Kieri Solutions - CMMC assessment and NIST SP 800-171 compliance services
Sign In
Open navigation menu - Kieri Solutions
Sign In
Request Gap Analysis
Home
Step by Step: Upgrade vCenter VCSA 6.0 (or 6.5) to 6.7

Step by Step: Upgrade vCenter VCSA 6.0 (or 6.5) to 6.7

Share Kieri Solutions CMMC Compliance Blog Posts On LinkedIn Share Kieri Solutions CMMC Compliance Blog Posts On X

In this article

Step by Step: Upgrade vCenter VCSA 6.0 (or 6.5) to 6.7

These screenshots show the entire process to upgrade vCenter from 6.0 to 6.7 using a Windows 10 desktop as my administrative workstation.   The same steps work for vCenter 6.5 to 6.7.

Is your existing vCenter server running on Windows?  This article is primarily about upgrading vCenter appliances (linux-based).  If you have a Windows vCenter server, check the comments for instructions from Greg Curry.  Thanks Greg!

 

Preparing for the vCenter appliance upgrade

First, create a snapshot for your existing vCenter server. If you have disk space available, make sure to Quiesce memory.
Log on to vmware.com and navigate to the Downloads section. Pick vCenter Server from the list. (It does not matter if you choose Essentials, Standard, etc, they are all the same).
Verify the version you want to use (it will default to the latest one), and click Download for VMware vCenter Server Appliance, file type = iso.   Now wait for a bit for it to download.
Navigate to your downloads folder when the download completes. In Windows 10, you can double-click the file to mount it to a virtual DVD drive. For non Windows workstations, use an .iso viewer or burn the image to a CD then open it on the CD.
Navigate to the contents of your .iso file. On Windows 10, use Windows Explorer and look for the files inside your DVD drive.  Then expand vcsa-ui-installer to open that folder.
Expand the folder  that matches your computer (Windows 7, 8, and 10, pick win32)
(Windows 7, 8, 10) Run the installer.exe file to start the upgrade wizard.

Appliance Upgrade Stage 1

Options display. For this scenario, pick Upgrade (to upgrade an existing vCenter appliance from 6.0 or 6.5 to 6.7)
The VCSA introduction screen displays.
Agreement displays. You need to accept it to proceed.
Enter the DNS name for your existing vCenter server.  You can look this up in the address bar when you open vCenter to manage your VMware environment.  Port 443 is appropriate for almost everyone, unless the IT department has customized this.  When you Connect to Source, the rest of the window will display.
Most environments will use [email protected] for the SSO User name.  SSO password is the password for the user name you entered above (administrator@vsphere.local).  Appliance (OS) root password means the root password for your vCenter appliance website (https://vcenter01.company.com:5480).  See next step to identify which ESXi host is managing your appliance.

——————

Additional info from Todd who provided this quote in the comments (Thanks Todd!)

I ran into one minor issue during the “Upgrade Stage 1: Deploy Appliance” phase. Operation would halt with “Failed to authenticate with the guest operating system using the supplied credentials.” I know they’re good as I can login to VCSA, VAMI, MOB, ESXi using them.

I changed all of the passwords to numbers and letters only with a single known good special character tacked on at the end. Et Voila! Problem solved. The rest of the upgrade proceeds without errors.

Passwords like these will not work with this utility:

Tv5$8FG#m*Djn
7xjg8sP%C#usXH8H
X8xk$vR^q9ccw@WxR

———————–

 

In the VMware hosts & clusters view, if you select your existing vCenter server and go to the Summary tab, you can see the address of the ESXi host.
You will get prompted to review the certificate. Just click Yes.
Now enter the ESXi server that will host your upgraded vCenter server.  Yes, we are making a new vCenter server with this procedure.  The old vCenter will be powered off if the upgrade succeeds.   Make sure you pick a host that has plenty of RAM and disk (at least 12 GB RAM, at least 500 GB disk) available.
This is where you set the name and password for your new vCenter.   The name will be displayed in VMware Hosts & Clusters.  This is not the DNS name or IP address for your new vCenter.  Your new vCenter will inherit the existing DNS name and IP address since we are doing an upgrade.
Almost all medium and small businesses use Tiny for deployment size and Large for storage size.    If you have 10 or less ESXi servers, use Tiny.
Pick the datastore that will host your new vCenter server.  Remember that by default it will use 850 GB thick provisioned for a Tiny deployment.

