VMware ESXi and vSphere Cluster Management

Configure Networking and Initial Setup for vCenter Server Appliance

Learn how to configure VCSA networking, validate DNS and connectivity, access legacy VAMI, complete first-time setup, and sign in to vCenter.

The vCenter Server Appliance (VCSA) is a VMware virtual appliance that provides vCenter Server services. Before administrators can complete setup or use vCenter, the appliance needs reachable network settings. These settings include an IP address, subnet information, gateway, DNS servers, and a hostname or FQDN (fully qualified domain name), such as vcsa.lab.example.

This lesson includes legacy console and VAMI procedures because older VCSA releases expose different menus, ports, and URLs from current releases. Exact screens, credentials, ports, and service behavior vary by version. Always confirm the procedure for the installed release before changing a production appliance.

1. Plan the Appliance Network Configuration

Choose either DHCP or a static IP address before configuring the appliance. DHCP, or Dynamic Host Configuration Protocol, assigns network settings automatically. A static IP address is assigned manually and is intended to remain stable.

Setting	Example	Purpose	Where Used
FQDN	`vcsa.lab.example`	Stable hostname and certificate identity	DNS, management URL, vSphere access
IPv4 address	`192.0.2.50`	Address assigned to the appliance	Network interface and browser access
Subnet mask or prefix	`255.255.255.0` or `/24`	Defines the local IPv4 subnet	IP configuration prompt
Default gateway	`192.0.2.1`	Router used to reach other networks	Routing configuration
Primary DNS	`192.0.2.10`	Resolves names to addresses	Hostname and service resolution
Secondary DNS	`192.0.2.11`	Provides an additional resolver	DNS redundancy

For a production management appliance, use a static address or a DHCP reservation. Before assigning a static address, verify that it is unused and does not conflict with a DHCP scope, reservation, or existing DNS record.

Method	Benefits	Risks	Recommended Use
DHCP	Fast initial connectivity; settings are supplied automatically	Address may change; DNS and lease tracking can be unclear	Labs, testing, or initial deployment followed by a reservation
Static IP	Predictable management address and stable service identity	Typing errors or duplicate addresses can interrupt access	Production infrastructure and documented lab appliances

DNS and firewall checks

Create a forward DNS record mapping the appliance FQDN to its configured IP address.
Where required by your environment, create matching reverse DNS so the address maps back to the same FQDN.
Resolve the FQDN from the administrator workstation before depending on name-based URLs.
Confirm that the selected port group, VLAN, routing, and firewall rules allow access from trusted administrator networks.
Allow the appliance management interface and vSphere client interface required by the installed VCSA version.

2. Open the Appliance Console

Open the vSphere or ESXi management interface.
Locate the VCSA virtual machine and open its virtual machine console.
Select the appliance console login option and authenticate as the appliance administrator.

Legacy lab images may contain factory-default credentials. Do not rely on those credentials in production. Use the credentials assigned during deployment and change any default password immediately.

3. Configure Networking with the Legacy VAMI Utility

VAMI means Virtual Appliance Management Interface. In legacy VCSA releases, VAMI includes appliance configuration tools and a browser-based management interface. From the appliance console shell, launch the legacy network utility:

/opt/vmware/share/vami/vami_config_net

This path is release-specific and may not exist on current VCSA releases. If the command is unavailable, identify the appliance version and use its supported network configuration procedure.

Menu Option	Configuration Item	Expected Input	Validation Check
Default gateway	Gateway	Router on the appliance subnet, for example `192.0.2.1`	Gateway belongs to the local subnet and routes outward
DNS configuration	Primary and secondary DNS	`192.0.2.10` and `192.0.2.11`	Resolvers are reachable and contain the appliance record
Hostname	FQDN	`vcsa.lab.example`	Forward DNS resolves to the appliance address
IP address configuration	Address and subnet	`192.0.2.50` with `/24` or `255.255.255.0`	Address is unused and matches the planned subnet
Review	Complete configuration	Inspect every displayed value	No spelling, mask, gateway, or DNS errors remain
Exit	Leave the utility and console session	Save changes, then exit safely	Configuration is applied before closing the session

Use the utility prompts to configure the hostname or FQDN, DNS servers, default gateway, and IP address. For the sample lab plan, enter:

FQDN:              vcsa.lab.example
IPv4 address:      192.0.2.50
Subnet:            /24
Subnet mask:       255.255.255.0
Default gateway:   192.0.2.1
Primary DNS:       192.0.2.10
Secondary DNS:     192.0.2.11

Choose the IP address configuration function and select manual or static IPv4 configuration when prompted.
Enter the address and subnet mask or prefix length.
Set the default gateway for that subnet.
Configure primary and secondary DNS servers.
Supply the complete FQDN, not only the short hostname.
Use the review function to inspect all values.
Apply or save the configuration, then exit the utility.
Exit the console session safely after the changes have been saved.

4. Validate the Network

After changing network settings, a network restart, service restart, or short wait may be required. The exact behavior depends on the VCSA release.

Review the assigned IP address, subnet, gateway, DNS servers, and FQDN for typing errors.
From an administrative workstation, test reachability using the appliance IP address.
Resolve the FQDN and verify that it returns the configured appliance address.
Check that the gateway and firewall permit access from the workstation.

