What it isThe workbook can size brand-new hardware (greenfield) or measure what additional appliances will consume on existing hardware (converge).
Why it’s in the workbookThe same sheet serves both, so half the inputs may not apply to a given engagement.
What to enterFor a converge, you populate component selections and read the total resource output; you can largely ignore the per-host greenfield inputs.
Say it like this“We’re not buying hosts today — we’re checking whether one of your existing clusters can absorb these management appliances. So we’ll skip the host-parameter inputs and focus on the totals.”
What it isA fleet is the whole VCF estate managed centrally. An instance is one VCF deployment within it. A domain is a vCenter + NSX boundary inside an instance — either management or workload.
Why it’s in the workbookThe workbook asks you to declare the instance (First vs Additional) and then enumerate domains; fleet-level services only deploy on the first instance.
Say it like this“Fleet = the estate, instance = this deployment, domain = a vCenter boundary. Fleet services live on your first instance only.”
What it isThe management domain runs the control plane (SDDC Manager, VCF Operations, Automation, plus the vCenters and NSX Managers of every domain). Workload domains run business workloads.
Why it’s in the workbookCustomers assume each appliance lives “with” its workload — it doesn’t. A workload domain’s vCenter and NSX controllers actually run in the management domain.
Watch-outA management domain is still a management domain whether it has dedicated hardware or runs workloads alongside it. The old “consolidated / standard architecture” wording from 5.x is retired in VCF 9 — don’t promise a “consolidated domain” by name.
Say it like this“Even your workload domain’s vCenter and NSX controllers run up in the management domain. That’s why adding a workload domain still adds load to management.”
What it isA unified, containerized runtime that hosts lifecycle and operational services — fleet lifecycle, SDDC lifecycle, identity broker, log management, real-time metrics, Salt, software depot, telemetry — on a VCF services runtime.
Why it’s in the workbookIt replaces the old Aria Suite Lifecycle / separate-manager sprawl and is why the sizing sheet has “control nodes” and “worker nodes” lines.
Sizing / resource impactAdding components (Automation, Operations for Networks) can auto-resize the runtime by adding worker nodes.
Say it like this“In 9.1 the management plane is one containerized runtime. When we switch components on, the runtime scales its worker nodes automatically.”
What it isInclude everything first to see the maximum resource ceiling, screenshot it, then back components out to find the true minimum.
Why it’s in the workbookIt answers both questions a customer has: “what’s the most this could ever need?” and “what’s the least to get started?”
Say it like this“Let’s build the worst-case version first so we know the ceiling, then trim to a bare-minimum version. You’ll end up with two saved scenarios.”
Start here
Mandatory vs optional — at a glance
What you must deploy to converge, versus optional, paid, or design-specific components.
Log managementReal-time metricsOperations for NetworksIdentity Broker / Software DepotVCF Automation
Paid add-ons
vDefend / SSPAvi Load BalancervDefend & Avi License Hub
Conditional — only if designed
NSX Federation / Global ManagerSite Protection & DRCyber RecoveryRansomware RecoveryCross Cloud Mobility (HCX)Private AI Ready InfravSAN stretched cluster
Component
Classification
Deploys when
Add later?
SDDC Manager
Mandatory
Bring-up
No
VCF Operations (+ Cloud Proxy)
Mandatory
Bring-up
No
VCF services runtime
Mandatory
Bring-up
Auto-scales
NSX Manager
Mandatory
Bring-up
No — NSX is required in 9.x
vCenter (per domain)
Mandatory
Per domain
No
Log management
Optional
Day-N
Yes
Real-time metrics
Optional
Day-N
Yes
VCF Operations for Networks
Optional
Day-N
Yes
VCF Automation
Optional
Day-N
Yes — needs Operations first
Identity Broker / Software Depot (extra)
Optional
Day-N
Yes
vDefend / SSP
Paid
If licensed
Yes
Avi Load Balancer
Paid
If licensed
Yes
NSX Federation / Global Manager
Conditional
Multi-site only
Yes — needs dedicated NSX
Site Protection & DR
Conditional
If DR designed
Yes
Cyber / Ransomware Recovery
Conditional
If protection designed
Yes
Cross Cloud Mobility (HCX)
Conditional
If migrating to cloud
Yes
Private AI Ready Infra
Conditional
If AI workloads
Yes
Start here
Visual models
Three pictures that settle the questions customers ask most. Point at them while you talk.
