vSphere SSO and DNS

[DTMnz]

Hi Team,

We are setting up a new environment which is going to span three different datacenter locations in three different countries, New Zealand, Australia and Canada. This will be a very small install initially running on standard licensing. NZ will hold our vCenter appliance with integrated PSC and this will control clusters in Australia and Canada. I have a few questions though on best practice and I'm finding it difficult to source the information i want, I was wondering if anyone could help me with the following?

1. What is best practice with DNS and vSphere? Let's say our AD domain name is domain1.com. Should I setup new forward and reverse zones in our DNS, something like vsphere.local, so my first host would be something like esx1.vsphere.local? Or would I be aiming for something like esx1.domain1.com?
2. I was also thinking about using vsphere.local for my SSO domain name too, can I do this? Or do I have to have a separate SSO domain name? So I use my SSO domain as vsphere.local and then I setup vsphere.local in DNS and name all my hosts as above?

I hope that makes sense.

[daphnissov]

First of all, let me point out that

NZ will hold our vCenter appliance with integrated PSC and this will control clusters in Australia and Canada

is likely to give you some bad times with that cluster in Canada due to an extreme amount of latency. You may possibly have issues with the one in Oz as well depending on your circuit. What is best practice and most common in such a geographically-dispersed organization such as the one you have is to deploy a vCenter Server at each of these sites which manages those resources, and then to join them all in enhanced linked mode. With the release of vSphere 6.7, ELM can be achieved with built-in PSCs as opposed to external. On to your questions.

1. What is best practice with DNS and vSphere? Let's say our AD domain name is domain1.com. Should I setup new forward and reverse zones in our DNS, something like vsphere.local, so my first host would be something like esx1.vsphere.local? Or would I be aiming for something like esx1.domain1.com?

You should always have forward and reverse resolution for everything in your vSphere, this includes ESXi hosts and especially vCenter. Name your ESXi hosts something on your domain1.com infrastructure, not vsphere.local. vsphere.local is the default name of the SSO domain within the PSC (which you should plan to reuse) and this has no bearing on the ESXi hosts names.

I was also thinking about using vsphere.local for my SSO domain name too, can I do this? Or do I have to have a separate SSO domain name? So I use my SSO domain as vsphere.local and then I setup vsphere.local in DNS and name all my hosts as above?

No, no need to do this. See answer to #1. The SSO domain name will not become a machine name for any ESXi hosts. Only name your hosts what you require from your user domain.