Optional:  Check the “Enable Thin Disk Mode” so that your vCenter server uses less disk space (about 80 GB).  This is mildly dangerous because the usage can grow over time and cause a datastore to fill up (crashing all VMs on the datastore), but for most small environments it doesn’t grow more than a few GB per year and 850 GB is WAY more than you need. 

These are the network settings that your new vCenter server will use.  Make sure to pick a Network that both your existing vCenter and the new vCenter can communicate on, with their IP addresses.  The new vCenter will use the Temporary IP address for a few minutes during the upgrade process, then it will switch to the existing IP address of your vCenter server.    Make sure no other devices are using the Temporary IP address.
Ready to complete displays.  When you click Finish, the deployment will start.
Even across WAN links, this process takes less than an hour.    Make sure that your workstation doesn’t disconnect from the work network during this process.  (If it does disconnect, no problem, just re-start from the beginning.)

Errors that can occur during stage 1

If you used the wrong password for the old vCenter, the source host, or the destination host, you may get an error at this point.

If you are on an unstable VPN link, you may get an error.  Try running the upgrade from a workstation or server on the LAN.

If you used DNS instead of IP addresses, try changing to IP addresses.

Temporary IP error: The upgrade will attempt to ping the IP address you chose for the temporary vCenter IP address.  If it pings, the upgrade will fail.  Make sure nothing is using that IP.

For information about cleaning up failed upgrade steps, see troubleshooting at the bottom of the article.

Stage 2 Upgrade VCSA

Phase 1 shows complete. The new vCenter virtual machine is deployed, but not configured. Beginning Phase 2 of the upgrade.
Introduction for Stage 2 displays.  Click Next.
It is normal to get several warnings.  Errors are bad, and will cause your upgrade to fail. Warnings are not bad.   Read them and take action if appropriate.
Most small and medium businesses don’t have that much data in their vCenter.  In this example, there is only 3.18 GB of data to transfer.   Since there is not a big difference between the sizes of each choice, I choose to move over everything.  It is good to retain historical data when possible.
Most businesses are fine to join the CEIP. If you are working on a secure network, then don’t check it.
Ready to complete displays.   You will need to check that you have backed up the source vCenter server (you did, right?).  Ways to perform backups:  1) Veeam. 2) Create that snapshot at the beginning of this post. 3) Use the appliance website (https://vcenter.company.com:5480) and click the Backup button (you will need a web server or SCP host to do this).   The reality is that this upgrade process doesn’t delete your original server. At the worst, it powers it off.  There is very little risk of harming your original vCenter.
Phase 2 proceeds.  It should finish within about 30 minutes.

Possible errors during phase 2

NTP error:  Make sure your source VCSA has good NTP settings which are the same as the host you are using for source and destination.  See this VMware article about configuring NTP.   https://kb.vmware.com/s/article/57146   If you don’t have an internal time server, then the recommended option is to point to internet NTP servers: 0.vmware.pool.ntp.org    ;  1.vmware.pool.ntp.org  ; 2.vmware.pool.ntp.org

Success!!

At this point, your upgrade should be successful.   When the upgrade wizard completes, your old vCenter will be powered off and your new vCenter (running 6.7) will be powered on.

You may want to rename your old vCenter to something like “old_vCenter01”.

Test your ability to log onto the vCenter appliance (https://vcenter01.company.com:5480)

Test your ability to manage your virtual machines (https://vcenter01.company.com/vsphere-client)

Make sure to check your backup jobs.  They should switch to using the new vCenter automatically, but double-check.

Once you are comfortable with the new vCenter and you have at least one good backup of it, you can delete your old one.