For example, resolve vcsa.lab.example from the workstation. If it returns an incorrect address or does not resolve, correct DNS before continuing. DNS problems can later affect certificates, SSO, and service access.

5. Connect to the Appliance Management Interface

Open the appliance management interface over HTTPS using the appliance FQDN or IP address. Legacy releases commonly use port 5480:

https://<appliance-name-or-ip>:5480

Authenticate with the appliance administrative account. This interface is separate from the vSphere client. If the browser warns that the TLS certificate is self-signed or untrusted, verify the certificate subject, name, and fingerprint through a trusted administrative path when possible. A temporary warning may be expected during initial setup, but do not ignore an unexpected certificate identity.

Accept the EULA, or end-user license agreement, when the setup interface requests it.

6. Complete First-Time Appliance Setup

Choose the default or guided configuration path offered by the installed version.
Review the proposed appliance, networking, and service settings.
Choose whether to participate in optional telemetry or technical-data collection. Telemetry is diagnostic and usage information sent to VMware.
Review advanced choices before production use. These can include static networking, SSO (Single Sign-On), database-related settings, time synchronization, and certificate behavior.
Review the final configuration summary carefully.
Start the initialization process.
Wait for initialization and the required services to become available. Do not power off the appliance while the process is running.

Default setup can defer advanced configuration, which may be suitable for a lab but not for production. Confirm that the SSO domain and administrative identity are documented. SSO is the VMware authentication domain and identity service used by vCenter.

7. Access vCenter After Initialization

The vSphere Client is the browser-based client used to manage vCenter inventory and resources. Its URL depends on the release family.

Release Family	Appliance Management Endpoint	vSphere Client Endpoint	Authentication Notes
Legacy VCSA releases	`https://<appliance-name-or-ip>:5480`	`https://<appliance-name-or-ip>:9443/vsphere-client`	Port-based interfaces are common; use the documented vCenter or SSO identity
Modern VCSA releases	Version-specific VAMI endpoint, commonly reached through the appliance HTTPS interface	Commonly the standard HTTPS endpoint, such as `https://<appliance-name-or-ip>/ui`	Use the release-specific vCenter SSO account and URL

Modern releases generally use standard HTTPS rather than the legacy port-based client URL. Sign in with the correct vCenter or SSO identity for the release. The appliance root account is the operating-system administrative account; it is not necessarily the identity used to administer vCenter.

Confirm successful login by checking that the vCenter inventory loads and that basic navigation is available. Continue with adding an ESXi host to vCenter Server inventory when appropriate.

8. Post-Configuration Security and Operations

Change legacy default credentials immediately.
Use a static address or DHCP reservation for the VCSA.
Confirm time synchronization; accurate time supports authentication, certificates, and logs.
Verify forward and reverse DNS requirements.
Plan certificate issuance, renewal, and trust distribution. A TLS certificate secures HTTPS access and identifies the appliance.
Establish VCSA backup and restore procedures.
Plan patching and lifecycle maintenance.
Restrict management-interface access to trusted administrator networks.
Document the FQDN, IP address, gateway, DNS servers, management URL, client URL, and account ownership.

For related identity planning, review vCenter SSO deployment modes and vCenter SSO policies. For broader deployment context, see vCenter Server simple installation.

Troubleshooting

The appliance does not receive a DHCP address

Verify that the virtual NIC is connected to the intended port group and VLAN.
Check the DHCP server for a lease and available addresses.
Check for MAC filtering or other network policy restrictions.
Use console-based static configuration if DHCP is unavailable.
After initial access, create a DHCP reservation or migrate to a planned static address before production use.

The management page cannot be opened

Verify the IP address, subnet mask, gateway, and appliance power state.
Test reachability from the workstation.
Check firewall and routing rules.
Confirm the management port for the installed version; legacy VAMI commonly uses 5480.
Wait for services to finish initializing and retry.

The FQDN resolves incorrectly

Correct or create the forward DNS record.
Confirm that the configured DNS servers are reachable.
Remove stale or duplicate records.
Verify that the returned address equals the appliance address.

Login fails

Confirm whether the target requires the appliance root account or a vCenter SSO identity.
Use the deployment-documented password rather than assuming a factory default.
Remember that changing the root password does not necessarily change the vCenter SSO administrator password.
Follow the supported password recovery procedure for the applicable release.

The browser shows an untrusted certificate warning

An initial self-signed certificate can cause a warning.
Accessing by IP can produce a name mismatch when the certificate contains the FQDN.
Verify the certificate fingerprint and identity.
Use the configured FQDN and replace or regenerate certificates according to organizational policy.

The legacy command or port-based URL fails

The appliance may be a newer VCSA release, or the procedure may target an older interface. Identify the installed version and use the version-specific VAMI and vSphere Client endpoints. Do not assume that /opt/vmware/share/vami/vami_config_net, port 5480, or port 9443 exists on every release.

Exam-Relevant Notes

DHCP assigns settings automatically; a static IP is manually assigned and intended to remain stable.
The default gateway reaches networks outside the local subnet.
DNS and FQDN correctness are important for service access, certificates, and SSO.
The VAMI management interface and vSphere Client are separate interfaces.
The appliance root account is not automatically the vCenter SSO administrative identity.
Legacy and modern VCSA releases use different screens, ports, and URL structures.