1 · A workload domain’s control plane runs in the management domain2 · NSX Federation — active / standby Global Manager3 · From bare-minimum to high-watermark
Workbook tab 1 of 27
Prerequisite Checklist
The gate before bring-up. It’s split into management-domain hardware, workload-domain hardware, network, storage, and stretched-cluster requirements. Treat it as the “did we satisfy the entry conditions” list.
What it isMinimum supported server, CPU and memory configuration for the hosts that will run the management domain.
Why it’s in the workbookBring-up validation will fail if hosts aren’t on the Broadcom Compatibility Guide or are under-spec.
What to enterConfirm models against the Compatibility Guide; capture per-host cores and RAM.
Watch-out“Supported configuration” is not a number you invent — it must match the Compatibility Guide for that exact server + storage combo.
Say it like this“Two things have to be true before we deploy: the hardware is on the Compatibility Guide, and it clears the minimum CPU/RAM. Let’s verify both now.”
What it isExtra routing/latency requirements when the domain stretches across availability zones.
Why it’s in the workbookStretched clusters add a witness and inter-AZ routing constraints.
Say it like this“Only relevant if you’re stretching a cluster across two AZs — then we need routing between the ESX management networks and a witness.”
Workbook tab 2 of 27
VCF & VVF Planning
A short tab that sets the deployment’s identity: product, version, instance role, and the operation being performed. It seeds defaults the rest of the workbook reads.
Operation — Deploy new / Add instance / Add cluster
Required
What it isThe action being planned, which tailors which downstream tabs you fill.
Why it’s in the workbookSame workbook, different journeys: greenfield bring-up, expanding a fleet, or just adding a cluster.
Say it like this“This dropdown reshapes the workbook to the journey we’re on — new build, new instance, or new cluster.”
Workbook tab 3 of 27
Management Domain Sizing
The engine room — assumptions and the instance profile, every appliance toggle, the per-domain rows, and the host-requirement output. The longest tab; take it top to bottom.
1 · A workload domain’s control plane runs in the management domain
What it isStreams high-frequency performance data — ~5-second intervals vs the usual 5/10/15-minute collection.
Why it’s in the workbookNew in 9.1, Day-N, on every instance.
Sizing / resource impactAdds appliance footprint for the higher fidelity.
Say it like this“New in 9.1 — five-second metrics instead of minutes. Worth it if they care about fine-grained performance; otherwise skip to save resources.”
What it isInfrastructure provisioning and workflow automation.
Why it’s in the workbookOptional and easily added later, but it’s the single heaviest appliance.
Sizing / resource impact~24 vCPU / 96 GB — the most impactful single toggle on the sheet.
Watch-outRequires VCF Operations first (lifecycle dependency).
Say it like this“Automation is powerful but it’s 24 vCPU / 96 GB — the biggest line item. Include it for the high-watermark, decide later if you’ll run it.”
What it isThe vCenter appliance size for that domain (e.g. Medium ≈ 8 vCPU / 30 GB) and its storage tier.
Why it’s in the workbookEvery domain has its own vCenter — and it runs in the management domain.
Watch-outA Medium vCenter supports a limited number of connected vCenters/objects; size up if the domain count is high. 9.1 adds a one-call resize API.
Say it like this“Each domain’s vCenter is sized here — remember it physically runs in management, not out in the workload cluster.”
What it isThe NSX Local Manager topology for the domain. Shared reuses management’s NSX; Dedicated stands up its own; HA Cluster = 3-node.
Why it’s in the workbookLowest footprint is shared; isolation or federation needs dedicated.
Sizing / resource impactShared NSX shows 0 net-new resources (you reuse existing) — pull the running NSX’s real usage separately.
Watch-out9.1 change: the first workload domain no longer needs a dedicated NSX — it can join management’s NSX. But shared NSX cannot run Federation.
Say it like this“Shared NSX is cheapest and now allowed for your first workload domain — but the moment you want Federation, that domain needs its own NSX.”
What it isEnables a multi-site NSX Global Manager. Active-Active = both author policy; Active-Standby = one authoritative + warm failover; Connected = join an existing federation.
Why it’s in the workbookFederation gives consistent policy and faster failover across sites — the usual reason customers want it for DR.
Sizing / resource impactAdds Global Manager appliances (size them equally across paired domains).
Watch-outRequires dedicated (non-shared) NSX. Don’t toggle federation on a shared-NSX domain.
Say it like this“Federation adds a Global Manager at each site. Active-Standby is the common DR pattern — one site authoritative, the other warm.”