Remember that if the new vCenter doesn’t work, you can revert your changes simply by powering it off and powering the new vCenter on.  You may need to log into individual hosts (https://host_ip_address) to do this if your vCenter isn’t working.

Troubleshooting:

Manually verify every password for each device (your existing vCenter administrator@vsphere.local, your existing vCenter root, the source ESXi host root, the destination ESXi host root).  It is common for the vCenter root to be expired.  See my other blog for easy steps to fix an expired vCenter root password.

Orphaned vCenter attempts:  If your deployment fails, the new vCenter may display as orphaned.  There is no impact at this time, because you will continue using your existing vCenter.  I’ve heard that using VMware Workstation to connect to your vCenter will allow removal.  There is a blog that describes various methods for dealing with orphaned VMs: https://www.altaro.com/vmware/how-to-deal-with-orphaned-virtual-machines/  For a more authoritative source, see VMware KB article for removal steps: https://kb.vmware.com/s/article/1003742#vmdeleted

Upgrade failed with “Failed to send http datainstaller…”  The fix seems to be not using DNS for anything.  Change all your server names to IP addresses!   Reference https://virtuallyinclined.com/2018/07/30/vsphere-6-7-vcsa-upgrade-issues/

Selfish plug time (sorry!)

Thanks for reading this article! I hope it helps you! If you have tips or feedback, please comment or send me an email so that others can benefit.

I am a consultant in the Maryland/DC area in the USA. My specialties are Windows migrations (to 2016 and to Office 365 / Azure), VMware migrations, Netapp and SAN, and high availability / disaster recovery planning. If you would like help with your complex project, or would like a architectural review to improve your availability, please reach out! More information and contact can be found on the About page. – Amira Armond

Cybersecurity data analysis supporting CMMC Level 2 audit preparation for defense contractors

Talk to an Expert

Tell us where you are with compliance and we’ll map out the next steps for your team.

