not an official Broadcom document.