What it isThe platform behind vDefend micro-segmentation and security services (~6 vCPU / 24 GB; appears as SSP in workload rows).
Why it’s in the workbookRequired to deliver vDefend; it’s a paid add-on.
Sizing / resource impactIf included in the management domain, you don’t run it again in the workload domain.
Watch-outLicensing scope is independent of deployment. The appliances run and consume resources regardless of how many cores you’ve licensed — a partial license does not shrink the footprint. Decide (1) deploy or not, and separately (2) which clusters to license.
Say it like this“Two separate questions: do we deploy SSP at all, and which clusters do we license it to protect? The resource cost is the appliances; the license just governs coverage.”
What it isThe summed VM demand across every included component and domain (e.g. ~11 fleet VMs at 114 vCPU / 292 GB / 7.6 TB in a minimal profile, climbing to 30–40 VMs fully loaded).
Why it’s in the workbookThis is the demand side of the capacity question.
Say it like this“This total is what we test against your existing clusters — the demand these appliances place on whichever data center hosts management.”
What it isRequired hosts computed from CPU, RAM and storage demand, taking the largest of the three, with an N-1 (failure) assumption.
Why it’s in the workbookN-1 means it sizes assuming you can lose a host.
Sizing / resource impactThe minimum still applies: 2 hosts (FC/NFS) or 4 (vSAN-ESA), and N+1 for HA headroom.
Say it like this“It sizes for losing a host — so the number already includes failure headroom. With ~40 VMs you’re typically a couple of blades plus HA.”
What it isThe source lists behind every dropdown (valid sizes, models, options).
Why it’s in the workbookEditing here breaks the dropdowns — it’s lookup data.
Say it like this“That’s the dropdown source — read-only; we don’t touch it.”
Workbook tab 5 of 27
Deploy Management Domain
A data-entry sheet feeding the VCF Installer during bring-up, ordered the way the wizard asks for it: VCF Fleet, VCF Operations, VCF Automation, then the VCF Instance. The teaching point is categories and prerequisites, not every cell.
Reference values
Where you enter thisInstaller UI FQDNs & networks · API-only passwords & per-appliance sizing
What it isMicrosoft Certificate Authority integration: install CA roles, configure basic auth, create a template, assign privileges, and issue CA-signed certs via Operations/SDDC Manager.
Why it’s in the workbookReplaces self-signed certs with enterprise PKI.
What to enterCA server URL, service-account credentials, template name, cert subject fields (Org, OU, Country, State).
Watch-outThe cert subject fields and CA template must match the customer’s PKI standards exactly, or issuance fails.
Say it like this“We wire VCF into your Microsoft CA here so every appliance gets an enterprise-signed cert instead of self-signed.”
What it isOptional post-deploy actions: stretch the management cluster across AZs, and/or deploy the Avi load balancer.
Why it’s in the workbookOnly when the design calls for multi-AZ or Avi.
Say it like this“These are conditional — stretched cluster only if you’re multi-AZ, Avi only if you licensed it.”
Workbook tab 7 of 27
Deploy Fleet Management Day-N
Where deferred components get specified after the platform is live — the Operations nodes, Cloud Proxy, License Server, Automation and the deferred toggles. Note several Day-N items are API-only.
Reference values
Where you enter thisVCF Installer deferred-components flow
What it isParameters to add a new single-rack or multi-rack Layer-2 cluster into a selected workload (or management) domain — ESX management network (VLAN/gateway/CIDR/MTU), per-host details, storage and an optional new network pool.
Why it’s in the workbookDomains grow by adding clusters; this captures each one.
Say it like this“When a domain needs more capacity we add a cluster — this tab captures that cluster’s spec.”
What it isAn internal store for cross-instance infrastructure values — fleet deployment CIDR/network/gateway/MTU/VLAN, plus DNS, NTP, SMTP and domain-controller entries shared across instances, and subnet allocations.
Why it’s in the workbookHolds the global/cross-instance values the workbook reuses; the name is just a developer label.
Say it like this“Don’t be thrown by the name — it’s a behind-the-scenes store for fleet-wide network, DNS and NTP values.”
Workbook tab 13 of 27
Value Reference Tables - MR
The multi-rack variant of the working IP/FQDN reference tables.
What it isWorking tables holding the per-component IP-address lists for the management and workload domains, sample FQDNs, and the PnP version — the source the entry tabs and As-Built sheets read from.