Book a Consultation

Don't miss these

Is Your Security Plan Telling the Truth?
Server room corridor lined with racks in a data center covered by a System Security Plan
Is Your Security Plan Telling the Truth?
What Does the Government Actually Require of You Today?
A network of yellow lines connecting round nodes against a dark background.
What Does the Government Actually Require of You Today?
NIST SP 800-171 Rev 3, What Changed and What It Means for Your CMMC Timeline
Man at a desk in a dark office reading text on a computer monitor, NIST SP 800-171 Rev 3
NIST SP 800-171 Rev 3, What Changed and What It Means for Your CMMC Timeline
CMMC Backup Requirements and The Myths Worth Ignoring
Server backup drives in a dark data center supporting CMMC backup requirements for a defense contractor
CMMC Backup Requirements and The Myths Worth Ignoring
How to Prepare for a DIBCAC High Assessment
Analyst reviewing evidence on dark dual monitors while preparing for a DIBCAC High assessment
How to Prepare for a DIBCAC High Assessment
Out of Scope Assets - What the Final Rule Actually Changed
Abstract data cityscape tied to out of scope assets in a CMMC assessment by Kieri Solutions
Out of Scope Assets - What the Final Rule Actually Changed
CMMC Proposed Rule Analysis - What Defense Contractors Need to Know
Dark cybersecurity image with glowing data illustrating CMMC final rule compliance for defense contractors
CMMC Proposed Rule Analysis - What Defense Contractors Need to Know
CMMC Phase 2 Suspended and What Defense Contractors Need to Know
Analyst reviewing code while working toward CMMC and NIST 800-171 compliance
CMMC Phase 2 Suspended and What Defense Contractors Need to Know
CUI Assets - What Assessors Actually Evaluate
Abstract network of nodes tied to CUI assets and CMMC scope assessed by Kieri Solutions
CUI Assets - What Assessors Actually Evaluate
Do I Even Have CUI? Understanding What You Need to Protect
Abstract data network tied to finding CUI on a defense contractor network with Kieri
Do I Even Have CUI? Understanding What You Need to Protect
Why the DoD Wants Security Protection Data Protected Like CUI
Abstract data network tied to security protection data and CMMC scope assessed by Kieri
Why the DoD Wants Security Protection Data Protected Like CUI
Why Your CMMC Gap Analysis Might Be Worthless - 110 Practices vs 320 Assessment Objectives
Cybersecurity professional conducting CMMC gap analysis for a defense contracting organization
Why Your CMMC Gap Analysis Might Be Worthless - 110 Practices vs 320 Assessment Objectives
Building a CMMC Level 2 Compliant Network You Can Actually Manage
Network architecture visualization for a CMMC Level 2 reference architecture built on Microsoft 365 GCC High
Building a CMMC Level 2 Compliant Network You Can Actually Manage
Why Most CMMC Documentation Fails and How to Fix It
CMMC compliance documentation policies and procedures
Why Most CMMC Documentation Fails and How to Fix It
What Passed a DOD Assessment for System Baselining and Inventories
CMMC system inventory and baseline configuration monitoring dashboard
What Passed a DOD Assessment for System Baselining and Inventories
How to Implement Mobile Code Requirements for CMMC Level 2
CMMC mobile code security controls and technical implementation
How to Implement Mobile Code Requirements for CMMC Level 2
What Does "Monitor" Actually Mean in CMMC Requirements?
CMMC monitoring requirements - access control and password security verification
What Does "Monitor" Actually Mean in CMMC Requirements?
The Version 20 Problem and How to Avoid It
CMMC compliance documentation sequence - cybersecurity program management
The Version 20 Problem and How to Avoid It
Build Your Own CMMC Level 2 Compliant Environment with the Kieri Reference Architecture
CMMC Level 2 compliant environment security controls and access management
Build Your Own CMMC Level 2 Compliant Environment with the Kieri Reference Architecture
Inside the KCD - What Makes This Documentation Different
CMMC compliance documentation templates digital security
Inside the KCD - What Makes This Documentation Different
How the Kieri Compliance Documentation and Reference Architecture Work Together
Kieri Compliance Documentation and Reference Architecture working together for CMMC Level 2 compliance
How the Kieri Compliance Documentation and Reference Architecture Work Together
What's Actually Inside the Kieri Compliance Documentation? A Complete Walkthrough
CMMC compliance documentation and reference architecture security controls - fingerprint scanning and access management
What's Actually Inside the Kieri Compliance Documentation? A Complete Walkthrough
CMMC Assessments by Kieri Solutions
Global cybersecurity compliance support for defense contractors under DFARS
CMMC Assessments by Kieri Solutions
CMMC Education: User vs Network Session Termination
Secure IT infrastructure design supporting CMMC Level 2 compliance for defense contractors
CMMC Education: User vs Network Session Termination
CMMC Proposed Rule has been released! 
Cybersecurity threat - CMMC compliance
CMMC Proposed Rule has been released! 
Interested in the Kieri Compliance Documentation?
Secure data transmission within CMMC compliant network architecture
Interested in the Kieri Compliance Documentation?
How to fix Outlook missing Friday January 13 2023
Interconnected defense contractor networks requiring CMMC Level 2 cybersecurity certification
How to fix Outlook missing Friday January 13 2023
C3PAO Meeting - July 26, 2021 12-1 pm EDT
C3PAO Meeting - July 26, 2021 12-1 pm EDT
NIST SP 800-171 DoD Self Assessment Services
DFARS 252.204-7012 and NIST SP 800-171 requirements
NIST SP 800-171 DoD Self Assessment Services
vSphere Health detected new issues in your environment 6.7
vcenter 6.7 alarm displays vsphere health detected new issue
vSphere Health detected new issues in your environment 6.7
vCenter Health Warning: External Platform Services Controller
vCenter Health Warning: External Platform Services Controller
Synology storage latency and disconnects on VMware
Synology storage latency and disconnects on VMware
Windows Stuck in Recovery Mode Datto driver signing
Windows Stuck in Recovery Mode Datto driver signing
Office 365 MFA App Password Missing Fix
Office 365 MFA App Password Missing Fix
Microsoft Teams Conference Calls & Dial-In Numbers
Microsoft Teams Conference Calls & Dial-In Numbers
C: Drive Full Exchange
C: Drive Full Exchange
Exchange server very slow, services and network blank
Exchange server very slow, services and network blank
Exchange 2016 DAG - 3 servers 2 sites
Diagram showing mailbox servers with active and passive databases. Each database is only active on one server.
Exchange 2016 DAG - 3 servers 2 sites
Netapp 3rd-party CA certificates expiring DeutscheTelekomRootCA2
Kieri Solutions partnering with defense contractors to achieve CMMC Level 2 certification
Netapp 3rd-party CA certificates expiring DeutscheTelekomRootCA2
vCenter 6.7 Memory Exhaustion and vSphere health (Tiny)
warning vsphere health detected new issue memory exhaustion 6.7 vcenter
vCenter 6.7 Memory Exhaustion and vSphere health (Tiny)
Step by Step: Upgrade vCenter VCSA 6.0 (or 6.5) to 6.7
Step by Step: Upgrade vCenter VCSA 6.0 (or 6.5) to 6.7
How to prepare for a DoD CMMC audit and certification
cybersecurity CMMC DoD NIST 800-171 compliance nist 800-53
How to prepare for a DoD CMMC audit and certification
Fix Expired vCenter Root Password (6.5 & 6.7)
Fix Expired vCenter Root Password (6.5 & 6.7)
How to rename Windows Server 2016 Domain Controller
How to rename Windows Server 2016 Domain Controller
Runtime Error Adding Host in VMware vCenter & ESXi
add host a general runtime error occurred vcenter 6.5 6.7
Runtime Error Adding Host in VMware vCenter & ESXi
How to fix Netapp expired self-signed certificate by creating a new one
netapp certificate expired install site cant be reached
How to fix Netapp expired self-signed certificate by creating a new one
How to register a warranty or service agreement on HPE website
hpe hp register account SAR ID service agreement warranty how accept
How to register a warranty or service agreement on HPE website
How to install vCenter 6.7 (and 6.0 and 6.5) with no DNS, only IP address
vcenter ip address no dns
How to install vCenter 6.7 (and 6.0 and 6.5) with no DNS, only IP address
How to disable continuous scrolling on Kindle - turn on page flip
disable continuous scrolling option displays
How to disable continuous scrolling on Kindle - turn on page flip
17hats how to export or convert to Excel CSV TAB XLS workbook
17hats export convert iff to csv tab excel
17hats how to export or convert to Excel CSV TAB XLS workbook
How to fix "Cannot apply changes to this Internet Shortcut" Windows
cannot apply changes to this internet shortcut 2016 2019
How to fix "Cannot apply changes to this Internet Shortcut" Windows
Best Free Computer Incident Response Templates and Scenarios
best free incident response reporting form cybersecurity IT
Best Free Computer Incident Response Templates and Scenarios
Firmware & System Patching Services | DC & Maryland
poweredge server raid reconfigure add disks 1 5
Firmware & System Patching Services | DC & Maryland
Network hardening near Baltimore MD, Frederick, Rockville, Gaithersburg and DC
Best practice network segmentation and hardening prevents pivot attacks NIST
Network hardening near Baltimore MD, Frederick, Rockville, Gaithersburg and DC
VMware vSphere ESX and vCenter Upgrade 5.5 to 6.0 or 6.5 or 6.7 best practices