Why it’s in the workbookWhere “Value Missing” IP placeholders live until you fill the real values.
Say it like this“These feed the IP and FQDN entries you see elsewhere — you don’t edit them directly.”
Workbook tab 14 of 27
Value Reference Tables
Working tables holding per-component IP and FQDN values the entry tabs read from.
What it isWorking tables holding the per-component IP-address lists for the management and workload domains, sample FQDNs, and the PnP version — the source the entry tabs and As-Built sheets read from.
Why it’s in the workbookWhere “Value Missing” IP placeholders live until you fill the real values.
Say it like this“These feed the IP and FQDN entries you see elsewhere — you don’t edit them directly.”
What it isA reference scratch area for Site Protection & DR — reference hostnames and IPs for vSphere Replication, Site Recovery Manager and recovery NSX Tier-1 objects, for management and workload domains.
Why it’s in the workbookBacks the DR tabs with sample/reference values.
Say it like this“Another working sheet — it backs the DR planning with reference hostnames and IPs.”
Workbook tab 16 of 27
Additional Racks
Per-rack host and network-pool blocks for multi-rack growth.
What it isPer-rack host blocks (up to ~16 hosts per rack) and a per-rack network pool for multi-rack expansions — Rack 2, Rack 3, and so on.
Why it’s in the workbookLarger deployments span racks with their own VLANs/uplinks.
Say it like this“For multi-rack growth each rack gets its own networking block here.”
Workbook tab 17 of 27
Site Protection & DR
The protection blueprint. Much of it is reconfiguring DNS/NTP on the fleet and Operations nodes so they survive a site move, plus the DR appliance specifics.
What it isDefines which components are protected and how (backup-restore vs DR-tool).
Why it’s in the workbookNot every appliance is replicated — Automation and Operations restore from backup; others follow documented fleet-recovery procedures.
Watch-outDon’t design “replicate all 30 VMs.” Map each component to its supported protection method first.
Say it like this“We protect by method, not by blanket replication — Automation and Operations come back from backup, others via documented recovery.”
Workbook tab 18 of 27
Cyber Recovery
Deploys the Protection & Recovery appliance and wires up the SSO users it needs. Field families are appliance placement, networking, credentials and vCenter SSO registration.
What it isWhere and how the appliance lands: management vCenter, cluster, VM name, datastore, network, hostname, root/admin passwords, NTP, gateway, DNS, IP/prefix.
Why it’s in the workbookIt’s the engine for cyber-recovery operations.
Say it like this“This is the recovery appliance — we place it in management and give it identity, network and credentials.”
What it isThe consolidated VLAN & IP-subnet master for the management domain across both availability zones — Management VM, ESXi management, vMotion, vSAN, NSX Host Overlay, vSphere Replication, Edge Uplink 1/2, Edge Overlay and RTEP Overlay — plus the BGP requirements (edge AS, ToR IPs/AS/passwords) per AZ.
Why it’s in the workbookIt’s the single network record the fabric and DNS teams work from; safe to share because it carries no credentials.
Watch-outThis is a planning requirements sheet, not just a summary — if a row is blank, that network hasn’t been designed yet.
Say it like this“This is the network team’s master sheet — every VLAN, subnet and BGP value for both AZs in one place, no passwords, safe to hand over.”
Workbook tab 23 of 27
Version History
Which revision — and which calculation logic — you’re on.
What it isThe workbook’s version lineage. This guide maps to v1.9.1.004 (Jun 15 2026); recent revisions added API-only deployment options and a vCenter resize, and fixed sizing calculations.
Why it’s in the workbookTells you which revision — and therefore which calculation logic — you’re working with.
Watch-outAlways download a fresh workbook before a new design; the logic changes between versions.
Say it like this“We always start from a freshly downloaded workbook — an old copy can size things wrong because the logic changes.”
Workbook tab 24 of 27
Private AI Ready Infrastructure
Inputs for the Private AI validated solution — GPU enablement, Kubernetes/Supervisor, and the developer-ready infrastructure objects. Relevant when the customer is running AI workloads on VCF.
What it isThe cloud-hosted recovery path: a DRaaS connector appliance, a recovery SDDC in AWS (region, host type, VPC, subnets), a Cloud File System, service account and firewall rules.
Why it’s in the workbookRecovers to a cloud SDDC instead of a second on-prem site — capacity is spun up on demand at failover.
Watch-outIt’s a different product (VMware Cloud Disaster Recovery) from the on-prem Live Recovery appliance — don’t conflate the two tabs.
Say it like this“This is recovery into cloud on demand — a connector replicates to a cloud file system, and the recovery SDDC is created when you actually fail over.”
Workbook tab 26 of 27
Cross Cloud Mobility
The HCX-based validated solution for migrating workloads to a cloud SDDC (e.g. VMware Cloud on AWS). Inputs cover the HCX appliance, its network profiles, the vSphere role it needs, and the target cloud SDDC.
What it isThe HCX connector/appliance plus management and vMotion network profiles, a vSphere custom role, and VM folders/resource pool for the HCX appliances.
Why it’s in the workbookHCX is the migration fabric — it pairs your on-prem vCenter with the cloud SDDC and extends networks.
Watch-outNetwork Extension HA needs at least two extension appliances per switch / transport zone to form an HA group — don’t plan for one.
Say it like this“HCX is the mover — we register it with a vSphere role and set its management and vMotion profiles before any migration.”
What it isCloud SDDC name, AWS region, host type and count, VPC, subnets, management subnet, firewall rules, access groups, and the HCX license key.
Why it’s in the workbookDefines the destination environment workloads migrate into.
Watch-outThe firewall rule names and access groups must align with the cloud provider’s networking, or the HCX tunnels won’t establish.
Say it like this“This half is the cloud side — region, VPC, subnets and firewall openings HCX needs to reach the SDDC.”
Workbook tab 27 of 27
Active Directory Inputs
A tab handed to the customer’s AD team. It collects the directory structure and the service accounts every component needs to bind to AD. Often the long pole — start it early.
Reference values
Where you enter thisActive Directory created by the customer AD team — not a VCF UI
CEIPCustomer Experience Improvement ProgramTelemetry opt-in toggled during deployment.
PnPPlan and PrepareThe workbook itself / its version identifier.
Tools & reference
Objection handling FAQ
The pushbacks customers raise — and a straight answer for each.
“We’re reusing our own hardware — why does converging add so many VMs?”
Because the management plane is new even when the hosts aren’t. SDDC Manager, VCF Operations, the services runtime and NSX managers don’t exist in a plain vSphere estate — converging adds them. The hosts are reused; the control-plane appliances are net-new.
“Why does a workload domain consume management-domain resources?”
A workload domain’s vCenter and NSX controllers run up in the management domain, not out on the workload cluster. So every workload domain you add increases load on management, even if its hosts are elsewhere.
“Do we really need HA / three nodes of everything?”
HA is the production answer — it’s most of the VM growth. Single-node (Simple) is supported for labs/PoC, but it puts the management plane on single points of failure. The call is availability vs footprint; size both and let the customer choose.
“Our vDefend license won’t cover the whole estate — should we still deploy SSP?”
Licensing scope and deployment are separate questions. The SSP appliances run and consume resources regardless of how many cores you license; a partial license doesn’t shrink them. Decide first whether to deploy the capability, then separately which clusters to license.
“Isn’t two management domains overkill?”
For DR it’s the recommended pattern: a management domain running at the recovery site keeps a control plane alive to manage recovered workloads if the primary is lost. Federation makes the failover faster and policy-consistent.
“Can we skip NSX?”
No — NSX is mandatory in VCF 9.x. It underpins management connectivity, VPC networking, Supervisor/Kubernetes and Identity Broker integration, even if you’re not doing overlay on day one.
“What’s the absolute minimum to get started?”
The mandatory core: SDDC Manager, VCF Operations (+ cloud proxy), the VCF services runtime, and an NSX Manager — on 2 hosts (FC/NFS) or 4 (vSAN-ESA), with N+1 for HA. Everything else is Day-N.
“Which data center should host the management domain?”
Whichever has the most available resources for these appliances — that’s the first thing the sizing totals tell you. A site that already runs NSX/Avi is a practical tiebreaker because there’s more headroom and fewer new pieces.
“Are these components patched separately?”
They’re appliances under unified lifecycle through VCF Operations / SDDC lifecycle; you can drive patch/upgrade workflows rather than touching each one. The dependency order still matters: SDDC Manager → vCenter → ESX → NSX.
Built from the VCF 9.1 Planning & Preparation Workbook (v1.9.1.004) and validated against Broadcom TechDocs — an internal enablement aid, not official Broadcom documentation. The estimator is illustrative; confirm against the live workbook, Configuration Maximums and the Compatibility Guide.