Best practices and how to install esxi vsphere vcenter vmware and troubleshooting problems during the migration
VMware vSphere ESX and vCenter Upgrade 5.5 to 6.0 or 6.5 or 6.7 best practices
Disaster Recovery & Business Continuity in DC & Maryland
disaster recovery drp bcp hipaa frederick columbia gaithersburg baltimore rockville
Disaster Recovery & Business Continuity in DC & Maryland
VMWare and Netapp consultant in DC, Baltimore, Columbia, Frederick, and Rockville MD
installation services netapp disk shelf baltimore columbia rockville
VMWare and Netapp consultant in DC, Baltimore, Columbia, Frederick, and Rockville MD
SBDC - Intro to GDPR training - Frederick MD
intro gdpr overall sbdc fitci frederick
SBDC - Intro to GDPR training - Frederick MD
GDPR and Human Resources
cybersecurity cyber security hardening compliance firewall design frederick
GDPR and Human Resources
No, your computer isn't slow.
why slow computer pc repair frederick damascus mt airy md
No, your computer isn't slow.
Why you should consider a credit freeze - EquiFax hack
credit freeze equifax hack how to breach innovis
Why you should consider a credit freeze - EquiFax hack
Virtual Servers, Storage, and SAN - Why your servers are slow
cybersecurity compliance design consulting engineering
Virtual Servers, Storage, and SAN - Why your servers are slow
How to un-freeze your laptop like a pro
pc or computer problem repair damascus lisbon mt airy laytonsville
How to un-freeze your laptop like a pro
Upgrade your IT Services for the New Year
managed services it department outsource company frederick columbia germantown gaithersburg
Upgrade your IT Services for the New Year
Dell PowerEdge R730 PERC RAID online reconfiguration
poweredge server raid reconfigure add disks 1 5
Dell PowerEdge R730 PERC RAID online reconfiguration
Dreamhost HTTP error Wordpress media upload and library
dreamhost http error picture disappear upload shared wordpress
Dreamhost HTTP error Wordpress media upload and library
FortiAnalyzer Configuration problems after initial deploy
FortiAnalyzer 5.4 Storage Quota Limits for ADOM root
FortiAnalyzer Configuration problems after initial deploy
FortiAnalyzer Report: User Web Browsing by Category
fortianalyzer custom report users by category who is browsing web goofing off
FortiAnalyzer Report: User Web Browsing by Category
GDPR Consulting - What you need to know
cybersecurity CMMC DoD NIST 800-171 compliance nist 800-53
GDPR Consulting - What you need to know
The #1 Computer Security Threat Just Evolved - RCE Worm
cybersecurity cyber security compliance firewall frederick md
The #1 Computer Security Threat Just Evolved - RCE Worm
Fix vSphere & vCenter Datastore Size Reverting
security design cybersecurity consulting services compliance
Fix vSphere & vCenter Datastore Size Reverting
HP DL360p g8 ESXi 5.5 to 6.5 upgrade conflicting_vibs_error
conflicting vibs error vsphere upgrade metadata consultant vmware
HP DL360p g8 ESXi 5.5 to 6.5 upgrade conflicting_vibs_error
Is your IT person holding the network hostage?
Server Upgrade Cybersecurity Consultant SAN Netapp Frederick
Is your IT person holding the network hostage?
4 Hiring Mistakes When Choosing an IT Company
mistakes when hire IT consultant MSP managed service provider computer support outsourcing
4 Hiring Mistakes When Choosing an IT Company
What you should know about Cloud Computing and Office 365
cloud IT department migration Office 365 Frederick Baltimore Columbia MD
What you should know about Cloud Computing and Office 365
Can You Make Our Nation Safe from Hackers?
Can You Make Our Nation Safe from Hackers?
The Ultimate Way to Protect Against Computer Theft
Kieri Solutions site icon
The Ultimate Way to Protect Against Computer Theft
Small / medium business security concerns
managed services it department outsource company frederick columbia germantown gaithersburg
Small / medium business security concerns
Approaches to security policy
cybersecurity cyber security hardening compliance firewall design frederick
Approaches to security policy

Article

Is Your Security Plan Telling the Truth?
Read More
Server room corridor lined with racks in a data center covered by a System Security Plan

Article

What Does the Government Actually Require of You Today?
Read More
A network of yellow lines connecting round nodes against a dark background.

Article

NIST SP 800-171 Rev 3, What Changed and What It Means for Your CMMC Timeline
Read More
Man at a desk in a dark office reading text on a computer monitor, NIST SP 800-171 Rev 3

No one wants to start from blank templates.

No one wants to start from
blank templates.

Stop starting from blank templates. Get documentation proven through actual CMMC Level 2 assessment.

Schedule Demo